KR101028101B1 - System and Method for Defending against Distributed Denial of Service Attack - Google Patents

Abstract

The present invention relates to a distributed denial of service attack defense system and method, and more particularly, to a defense apparatus and method for network protection against distributed denial of service attacks (DDoS) for a packet having a destination IP address for the service request will be.

The distributed denial of service (DDos) attack defense method according to the present invention uses a security device including a mode switch tap device installed in a specific node of the network, the tap device is maintained in passive tapping mode, the packet passing through the node is analyzed Monitored; When the DDoS attack is detected, the tap device switches to the selective inline mode for the packet having the detected attack destination address; And a packet having an address other than the attack destination passes through the node, and the packet having the attack destination address is analyzed and discarded if the packet is a DDoS attack packet, and delivered to the node output terminal if the packet is a normal packet.

Distributed Denial of Service Attacks, DDoS, Passive Tapping, Selective Inline, FPGA

Description

Distributed Denial of Service Defense Security System and its Method {System and Method for Defending against Distributed Denial of Service Attack}

The present invention relates to a security technology for protecting network resources, and more particularly, to a system and method for preventing distributed denial of service (DDoS) attacks based on flow-based packet processing for high speed traffic. .

In general, a Distributed Denial of Service (DDoS) attack means sending a large amount of data instantaneously to a target system and network such as a specific web server on the Internet, thereby preventing the system and network from operating normally.

1 illustrates a general structure of Distributed Service Attack (DDoS), in which an attacker 11 uses a large number of insecure systems 12 and 13 on a network to simultaneously generate a large amount of attack traffic 14 at various locations. To the target victim server 15.

Types of attack traffic 14 include TCP SYN flooding, ICMP flooding, UDP flooding, and the like. In particular, in the case of TCP SYN flooding, a large amount of SYN packets are continuously sent to the server, resulting in many TCP connections and exhausting server resources. The damage caused by Distributed Denial of Service (DDoS) attacks places a heavy load on the network along with a denial of service over the network. Since such an attack flow appears to be a normal data flow, a technique for detecting and blocking such an attack is important.

As a method of detecting an attack in the flow of attack traffic, there is a method of detecting at the source or attacker side, a method of detecting at the destination or victim side, and a method of detecting at the core network.

However, existing technologies only detect a distributed denial of service attack after a heavy load on the network, and find the source of the attack to prevent the devices (routers) in the network from transmitting packets. Even when using the so-called out-of-path detection method, it performs through BGP (Border Gateway Protocol) bypass, which doubles the burden of traffic to the router where the packet flow performs BGP bypass, and protects the detector. Network setup is very complex for BGP bypass, such as having to be in close proximity to the network.

Therefore, in the high-speed network environment of Gbps or higher, a technology that detects a DDoS attack faster and makes network configuration easier is required.

The present invention has been proposed to solve such a problem, and the present invention provides a DDoS attack defense device and method that effectively protects a protected subnet from distributed denial of service (DDoS) attacks, is simple to implement, and easy to set up a network. It aims to do it.

In order to achieve the above object, an apparatus according to an aspect of the present invention is a network tap device for detecting and defending a distributed denial of service (DDoS) attack on the network, and comprises an input, an output, a duplicate packet transmitter, and a processed packet receiver. A packet replicating unit configured to copy a packet input through an input terminal and forward the packet to an output terminal side and a duplicate packet transmitting side; Located on the data path between the packet replicating unit and the output terminal, provided with a switch memory unit, and off when the destination address of the packet matches the address data stored in the switch memory unit to block the data path between the packet replication unit and the output terminal Soft switch; And a scheduler that is located on a data path intersection point between the packet copying unit and the output terminal and the data path intersection point between the processing packet receiving end and the output end, and determines a processing order of the delivered packets and transmits them to the output end.

In addition, the network tap apparatus according to the present invention further includes a bypass filter including a filter memory unit on a data path between the input terminal and the packet copy unit, and when the destination address of the packet does not match the address data stored in the filter memory unit. It can be characterized by bypassing the packet to the output end side.

In addition, the network security apparatus according to the present invention includes a temporary memory area for storing an address to be stored in the switch memory unit, and the DDoS when a packet transmitted through the duplicate packet transmitter has the same destination address as the address stored in the temporary memory area. The processor may discard the packet if it is determined to be an attack packet, and return the packet to the processing packet receiver when the packet is determined to be normal data.

