CN103916379B - A kind of CC attack recognition method and system based on high frequency statistics - Google Patents

A kind of CC attack recognition method and system based on high frequency statistics Download PDF

Info

Publication number
CN103916379B
CN103916379B CN201310640806.2A CN201310640806A CN103916379B CN 103916379 B CN103916379 B CN 103916379B CN 201310640806 A CN201310640806 A CN 201310640806A CN 103916379 B CN103916379 B CN 103916379B
Authority
CN
China
Prior art keywords
buffering area
count value
statistical item
hash values
statistical
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201310640806.2A
Other languages
Chinese (zh)
Other versions
CN103916379A (en
Inventor
康学斌
董建武
张栗伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Antiy Technology Group Co Ltd
Original Assignee
Harbin Antiy Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Harbin Antiy Technology Co Ltd filed Critical Harbin Antiy Technology Co Ltd
Priority to CN201310640806.2A priority Critical patent/CN103916379B/en
Publication of CN103916379A publication Critical patent/CN103916379A/en
Application granted granted Critical
Publication of CN103916379B publication Critical patent/CN103916379B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

The invention discloses the CC attack recognition method and system based on high frequency statistics, first, the HTTP GET requests in backbone traffic are recognized, and obtain source IP, purpose IP and URI, calculate hash values;If existing and the hash values identical statistical item in buffering area, then count value adds 1, otherwise judge whether buffering area is full, if it is not, adding buffering area using the hash values as new statistical item, and count value is set as 1, otherwise the count value of all statistical items of buffering area is subtracted 1, and judges to whether there is in buffering area count value for 0 statistical item, if in the presence of, the statistical item is then removed, and buffering area is added using the hash values as new statistical item;If there is the statistical item that unit interval count value exceedes given threshold in buffering area, then it is assumed that there is CC attacks, and alarm.Instant invention overcomes the possibility that CC attacks are flooded by the normal access of large-scale website, the thought counted using high-frequency data recognizes that CC is attacked come effective.

