JP2005286716A - Dos attack defending apparatus and defending method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To maintain stable network communication by preventing a DOS attack to a target terminal from a particular terminal using a plurality of IP addresses. <P>SOLUTION: A DOS attack defending apparatus and defending method includes: a reception packet buffer section 1 for receiving and storing transmission packets from transmission terminals A, B; table sections 2, 4 for associating an IP address denoting a transmission destination of the packets stored in the buffer section 1 with an individual recognition number for confirming a packet transmission source and recording the IP address; counter sections 5, 6 for counting the number of packets having the same individual recognition number with respect to the same destination IP address recorded in the table sections 2, 4 within a prescribed time; and a discard control section 7 for discarding the received packets stored in the buffer section 1 when the counted value reaches the prescribed value or over. After the discard of the received packets, the discard of the received packets may be stopped after a lapse of the prescribed time and a MAC address may be used for the individual recognition number. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a DOS attack defense device and a defense method, and more particularly to protect a DOS (Denial of Service) attack that stops a service such as a server connected to a network and protect an IP (Internet Protocol) related device. The present invention relates to an apparatus and a method.

  A DOS attack that interferes with the services of legitimate users by sending a large number of packets from a single source to the target server connected to the network, overflowing the communication path, or stopping the service due to overload Has been done. In order to counter this attack, an IP router on the network and a security device for protecting the network and devices connected to the network use, for example, a management table, and a transmission source terminal based on the transmission source IP address of the transmission packet And the destination is monitored using the destination IP address table. Further, the transmission terminal identification unit that manages the transmission destination and the transmission source in a unified manner is based on the time information from the timer unit that the continuous access for a predetermined time or more is repeated for the IP address of the specific transmission destination. Monitor. When continuous access from a specific transmission source to a specific transmission destination occurs, transmission from the IP address is not loaded into the reception buffer by the received packet discard control unit.

  However, in recent years, since it seems that access is concentrated on a specific terminal from an unspecified IP address, a plurality of IP addresses can be converted from a specific terminal through various providers. A DOS attack is performed on a specific terminal with an IP address. In such a case, the target terminal is subject to a DOS attack because it appears to be accessed from a plurality of terminals in spite of access from a specific terminal, and communication other than the DOS attack is also performed. There was a problem that relaying was interrupted.

  Accordingly, an object of the present invention is to prevent such an attack and maintain stable network communication even when a DOS attack is set against a specific terminal using a plurality of IP addresses.

  In order to achieve the above object, the present invention provides a DOS attack defense apparatus, which receives a transmission packet from a transmission terminal and stores it, and a transmission destination of a packet stored in the reception packet buffer unit. A table unit that records an IP address and an individual identification number that can determine the transmission source of the packet in association with each other, and the same individual for the same destination IP address recorded in the table unit within a predetermined time A counting unit that counts the number of packets having an identification number; and a discard control unit that discards received packets stored in the received packet buffer unit when the count value of the counting unit is equal to or greater than a predetermined value; It is characterized by providing.

  Then, according to the present invention, the table unit records the transmission destination IP address of the transmitted packet in association with the individual identification number that can determine the transmission source, and the counting unit within a predetermined time. , Counting the number of packets having the same individual identification number for the same destination IP address recorded in the table unit, and when the count value of the counter unit exceeds a predetermined value, the discard control unit Since the received packets stored in the received packet buffer unit are discarded, even if a specific terminal uses a plurality of IP addresses to attack a specific terminal, such a DOS attack can be prevented. And stable network communication can be maintained. In addition, since only the packet that is performing the DOS attack is discarded on the input side, all the communication that is not related to the DOS attack and the communication that is connected to the terminal that has been subjected to the DOS attack is connected in the output direction. It can be maintained normally.

  In the DOS attack defense apparatus, the discard control unit can stop discarding the received packet after a predetermined time has elapsed after discarding the received packet by the discard control unit. As a result, normal communication from the transmitting terminal that has stopped performing the DOS attack can be recovered.

  In the DOS attack defense apparatus, the individual identification number can be a MAC address (Media Access Control Address).

  Further, the present invention is a DOS attack protection method, which can receive and accumulate transmission packets from a transmission terminal, and determine the IP address of the transmission destination of the accumulated packets and the transmission source of the packets An individual identification number is recorded in association with each other, and within a predetermined time, the number of packets having the same individual identification number with respect to the recorded destination IP address is counted, and the count value is equal to or greater than a predetermined value. In this case, the accumulated received packet is discarded. As a result, as described above, a DOS attack against a specific terminal can be prevented from a specific terminal using a plurality of IP addresses, and all communications not related to the DOS attack and DOS located in the output direction can be protected. The communication to which the terminal that was under attack is connected can be maintained normally.

  In the DOS attack defense apparatus, the discarding of the received packet can be stopped after a predetermined time elapses after the discarding of the received packet, and a MAC address (Media Access Control Address) can be used as the individual identification number.

  According to the present invention, there is provided a DOS attack defense apparatus and a defense method capable of preventing a DOS attack from a specific terminal using a plurality of IP addresses to a target terminal and maintaining stable network communication. Can be provided.