In addition, the distributed denial of service (DDos) attack defense method according to another aspect of the present invention uses a security device including a mode switch tap device installed in a specific node of the network, the tap device is maintained in the passive tapping mode to pass through the node Analyzing and monitoring the packet; When the DDoS attack is detected, the tap device switches to the selective inline mode for the packet having the detected attack destination address; And a packet having an address other than the attack destination passes through the node, and the packet having the attack destination address is analyzed and discarded if the packet is a DDoS attack packet and delivered to the node output terminal if the packet is a normal packet.

The present invention utilizes a smart tap device that can switch between passive tapping mode and selective inline mode, effectively blocking DDoS attacks, and using a field programmable gate array (FPGA). It can be easily implemented, real-time operation is possible in the high-speed network environment, the network configuration is very easy by installing on a specific node of the network, and there is an advantageous effect that can greatly reduce the security computer processing capacity.

The present invention utilizes a smart tap device that can switch between passive tapping mode and selective inline mode to protect a server to be protected from distributed denial of service (DDoS) attacks on a network. It's about technology.

Specific features of the present invention will be further embodied through one embodiment described below. Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.

2 is a diagram illustrating a DDoS defense concept according to an embodiment of the present invention. Figure 2 (a) shows the packet flow when the tap device 220 is in passive tapping mode, and Figure 2 (b) is when the tap device 220 is in selective inline mode. Indicates the packet flow. That is, the tap device 220 is a smart tap that can be switched between the passive tapping mode and the selective inline mode, and is installed in a specific node of the network capable of distinguishing the protected subnet 240 from the open Internet 230. The tap device 220 is connected to the security computer 210, and is normally maintained in the passive tapping mode to transfer packets received from the Internet to the subnet, and to copy each packet to the security computer 210. The security computer 210 analyzes the packet transmitted from the tap device 220 in the passive tapping mode and monitors whether a DDoS attack occurs. If a DDoS attack is detected, the security computer 210 immediately instructs the tap device 220 to switch the mode to the selective inline mode to block the bypass path for the packet having a specific destination, and the security computer 210 corresponds to the corresponding device. By analyzing the packet, the malicious packet for the DDoS attack is discarded and only the normal packet is returned to the tap device 220 to enable the normal packet flow to the subnet 240.

That is, according to the present invention, a system for detecting and defending a distributed denial of service (DDoS) attack in the networks 230 and 240 detects and discards malicious packets among the packets transmitted from the open Internet 230, and discards only valid packets. It is characterized in that the transmission to the subnet 240 to be protected. The security computer 210 includes a packet determination unit that analyzes packets transmitted from the Internet 230 to determine malicious packets for DDoS attacks and valid packets.

In addition, the tap device 220 performs so-called filtered mirroring and filtered inlining to bypass the packet when the destination address of the received packet is not the protected address that requested the DDoS attack defense service. It can be done. In this case, since the delivery of a packet having a destination address for which no service is requested is bypassed to the subnetwork 240 without passing through the security computer 210, the security computer 210 is burdened especially when there are many clients connected to the subnet. Reduce the load to be done.

As described above, the smart tap device capable of switching between the passive tapping mode and the selective inline mode may be implemented as a single device such as a gateway array. 3 is a view for explaining a smart tap element according to the present invention.

