Method and protecting apparatus for defending denial of service attack

Abstract

The invention discloses a method for defending a denial of service attack. The method comprises the following steps: acquiring value statistic distribution of an appointed field of a message received by an appointed port of a host or a server; taking the appointed field as a characteristic field if the probability of extracting the same value from the appointed field is higher that a preset threshold; and determining the message to be an attack message or a service message according to the value of the characteristic field of the message and the value statistic distribution of the characteristic field for the message received by the appointed port. The invention also discloses a device for defending the denial of service attack. The technical proposal can effectively identify attack messages in large capacity, and achieves the aim of defending the denial of service attack.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method and protection device for defending against denial of service attacks. Background technique [0002] Distributed Denial of Service (DDoS, Distributed Denial of Service) attack is an attack method in which multiple attackers (hosts) attack the same victim (including hosts, servers, and network devices), making the victim unable to work normally . The typical feature of DDoS is to launch an attack on the victim through the method of "multiple hitting one", and achieve the purpose of denial of service attack by consuming the bandwidth, CPU processing power and memory occupation of the victim, especially in the way of bandwidth consumption. The most common and most effective. [0003] figure 1 It is a schematic diagram of the existing DDoS attack architecture. Such as figure 1 As shown, the attacker sends attack packets by controlling tens of thousands of ...

AI Technical Summary

Problems solved by technology

[0009] However, although the prevention method based on known defect attacks can accurately prevent known defect attacks, it needs to be specially processed for each defect attack. The more types of defect attacks, the higher the processing cost. If the attack traffic is large, It is unrealistic to scan for every vulnerability attack, so this solution is only used as a secondary means

However, the defense method based on fixed feature statistics can obtain an appropriate threshold based on historical data as long as the protected service type and characteristics are known, and can also screen illegal traffic to a certain extent. It is simple to implement and high in processing efficiency. It is the current DDoS protection device The main method used, but the disadvantage is that there are many types of servers at present, among which game servers account for a large proportion. The protocol characteristics of each game server are different, and it is difficult to conduct a comprehensive analysis of this type of server according to the service type and characteristics. good protection

Images