Method and system for cleaning SYN FLOOD attack

Abstract

The invention discloses a method and a system for cleaning SYN FLOOD attack. The method has the advantages that by filtering an overlong SYN message, the stress during connection establishing and analysis is greatly reduced; then, by analyzing after a connection identification is established, the reloading time of SYN is judged, and the reloading times are limited, so as to prevent an attacker from simulating reloading activity and counterfeiting into legal traffic; the method can be widely applied to SYN attach defense techniques.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a cleaning method and system for SYN FLOOD attacks. Background technique [0002] Denial of Service attack (DoS, Denial of Service) refers to using various service requests to exhaust the system resources of the attacked network, so that the attacked network cannot process the requests of legitimate users. With the rise of botnets, and due to the characteristics of simple attack methods, large impact, and difficulty in tracing, distributed denial of service attacks (DDoS, Distributed Denial of Service) have grown rapidly and become increasingly rampant. A botnet composed of tens of thousands of hosts provides the required bandwidth and hosts for DDoS attacks, forming a huge attack and network traffic, causing great harm to the attacked network. [0003] With the continuous improvement and development of DDoS attack technology, operators such as ISPs, ICPs, and IDCs fac...

AI Technical Summary

Problems solved by technology

[0006] The above two methods have obvious disadvantages. The first method brings a lot of complexity and trouble in the deployment of the network architecture of the system because it needs to reply the verification message to the client. It generates a cookie and a reply for each SYN request. The efficiency of the message is also very low; the second method needs to establish a connection identifier for each SYN request, and the efficiency is relatively low. The SYN attack with large traffic can often reach millions of messages per second, and secondly, some small traffic The SYN attack may forge the retransmission behavior, use the same address and port to resend the SYN message at intervals, and only check the validity of the retransmission, which will miss and kill this part of the traffic

Images