The smart tap device 220 includes an input terminal 310, an output terminal 320, a duplicate packet transmitting terminal 330, and a processing packet receiving terminal 340, and a packet input through the input terminal 310 from the open Internet 230. The packet replica unit 350 is provided to copy the data and forward the duplicated data to the output terminal 320 and the duplicate packet transmitter 330. The soft switch SW is positioned on the data path between the packet copy unit 350 and the output terminal 320. The soft switch SW includes a switch memory unit Ms so that a destination address of the packet is the memory unit Ms. If the data is matched with the address data stored in the), the soft switch (SW) is turned off to block the data path between the packet replicating unit and the output terminal, the packet is transmitted only to the security computer or processor unit 210 through the duplicate packet transmission unit 330 do. The processor unit 210 continuously monitors whether there is a DDoS attack by analyzing the packet transmitted through the duplicate packet transmitter 330, and stores a corresponding destination address in the temporary memory area M211 when a DDoS attack is detected. In addition, it is to be stored in the switch memory unit (Ms) of the smart tap element. Afterwards, if the packet transmitted through the duplicate packet transmitter 330 has the same destination as the address stored in the temporary memory area M211, the processor 210 analyzes it and discards the packet if it is determined to be a DDoS attack packet. If it is determined that the data, the packet is returned to the processing packet receiving end (340). The data path is formed such that the packet inputted to the processing packet receiving end 340 is transmitted through the output end, so that the processing packet is delivered to the protected subnet 240 so that the normal packet is not restricted in the packet flow. The scheduler 380 may further include a scheduler 380 positioned at an intersection of the data path between the packet copying unit 350 and the output terminal 320 and the data path between the processing packet receiving end 340 and the output terminal 320. The scheduler 380 determines a processing order of packets transmitted from the packet copying unit 350 or the processing packet receiving end 340 and transmits the processing order to the output end 320. When it is determined that the DDoS attack is released, the processor 210 deletes the corresponding destination address from the temporary memory area M211 and updates the address data of the switch memory part Ms of the smart tap element.

A bypass filter 360 including a filter memory unit Mf may be further provided on the data path between the input terminal 310 and the packet replica unit 350. The bypass filter 360 bypasses the packet to the output terminal when the destination address of the packet does not match the address data stored in the filter memory unit. The data path of the packet bypassed from the bypass filter 360 to the output terminal is connected to the scheduler 380, and the scheduler 380 is the packet copying unit 350, the processing packet receiving end 340 or The packet flow may be controlled by determining a processing order of packets transmitted from the bypass filter 360. For example, the scheduler 380 preferentially transmits the first arrived packet among the packets transmitted from the packet replicating unit 350, the processing packet receiving end 340, or the bypass filter 360 to the output end 320. FIFO control to transmit can be applied.

In the filter memory unit Mf, address data of a customer who applied for service in advance is stored, and the processor unit may be updated through the customer registration unit M212 of the 210. In addition, the filter may further include a passive filter 370 positioned immediately after the input terminal. The passive filter bypasses all packets to the output terminal when the power is cut off, thereby abnormally restricting the flow of packets in the event of a power failure of the network security device. To avoid this situation.

Determination of DDoS attacks can generally be done using a known method, for example, if the number of packets with the same destination address exceeds the standard number per second, the primary decision can be made that the destination client server or router is under DDoS attacks. Additional criteria can be applied to apply the optional inline mode for packets with the destination. The destination address may be specified as an IP address or a TCP / UDP port number of a specific destination. The packet analysis of the security computer compares the payload data portion of the datagram (packet) as well as the header portion including the destination address and destination port, and compares the packet according to a predetermined classification criteria. Determine the validity.

Such a tap device can be implemented in various ways such as an FPGA device, a microprocessor, an ASIC, or a combination thereof. In a high-speed network environment of Gbps or higher by switching between a passive tapping mode and an optional inline mode, You can control the packets delivered in real time.

A method for preventing distributed denial of service (DDos) attacks by using a security device including a tap device and a security computer implemented with the above-described FPGA device includes a subnet to which the client to receive the security device and an open Internet. Installing at a specific node, and the tap device is maintained in passive tapping mode so that packets passing through the node are analyzed and monitored; When the DDoS attack is detected, the tap device switches to the selective inline mode for the packet having the detected attack destination address; The packet having an address other than the attack destination passes through the node, and the packet having the attack destination address is analyzed and discarded if the packet is a DDoS attack packet, and delivered to the node output terminal if the packet is a normal packet. In this case, if the destination address of the input packet does not match the pre-registered service target address, the step of bypassing the packet to the output terminal may be performed first. In addition, when it is determined that the DDoS attack is released, a step of switching the tapping device to the passive tapping mode for the corresponding destination packet is added. If the tap device is powered off, bypassing all packets to the output stage is as described above.

That is, the bypass mode and the passive tapping mode are determined according to whether the packet includes the service request destination address, the validity of the packet is determined by the security computer, and the passive tapping mode and the selective inline mode are determined accordingly. .

The embodiments of the present invention described above are disclosed for the purpose of illustration, and those skilled in the art having various ordinary knowledge of the present invention may make various modifications, changes, and additions within the spirit and scope of the present invention. Additions should be considered to be within the scope of the following claims. In addition, the drawings shown in the above embodiments should be seen as being shown enlarged or reduced.