Description

A kind of CC attack recognition method and system based on high frequency statistics
Technical field
The present invention relates to technical field of network security, more particularly to a kind of CC attack recognitions method based on high frequency statistics and System.
Background technology
Described CC attacks can be classified as one kind of ddos attack.Cause service by sending substantial amounts of request data Device refusal service, is a kind of connection attack.CC attacks, which common are, acts on behalf of CC attacks, and broiler chicken CC attacks.Acting on behalf of CC attacks is Hacker generates the legal web-page requests for pointing to victim host by proxy server, realizes DOS and camouflage.And broiler chicken CC attacks are Hacker attacks software using CC, controls a large amount of broiler chicken, offensive attack, and comparatively speaking the latter is more difficult to defence than the former.Because meat Chicken can simulate the request that normal users access website, be forged into legal data packet.
Conventional protection DDoS recognizes the CC of abnormal burst in backbone network and accesses stream primarily directed to some websites Amount, the place different from conventional method is that have substantial amounts of normal flowing of access first, as long as secondly traditional access count statistics For the website of the network protected, it is not necessary to which other websites are counted, the information counted is considerably less.
The identification core that CC attacks are carried out in backbone network is the statistics that can be conducted interviews to the website attacked, and is set up The full URL of the whole network statistics resource to be consumed is then not convergent, constantly has new URL to add, and new different domain names are added, and are needed The content to be counted is Protean, and statistical item is not fixed, and how therefrom to find high frequency CC attacks, and not by regular big The normal access of type website flood be currently without solve the problem of.
The content of the invention
For above-mentioned technical problem, the invention provides a kind of CC attack recognition method and system based on high frequency statistics, This method is by setting up a buffering area, using the thought of big data high frequency statistics, abandons the conventional method of accurate statistics, realizes The purpose that effectively identification CC is attacked.
The present invention adopts with the following method to realize:A kind of CC attack recognition methods based on high frequency statistics, including:
HTTP GET requests in step 1, identification backbone traffic, and utilization HTTP GET requests acquisition source IP, Purpose IP and URI;
Wherein, purpose IP, HTTP head, URI etc., the URI can be obtained using HTTP GET requests content(Uniform Resource Locator abbreviation)It is URL, is the field in http protocol, is a URL part;Utilize HTTP can obtain the contents such as source IP, URI, protocol version, client-side information;
Step 2, the source IP using acquisition, purpose IP and URI calculate hash values;
Step 3, judge in buffering area whether there is with the hash values identical statistical item, if in the presence of the statistics The count value of project adds 1, and performs step 6, otherwise performs step 4;
Step 4, judge to whether there is remaining space in buffering area, if in the presence of regarding the hash values as new statistical items Mesh adds buffering area, and sets count value as 1, otherwise subtracts 1 by the count value of all statistical items of buffering area, and perform step 5;
Step 5, judge in buffering area with the presence or absence of count value for 0 statistical item, if in the presence of removing the statistical items Mesh, and buffering area is added using the hash values as new statistical item, and set count value the hash is abandoned as 1, otherwise Value, terminates;
Step 6, when exist in buffering area unit interval count value exceed given threshold statistical item, then it is assumed that there is CC Attack, and alarm.
Further, the size of the buffering area is fixed.Form a stable staqtistical data base.
Further, the given threshold is 10 times of conventional visit capacity.
The present invention is realized using following system:A kind of CC System for attack recognition based on high frequency statistics, including:
Identification module, is obtained for recognizing the HTTP GET requests in backbone traffic, and using the HTTP GET requests Take source IP, purpose IP and URI;
Wherein, purpose IP, HTTP head, URI etc., the URI can be obtained using HTTP GET requests content(Uniform Resource Locator abbreviation)It is URL, is the field in http protocol, is a URL part;Utilize HTTP can obtain the contents such as source IP, URI, protocol version, client-side information;
Computing module, for calculating hash values using the source IP, purpose IP and URI that obtain;
First determination module, for judge in buffering area whether there is with the hash values identical statistical item, if depositing , then the count value of the statistical item adds 1, and is handled by disposal module, otherwise by the second determination module continue judge;
Second determination module, for judge in buffering area whether there is remaining space, if in the presence of, using the hash values as New statistical item adds buffering area, and sets count value as 1, otherwise subtracts 1 by the count value of all statistical items of buffering area, and Continued to judge by the 3rd determination module;
3rd determination module, for judging to whether there is in buffering area count value for 0 statistical item, if in the presence of clearly Buffering area is added except the statistical item, and using the hash values as new statistical item, and sets count value as 1, otherwise The hash values are abandoned, are terminated;
Dispose module, when exist in buffering area unit interval count value exceed given threshold statistical item, then it is assumed that deposit In CC attacks, and alarm.
Further, the size of the buffering area is fixed.
Further, the given threshold is 10 times of conventional visit capacity.
In summary, the invention provides a kind of CC attack recognition method and system based on high frequency statistics, identification is passed through HTTP GET requests in backbone traffic, and source IP, purpose IP and URI are further obtained, calculate hash using the above Value, and stored these hash values as statistical item into buffering area, if hash values are had stored in buffering area, accordingly Count value adds 1, otherwise adds buffering area using the hash values as new statistical item, and sets count value as 1, if the buffering area It is full, then all count values are subtracted 1, count value is deleted for 0 statistical item.So as to ensure there is a fixed number in the buffer The statistical item of scope is measured, backbone network data traffic is overcome greatly, does the difficulty accurately counted, accomplish with minimum Resources Consumption The identification of CC attacks is carried out to the key network data of magnanimity.
