A real-time ddos ​​defense system based on dpdk

Abstract

The invention discloses a DDoS real-time defense system based on DPDK. The system includes modules such as fast forwarding path, machine learning rule table, fast forwarding table, priority queue scheduling, flow monitoring and the like. The present invention targets unknown complex attacks through the DPDK-based data forwarding plane, provides priority to the victim with mission-critical preferred traffic, and efficiently forwards data packets; secondly, the present invention implements machine learning matching rules and uses flexible scheduling methods for traffic management to offset machine attacks. Negative effects caused by learning model defects. The system has the advantages of deployability, high efficiency, and fault tolerance. It can realize data-driven traffic classification based on machine learning rules, thereby defending against DDoS attacks in real time, achieving efficient intra-network forwarding, and improving the benign traffic forwarding rate. .

Description

technical field [0001] The invention relates to the technical field of computer network security, belongs to the defense of distributed denial of service attack (DDoS), in particular to a DPDK-based real-time DDoS defense system. Background technique [0002] Distributed denial of service attacks have become one of the main threats facing the Internet. DDoS defense has always been a topic of great research value, which has attracted extensive attention from both academia and industry. A common challenge faced by current approaches to DDoS defense is deployability and efficiency against attacks of previously unknown complexity. [0003] Due to the heterogeneity of autonomous systems, methods that require deployment in a large number of autonomous systems are severely limited in their deployment in real environments. Therefore, cloud security service providers play a vital role in today's DDoS protection. They first redirect the DDoS victim's traffic to a data center that i...

AI Technical Summary

Problems solved by technology

However, since defenses focus on dealing with large but well-characterized attacks, when faced with unknown and complex attacks that have no precedent or have not been fully exposed, the cleanup services deployed by cloud security service providers cannot identify the attacks, which poses a serious threat to enterprises. threaten

Existing target-driven policy-based methods can only simply share by flow or by source, and cannot implement complex target traffic priority policies

Images