1 is a diagram illustrating a general structure of a distributed service attack (DDoS).

2 is a diagram illustrating a DDoS defense concept according to an embodiment of the present invention.

3 is a view for explaining a smart tap element according to the present invention.

Claims (14)

A network tap device for detecting and defending a distributed denial of service (DDoS) attack on a network, comprising: an input, an output, a duplicate packet transmitter, and a processed packet receiver; A packet replicating unit configured to copy the packet input through the input terminal and forward the packet to the output terminal side and the duplicate packet transmitting side; Located on the data path between the packet replicating unit and the output terminal, provided with a switch memory unit, and off when the destination address of the packet matches the address data stored in the switch memory unit to block the data path between the packet replication unit and the output terminal Soft switch; A scheduler positioned on the intersection of the data path between the soft switch and the output terminal and the data path between the processing packet receiving end and the output end, the scheduler configured to determine a processing order of the transmitted packets and to transmit it to the output end; And And a bypass filter including a filter memory unit on a data path between the input terminal and the packet replica unit. And the bypass filter bypasses the packet to the output terminal when the destination address of the packet does not match the address data stored in the filter memory unit. delete The method of claim 1, And a data path of a packet bypassed from the bypass filter to the output end is connected to the scheduler. The method according to any one of claims 1 to 3, Further comprising a passive filter located immediately after the input terminal, The passive filter is a network tap device, characterized in that bypassing all packets to the output terminal when the power is cut off. A network security device including a gateway array unit and a processor unit for detecting and defending a distributed denial of service (DDoS) attack on a network, The gateway array unit includes an input terminal, an output terminal, a duplicate packet transmitting end, and a processing packet receiving end, A packet replicating unit configured to copy the packet input through the input terminal and forward the packet to the output terminal side and the duplicate packet transmitting side; Located on the data path between the packet replicating unit and the output terminal, provided with a switch memory unit, and off when the destination address of the packet matches the address data stored in the switch memory unit to block the data path between the packet replication unit and the output terminal Soft switch; A data path such that a packet received at the processing packet receiving end is passed through an output end; And And a bypass filter including a filter memory unit on a data path between the input terminal and the packet replica unit. The processor unit includes a temporary memory area for storing an address to be stored in the switch memory unit. If the packet transmitted through the duplicate packet transmitter has the same destination address as the address stored in the temporary memory area, the processor receives the packet if it is determined to be a DDoS attack packet. If discarded and determined to be normal data, the packet is returned to the processed packet receiver. And the bypass filter bypasses the packet to the output terminal if the destination address of the packet does not match the address data stored in the filter memory unit. The method of claim 5, A scheduler positioned on a data path intersection point between the packet copying unit and the output end and a data path intersection point between the processing packet receiving end and the output end, and configured to determine a processing order of the transmitted packets and to transmit it to the output end. delete The method according to claim 5 or 6, Further comprising a passive filter located immediately after the input terminal, The passive filter bypasses all packets to an output terminal when the power is cut off. The method according to claim 5 or 6, And the address data of the switch memory unit can be updated by the processor unit. The method of claim 5, And the address data of the filter memory unit may be updated by the processor unit. In the distributed denial of service (DDos) attack defense method using a security device including a mode switch tap device installed in a specific node of the network, The tap device is maintained in passive tapping mode so that packets passing through the node are analyzed and monitored; When the DDoS attack is detected, the tap device switches to the selective inline mode for the packet having the detected attack destination address; And A packet having an address other than the attack destination passes through the node, and a packet having the attack destination address is analyzed and discarded if the packet is a DDoS attack packet, and delivered to the node output terminal if the packet is a normal packet. The distributed denial of service (DDos) attack defense method, if the destination address of the input packet does not match the pre-registered service target address, bypasses the packet to the output stage. The method of claim 11, If it is determined that the DDoS attack is released, the tap device is switched to the passive tapping mode for the destination packet; Distributed denial of service (DDos) attack defense method further comprising. delete 13. The method according to claim 11 or 12, Distributed power denial of service (DDos) attack defense method characterized in that by bypassing all packets to the output terminal when the power to the tap device is cut off.

Images