Brief description of the drawings
In order to illustrate more clearly of technical scheme, letter will be made to the accompanying drawing to be used needed for embodiment below Singly introduce, it should be apparent that, drawings in the following description are only some embodiments described in the present invention, for this area For those of ordinary skill, on the premise of not paying creative work, other accompanying drawings can also be obtained according to these accompanying drawings.
A kind of CC attack recognition method flow diagrams based on high frequency statistics that Fig. 1 provides for the present invention;
A kind of CC System for attack recognition structure charts based on high frequency statistics that Fig. 2 provides for the present invention.
Embodiment
The present invention gives a kind of CC attack recognition method and system based on high frequency statistics, in order that the art Personnel more fully understand the technical scheme in the embodiment of the present invention, and enable the above objects, features and advantages of the present invention more Plus become apparent, technical scheme in the present invention is described in further detail below in conjunction with the accompanying drawings:
Present invention firstly provides a kind of CC attack recognition methods based on high frequency statistics, as shown in figure 1, including:
HTTP GET requests in S101 identification backbone traffics, and obtain source IP, mesh using the HTTP GET requests IP and URI;
For example:Source IP:113.92.175.10;
Purpose IP:184.51.198.33;
GET/pki/crl/products/WinIntPCA.crl HTTP/1.1;
URI:http://crl.microsoft.com/pki/crl/products/WinIntPCA.crl;
S102 calculates hash values using the source IP, purpose IP and URI obtained;
By source IP, purpose IP and URI splice that to obtain a character string as follows:
113.92.175.10|184.51.198.33|
http://crl.microsoft.com/pki/crl/products/WinIntPCA.crl;
The hash values of the character string are calculated, for example:CRC64 values are(3857831069L, 3494489294L);
S103 judge in buffering area whether there is with the hash values identical statistical item, if so, the then statistical item Count value add 1, and perform S106, otherwise perform S104;
S104 judges to whether there is remaining space in buffering area, if so, the hash values are added as new statistical item Enter buffering area, and set count value as 1, otherwise the count value of all statistical items of buffering area is subtracted 1, and perform S105;
S105 judges to whether there is in buffering area count value for 0 statistical item, if so, the statistical item is then removed, And buffering area is added using the hash values as new statistical item, and set count value the hash values are abandoned as 1, otherwise, Terminate;
S106, which works as, has the statistical item that unit interval count value exceedes given threshold in buffering area, then it is assumed that there is CC and attack Hit, and alarm.
Preferably, the size of the buffering area is fixed.
Preferably, the given threshold is 10 times of conventional visit capacity.
For example:Under normal circumstances, conventional visit capacity is 20 times in the unit interval, and the visit capacity of unit interval reaches at present To more than 200 times, then it is assumed that there is CC attacks.
Present invention also offers a kind of CC System for attack recognition based on high frequency statistics, as shown in Fig. 2 including:
Identification module 201, for recognizing the HTTP GET requests in backbone traffic, and utilizes the HTTP GET requests Obtain source IP, purpose IP and URI;
Computing module 202, for calculating hash values using the source IP, purpose IP and URI that obtain;
First determination module 203, for judge in buffering area whether there is with the hash values identical statistical item, if In the presence of, then the count value of the statistical item adds 1, and is handled by disposal module 206, otherwise by the second determination module 204 after It is continuous to judge;
Second determination module 204, for judging to whether there is remaining space in buffering area, if in the presence of by the hash values Buffering area is added as new statistical item, and sets count value as 1, otherwise subtracts the count value of all statistical items of buffering area 1, and judgement is continued by the 3rd determination module 205;
3rd determination module 205, for judging to whether there is in buffering area count value for 0 statistical item, if in the presence of, The statistical item is removed, and buffering area is added using the hash values as new statistical item, and sets count value as 1, it is no The hash values are then abandoned, are terminated;
Dispose module 206, when exist in buffering area unit interval count value exceed given threshold statistical item, then it is assumed that There is CC attacks, and alarm.
Preferably, the size of the buffering area is fixed.
Preferably, the given threshold is 10 times of conventional visit capacity.
As described above, The present invention gives a kind of specific implementation of the CC attack recognition method and system based on high frequency statistics Example, it is with the difference of conventional method, and traditional CC attack recognitions are the acess controls carried out for some websites;And The CC attack recognitions that conventional method is used in backbone network, then may have very huge data to need processing, and CC is attacked Hit and be likely to be flooded by the normal access of large-scale website, so as to can not effectively recognize.Method provided by the present invention is chosen solid Determine the HTTP GET requests in the buffering area of size, identification backbone network, and hash values are calculated using source IP, purpose IP and URI, if There is identical hash values in buffering area, then count value adds 1, otherwise judge whether buffering area also has remaining space, if so, then by institute State hash values to add in buffering area, count value is set as 1, if without remaining space, the count value of all statistical items is subtracted 1, the count value that will appear from is removed for 0 statistical item, and the hash values are updated in buffering area.Utilize this dynamic statistics number According to method, limit the data volume in buffering area;When the count value in the unit interval of a certain hash values exceedes normal condition Lower averaged count to a certain degree after, then it is assumed that there occurs CC attack.Method provided by the present invention can utilize the money of very little Source handles the mass data of backbone network, effectively recognizes that the high frequency in the unit interval in single source accesses situation, so that in time It was found that CC is attacked.
Above example is used to illustrative and not limiting technical scheme.Appointing for spirit and scope of the invention is not departed from What modification or local replacement, all should cover among scope of the presently claimed invention.

