Efficient SYN Flood attack identification and disposal method

Abstract

The invention discloses an efficient SYN Flood attack identification and disposal method. The method comprises the steps that: 1, a New table for storing a to-be-classified IP list, a White table for storing an IP white list and a Black table for storing an IP black list are set at a server side; 2, the server side abandons a first SYN data packet on each connection request and records a source address of each SYN data packet into the New table; and 3, the server side acquires the source address of the SYN data packet for the received SYN data packet of each connection request, transfers the source addresses into the White table if the source addresses are positioned in the New table, and directly abandons the SYN data packets if the source addresses are positioned in the Black table. The efficient SYN Flood attack identification and disposal method disclosed by the invention has an identification rate of 98%, and can minimize attack influence.

Description

technical field [0001] The invention relates to an efficient SYN Flood attack identification and treatment method, which belongs to the field of network technology. Background technique [0002] SYN Flood is currently a very popular DDoS attack method. It is a method that uses TCP protocol flaws to forge a large number of TCP connection requests, so that the resources of the attacked party are exhausted (CPU exhaustion, memory shortage, bandwidth is full, etc.) attack method. [0003] TCP is the abbreviation of Transmission Control Protocol, which is translated into Chinese as Transmission Control Protocol. TCP is a connection-oriented communication protocol that provides a stable and reliable data stream service. [0004] TCP needs to establish a connection through a "three-way handshake": [0005] The first handshake: the client sends a SYN packet (syn=j) to the server and enters the SYN_SEND state [0006] The second handshake: After receiving the SYN packet sent by t...

AI Technical Summary

Problems solved by technology

[0008] The problem lies in this "three-way handshake" process: if a user suddenly crashes or drops offline after sending a SYN message to the server, the SYN+ACK message sent by the server cannot receive the ACK message from the client, which means At this time, the server will generally retry sending the SYN+ACK message and discard the unfinished connection after waiting for a period of time. This period is SYNTimeout, but the server will maintain a half-connection table during this period.

During a SYN Foold attack, a large number of fake IPs will send SYN packets to the server. At this time, the server will maintain a huge semi-connected table, causing the server to run out of resources and unable to respond to normal requests.

Images