IP spoofing DDoS attack defense method based on active IP record

Abstract

The invention discloses a defense method aiming at IP deception DDoS (Distributed Denial of Service) attack. The method is based on active IP records; the active IP is a source IP address which has established or is establishing connection with a system, the IP deception DDoS attack generally uses a randomly generated IP as a data stream source address, the IP is a non-active IP, a data stream from the active IP according to the principle can be regarded as a legal stream flow and a network stream from the non-active IP is regarded as a suspicious stream flow, therefore, a DDoS defense gateway which is positioned at the boundary of an autonomous system can use an active IP record form to carry out the matching process to data packets of the autonomous system, the network stream from the active IP passes through directly, the IP data packets without active records are discarded by a router at the boundary of the autonomous system or a router near the boundary and sends an ICMP time out error message to notify source nodes. The data packet of the IP deception DDoS attack with the non-active IP can not reach victimized nodes. The discarded data packet carries out retransmission by the upper layer protocol or application of the source nodes.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a defense method for denial of service or distributed denial of attack using IP deception. Background technique [0002] Distributed denial of service attack (DDoS) is currently the most popular network attack method. Its principle is simple, easy to implement, and the attack is extremely destructive. It poses a great threat to the security of the current network. [0003] DDoS attackers usually control a large number of nodes with low security defense levels distributed in the Internet as attacking puppet machines to form a multi-level DDoS attack botnet. By sending remote control commands to the botnet, they cooperate with a large number of puppet machines to directly or indirectly attack Its attack target sends a large number of network packets, and these network packets converge into overwhelming network traffic at the victim end, exhausting the victim's network ba...

AI Technical Summary

Problems solved by technology

[0019] There are many methods of source backtracking, some require a longer path backtracking time, and others will generate additional data flow, thereby increasing the load on the network

Moreover, the data packet transmission node may also be controlled by an attacker, thereby destroying the path backtracking

In addition, using the attack path obtained by source backtracking to deal with DDoS attacks also has problems such as cooperation between ISPs and response time

Images