Claims (6)

1. a kind of CC attack recognition methods based on high frequency statistics, it is characterised in that including:
HTTP GET requests in step 1, identification backbone traffic, and obtain source IP, purpose using the HTTP GET requests IP and URI;
Step 2, the source IP using acquisition, purpose IP and URI calculate hash values;
Step 3, judge in buffering area whether there is with the hash values identical statistical item, if in the presence of the statistical item Count value add 1, and perform step 6, otherwise perform step 4;
Step 4, judge to whether there is remaining space in buffering area, if in the presence of the hash values are added as new statistical item Enter buffering area, and set count value as 1, otherwise the count value of all statistical items of buffering area is subtracted 1, and perform step 5;
Step 5, judge in buffering area with the presence or absence of count value for 0 statistical item, if in the presence of, remove the statistical item, And buffering area is added using the hash values as new statistical item, and set count value the hash values are abandoned as 1, otherwise, Terminate;
Step 6, when exist in buffering area unit interval count value exceed given threshold statistical item, then it is assumed that there is CC and attack Hit, and alarm.
2. the method as described in claim 1, it is characterised in that the size of the buffering area is fixed.
3. the method as described in claim 1, it is characterised in that the given threshold is 10 times of conventional visit capacity.
4. a kind of CC System for attack recognition based on high frequency statistics, it is characterised in that including:
Identification module, source is obtained for recognizing the HTTP GET requests in backbone traffic, and using the HTTP GET requests IP, purpose IP and URI;
Computing module, for calculating hash values using the source IP, purpose IP and URI that obtain;
First determination module, for judge in buffering area whether there is with the hash values identical statistical item, if in the presence of, The count value of the statistical item adds 1, and is handled by disposal module, is otherwise continued to judge by the second determination module;
Second determination module, for judge in buffering area whether there is remaining space, if in the presence of, using the hash values as newly Statistical item adds buffering area, and sets count value as 1, otherwise subtracts 1 by the count value of all statistical items of buffering area, and by the Three determination modules continue to judge;
3rd determination module, for judge in buffering area with the presence or absence of count value for 0 statistical item, if in the presence of removing institute Statistical item is stated, and buffering area is added using the hash values as new statistical item, and sets count value as 1, is otherwise abandoned The hash values, terminate;
Dispose module, when exist in buffering area unit interval count value exceed given threshold statistical item, then it is assumed that there is CC Attack, and alarm.
5. system as claimed in claim 4, it is characterised in that the size of the buffering area is fixed.
6. system as claimed in claim 4, it is characterised in that the given threshold is 10 times of conventional visit capacity.
CN201310640806.2A 2013-12-04 2013-12-04 A kind of CC attack recognition method and system based on high frequency statistics Active CN103916379B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201310640806.2A CN103916379B (en) 2013-12-04 2013-12-04 A kind of CC attack recognition method and system based on high frequency statistics