  FIG. 1 shows an embodiment of a DOS attack defense device according to the present invention. This DOS attack defense device 10 receives a reception packet from a transmission terminal A, B and stores it, and a reception packet buffer 1. A destination IP address table 2 that detects a destination IP address from a packet loaded in the packet buffer unit 1 and accumulates information as a table, and similarly, a source IP address from a packet loaded in the received packet buffer unit 1 A source IP address table 3 that detects an address and stores information as a table, and a source MAC address table 4 that detects a source MAC address from packets loaded in the received packet buffer unit 1 and stores information as a table And the destination IP address table 2 and the source MAC address table 4 Source terminal identification unit 5 that counts the number of received packets, timer unit 6 that counts the number of packets counted up to the transmission source terminal identification unit 5 for a predetermined time, and transmission terminal identification When the number of packets counted up in the unit 5 is counted up by a certain value or more, the received packet discard control unit 7 discards the received packet of the corresponding source MAC address.

  Next, the operation of the DOS attack defense device 10 having the above configuration will be described. Here, it is assumed that the transmission terminal A is an attack terminal, and the transmission terminal B is a normal user terminal.

  The reception packet buffer unit 1 receives transmission packets from the transmission terminals A and B and accumulates them as needed. From the packets loaded in the reception packet buffer unit 1, the IP address of the transmission destination, the IP address of the transmission source, and the MAC address of the transmission source are detected, respectively, the transmission destination IP address table 2, The information is stored in the transmission source IP address table 3 and the transmission source MAC address table 4.

  Next, the transmission destination IP address and the transmission source MAC address of the accumulated table information are managed for each received packet by using the transmission destination IP address table 2 and the transmission source MAC address table 3, respectively. The transmission source terminal identification unit 5 counts the number of packets from the specific terminal A and the transmission terminal B toward the target terminal. Normally, if it is normal access, it is impossible to access a single destination continuously for several minutes. Therefore, when the packet number count value reaches a certain level for a predetermined time by several minutes by the transmission source terminal identification unit 5, it is determined that the access is abnormal (DOS attack), and the received packet discard control unit 7 Prevents the packet from the transmission source MAC address from being stored in the reception packet buffer unit 1.

  In this way, when a packet addressed to a target terminal whose count value is a certain level or more is received from a specific terminal within a predetermined time, the received packet is discarded by the DOS attack defense device 10 to prevent a DOS attack. Can do. If the source IP address is monitored, there is a possibility that the DOS attack cannot be prevented by changing the IP address. However, if the MAC address is monitored as in the present invention, the MAC address is unique to the terminal. Therefore, the transmission terminal can be specified, and the DOS attack by changing the IP address can be prevented.

  In addition, when a terminal that has performed a DOS attack does not voluntarily perform a DOS attack, the user recognizes an abnormality because communication is not possible, and another predetermined time (the number required for recovery of the transmitting terminal) If the packet discarding is stopped when the time has passed, the normal communication from the transmitting terminal that has stopped performing the DOS attack can be recovered.

  Since the transmission terminal A is a DOS attack terminal, the transmission packet of the transmission terminal A is abnormal traffic. Since the transmission terminal B is a normal user's terminal, the transmission packet is normal traffic. The traffic of the transmission terminal A becomes abnormal, the abnormality is detected by the timer unit 6 and recognized as a DOS attack terminal, the MAC address of the transmission terminal A is specified by the transmission source MAC address table 4 and the transmission source terminal identification unit 5, The packet discard buffer 7 notifies the packet reception buffer 1 of packet discard. On the other hand, since the transmitting terminal B is normal traffic, no abnormality is detected by the timer unit 6, and therefore it is possible to continue receiving packets.

  Each component described above can be realized by a CPU (Central Processing Unit) or the like, or by hardware.

It is a block diagram which shows the structure of one Embodiment of the DOS attack defense apparatus concerning this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Reception packet buffer part 2 Transmission destination IP address table 3 Transmission origin IP address table 4 Transmission origin MAC address table 5 Transmission origin terminal identification part 6 Timer part 7 Reception packet discard control part 10 DOS attack defense apparatus A Transmission terminal (attack terminal)
B Sending terminal (normal user terminal)

Claims (6)

A reception packet buffer unit that receives and accumulates transmission packets from the transmission terminal;
A table part that records the IP address of the transmission destination of the packet stored in the reception packet buffer part in association with the individual identification number that can determine the transmission source of the packet;
A counting unit for counting the number of packets having the same individual identification number for the same destination IP address recorded in the table unit within a predetermined time;
A DOS attack defense apparatus, comprising: a discard control unit that discards a received packet stored in the received packet buffer unit when a count value of the counting unit exceeds a predetermined value. The DOS attack protection apparatus according to claim 1, wherein the discard control unit stops discarding the received packet after a predetermined time has elapsed after discarding the received packet by the discard control unit.   3. The DOS attack defense apparatus according to claim 1, wherein the individual identification number is a MAC address (Media Access Control Address). Receive and store transmission packets from the sending terminal,
Record the IP address of the destination of the stored packet in association with the individual identification number that can determine the source of the packet;
Within a predetermined time, count the number of packets having the same individual identification number for the same recorded destination IP address,
A DOS attack protection method, comprising: discarding the accumulated received packets when the count value is equal to or greater than a predetermined value. 5. The DOS attack protection method according to claim 4, wherein after the reception packet is discarded, the reception packet is stopped after a predetermined time elapses.   6. The DOS attack protection method according to claim 4, wherein the individual identification number is a MAC address (Media Access Control Address).

Images