Recombining TCP sessions based on finite state machine to detect cyber attackers

Attacks in the cyberspace is becoming more and more diverse and complex. Many attackers divide the payload in a TCP package into a set of IP packets. Though traditional attack detecting methods designed based on feature matching algorithm can only analyze a single IP packet, the cannot comprehensively analyze multi-packets. Therefore, the traditional methods cannot effectively detect the attackers' payload that are split up into multi-packets. Consequently, it is quite necessary to reassemble packets on the application layer and restore the payload that is distributed in multiple packets. Then, we can analyze the complete attacker's payload flexibly. In this work, we propose a TCP session bidirectional data flow reassembly method based the Finite State Machine (FSM). Besides, we evaluate the performance of our work using the Spark platform. Simulation results show that our method is of high accuracy and good performance in expansibility.