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201310640806.2A CN103916379B (en) 2013-12-04 2013-12-04 A kind of CC attack recognition method and system based on high frequency statistics

Publications (2)

Publication Number Publication Date
CN103916379A CN103916379A (en) 2014-07-09
CN103916379B true CN103916379B (en) 2017-07-18

Family

ID=51041786

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201310640806.2A Active CN103916379B (en) 2013-12-04 2013-12-04 A kind of CC attack recognition method and system based on high frequency statistics

Country Status (1)

Country Link
CN (1) CN103916379B (en)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104539604B (en) * 2014-12-23 2017-11-24 北京奇安信科技有限公司 Website protection method and device
CN106789849B (en) * 2015-11-24 2020-12-04 阿里巴巴集团控股有限公司 CC attack identification method, node and system
CN105553974A (en) * 2015-12-14 2016-05-04 中国电子信息产业集团有限公司第六研究所 Prevention method of HTTP slow attack
CN108243149A (en) * 2016-12-23 2018-07-03 北京华为数字技术有限公司 A kind of network attack detecting method and device
CN110519266B (en) * 2019-08-27 2021-04-27 四川长虹电器股份有限公司 Cc attack detection method based on statistical method
CN110808967B (en) * 2019-10-24 2022-04-08 新华三信息安全技术有限公司 Detection method for challenging black hole attack and related device
CN114640504B (en) * 2022-02-24 2024-02-06 京东科技信息技术有限公司 CC attack protection method, device, equipment and storage medium

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101465760A (en) * 2007-12-17 2009-06-24 北京启明星辰信息技术股份有限公司 Method and system for detecting abnegation service aggression
CN101505218A (en) * 2009-03-18 2009-08-12 杭州华三通信技术有限公司 Detection method and apparatus for attack packet
CN101567815A (en) * 2009-05-27 2009-10-28 清华大学 Method for effectively detecting and defending domain name server (DNS) amplification attacks
CN101729569A (en) * 2009-12-22 2010-06-09 成都市华为赛门铁克科技有限公司 Distributed Denial of Service (DDOS) attack protection method, device and system
CN102510385A (en) * 2011-12-12 2012-06-20 汉柏科技有限公司 Method for preventing fragment attack of IP (Internet Protocol) datagram
CN103179132A (en) * 2013-04-09 2013-06-26 中国信息安全测评中心 Method and device for detecting and defending CC (challenge collapsar)

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100370757C (en) * 2004-07-09 2008-02-20 国际商业机器公司 Method and system for dentifying a distributed denial of service (DDOS) attack within a network and defending against such an attack

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101465760A (en) * 2007-12-17 2009-06-24 北京启明星辰信息技术股份有限公司 Method and system for detecting abnegation service aggression
CN101505218A (en) * 2009-03-18 2009-08-12 杭州华三通信技术有限公司 Detection method and apparatus for attack packet
CN101567815A (en) * 2009-05-27 2009-10-28 清华大学 Method for effectively detecting and defending domain name server (DNS) amplification attacks
CN101729569A (en) * 2009-12-22 2010-06-09 成都市华为赛门铁克科技有限公司 Distributed Denial of Service (DDOS) attack protection method, device and system
CN102510385A (en) * 2011-12-12 2012-06-20 汉柏科技有限公司 Method for preventing fragment attack of IP (Internet Protocol) datagram
CN103179132A (en) * 2013-04-09 2013-06-26 中国信息安全测评中心 Method and device for detecting and defending CC (challenge collapsar)

