Detection defense method for distributed reject service and network appliance

Abstract

The embodiment of the invention relates to the communication field, and provides a distributed service-refusal detection defense method and network equipment thereof. The method comprises the following steps: the number N of reached data packages in unit time is counted and compared with a threshold value; when N is not lager than the threshold value, a combination entropy of the reached N data packages in unit time, the mean value of the combination entropy and the fluctuation range of the combination entropy of the reached data packages in unit time are acquired; when N is larger than the preset threshold value, the combination entropy of the reached N data packages in unit time is acquired, and whether the offset of the combination entropy of the reached N data packages in unit time to the mean value of the combination entropy is larger than the fluctuation range of the combination entropy is judged, if so, attack occurrence is determined. The distributed service-refusal DDos attack is detected by using the combination entropy of different parameters of the data packages so as to avoid the shortcoming of high rate of missing report caused by single-character faked by the attackers, thus improving the accuracy in detecting the DDoS attack.

Description

technical field [0001] The invention relates to the communication field, in particular to a distributed denial of service detection and defense method and network equipment. Background technique [0002] Denial of Service (Denial of Service: DoS) attack has been a main attack method in the field of computer security for a long time. In the presence of such an attack, victims in the network, such as hosts, servers, routers and other devices, will not be able to provide or accept normal services, and in a distributed denial of service (Distributed Denial of Service: DDoS) attack, The attacker controls a large number of hosts distributed across the network, and at the same time launches a denial of service attack on the target. [0003] At present, the most common attack methods in DDoS attacks are transmission control protocol flood attack (TCPFlood), user datagram protocol flood attack (UDP Flood), and Internet control message protocol flood attack (ICMP Flood) attack. For t...

AI Technical Summary

Problems solved by technology

[0007] In the process of realizing the present invention, the inventor found that the prior art has at least the following disadvantages: because the information entropy is the probability that a single source Internet protocol address field or hop value is used to obtain the attribute, the probability is relatively large, so the attacker is very likely to It is easy to simulate the probability distribution of normal data packet attributes by tampering with the source IP address field value of the data packet network layer or transport layer, so that the detection accuracy rate of the detection method based on single attribute information entropy is very low and the false negative rate is high

Images