Also Published As

Publication number Publication date
CN103916379A (en) 2014-07-09

Similar Documents

Publication Publication Date Title
CN103916379B (en) A kind of CC attack recognition method and system based on high frequency statistics
Liu et al. Efficient DDoS attacks mitigation for stateful forwarding in Internet of Things
US10432652B1 (en) Methods for detecting and mitigating malicious network behavior and devices thereof
CN109194680B (en) Network attack identification method, device and equipment
CN102291390B (en) Method for defending against denial of service attack based on cloud computation platform
US8943586B2 (en) Methods of detecting DNS flooding attack according to characteristics of type of attack traffic
CN103856470B (en) Detecting method of distributed denial of service attacking and detection device
WO2018121331A1 (en) Attack request determination method, apparatus and server
CN102571547B (en) Method and device for controlling hyper text transport protocol (HTTP) traffic
JP2012522295A (en) Filtering method, system, and network device
CN101572700A (en) Method for defending HTTP Flood distributed denial-of-service attack
CN105282169A (en) DDoS attack warning method and system based on SDN controller threshold
CN102271068A (en) Method for detecting DOS/DDOS (denial of service/distributed denial of service) attack
CN101150586A (en) CC attack prevention method and device
WO2020037781A1 (en) Anti-attack method and device for server
CN108683686A (en) A kind of Stochastic subspace name ddos attack detection method
CN101577644B (en) Peer-to-peer network application traffic identification method
KR101200906B1 (en) High Performance System and Method for Blocking Harmful Sites Access on the basis of Network
CN112019533A (en) Method and system for relieving DDoS attack on CDN system
KR101188305B1 (en) System and method for botnet detection using traffic analysis of non-ideal domain name system
Huang et al. An authentication scheme to defend against UDP DrDoS attacks in 5G networks
CN104580228A (en) System and method for generating blacklist for access requests from network
CN104378358A (en) HTTP Get Flood attack prevention method based on server log
US20170149821A1 (en) Method And System For Protection From DDoS Attack For CDN Server Group
WO2011103835A2 (en) User access control method, apparatus and system

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CP03 Change of name, title or address
CP03 Change of name, title or address

Address after: 150010 building 7, innovation and entrepreneurship Plaza, science and technology innovation city, Harbin high tech Industrial Development Zone, Heilongjiang, China (No. 838, world Kun Road)

Patentee after: Harbin antiy Technology Group Limited by Share Ltd

Address before: 150090 room 506, Hongqi Street, Nangang District, Harbin Development Zone, Heilongjiang, China, 162

Patentee before: Harbin Antiy Technology Co., Ltd.

PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: CC attack identification method and system based on high frequency statistics

Effective date of registration: 20190718

Granted publication date: 20170718

Pledgee: Bank of Longjiang, Limited by Share Ltd, Harbin Limin branch

Pledgor: Harbin antiy Technology Group Limited by Share Ltd

Registration number: 2019230000007

PE01 Entry into force of the registration of the contract for pledge of patent right
CP01 Change in the name or title of a patent holder

Address after: 150010 building 7, innovation and entrepreneurship Plaza, science and technology innovation city, Harbin high tech Industrial Development Zone, Heilongjiang, China (No. 838, world Kun Road)

Patentee after: Antan Technology Group Co.,Ltd.

Address before: 150010 building 7, innovation and entrepreneurship Plaza, science and technology innovation city, Harbin high tech Industrial Development Zone, Heilongjiang, China (No. 838, world Kun Road)

Patentee before: Harbin Antian Science and Technology Group Co.,Ltd.

CP01 Change in the name or title of a patent holder
PC01 Cancellation of the registration of the contract for pledge of patent right

Date of cancellation: 20211119

Granted publication date: 20170718

Pledgee: Bank of Longjiang Limited by Share Ltd. Harbin Limin branch

Pledgor: Harbin Antian Science and Technology Group Co.,Ltd.

Registration number: 2019230000007

PC01 Cancellation of the registration of the contract for pledge of patent right