JP2018032906A - Ddos coordination countermeasure device, ddos coordination countermeasure method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique to allow attack information to be shared and countermeasures to be coordinated with high scalability when the whole Internet coordinates and deals with DDoS attacks.SOLUTION: One aspect of the present invention is a DDoS coordination countermeasure device included in an autonomous system (hereinafter, AS). The DDoS coordination countermeasure device includes: a storage unit for storing information on DDoS attacks for the AS and coordination ASs; a processing unit for obtaining communication traffic destined to a target IP address of DDoS attacks at the AS, calculating total communication traffic of the obtained communication traffic destined to the target IP address by the target AS, and determining an amount of resource allocation of a defense function of the AS against the calculated total communication traffic destined to the target ASs; and a communication unit for communicating with other devices of the AS and DDoS coordination countermeasure devices of the coordination ASs.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a network technology that realizes sharing of DDoS (Distributed Denial of Service attack) attack information and coping countermeasures between a plurality of organizations.

  A mechanism for signaling telemetry information, threat information, and countermeasure requests related to DDoS attacks in real time has been studied in IETF DOTS (DDoS Open Threat Signaling) shown in Non-Patent Document 1. One organization's defense by notifying DDoS attack information among multiple organizations and sharing the resources of the defense functions of each organization (for example, the mitigation device shown in Non-Patent Document 2) to deal with attacks It is expected to be able to cope with large-scale and advanced DDoS attacks that cannot be dealt with by functions alone (Non-patent Document 3).

IETF, "DDoS Open Threat Signaling," https://datatracker.ietf.org/doc/charter-ietf-dots/, 2015.6 Toyo Technica, "Introduction to Arbor Peakflow SP," http://www.kyoei-ele.com/products/index.php/prod/info/280/file/4.pdf IETF, "Use cases for DDoS Open Threat Signaling," https://datatracker.ietf.org/doc/draft-ietf-dots-use-cases/, 2015.10 Mizuguchi Takanori et al., “Traffic analysis system SAMURAI and service development,” NTT Technical Journal, 2008.7, http://www.ntt.co.jp/journal/0807/files/jn200807016.pdf

  The existing technology (DOTS system) can be used to deal with larger and more advanced DDoS attacks by sharing DDoS attack information sharing mechanisms between multiple organizations and defense function resources among multiple organizations. Cases are being considered.

  However, it has not been studied how to deal with the DDoS attack targeting each organization specifically by allocating defense function resources of multiple organizations. In addition, the existing technology only considers cooperation between a small number of organizations such as an organization damaged by a DDoS attack and an organization (ISP: Internet Service Provider, etc.) that manages the upstream network. However, for example, in order to maximize the defense capability against a large-scale DDoS attack that consumes network bandwidth, it is desirable to cooperate with the entire Internet to deal with the organization as close as possible to the attack source, A highly scalable technology that can operate on the Internet scale is required.

  In view of the above-described problems, an object of the present invention is to provide a technique for realizing high scalability for sharing attack information and cooperating in dealing with a DDoS attack in cooperation with the entire Internet.

  In order to solve the above-described problem, an aspect of the present invention is a DDoS cooperation response device provided in an autonomous system (hereinafter referred to as AS: Autonomous System), which stores information related to the DDoS attack of the AS and the cooperation AS And the traffic volume destined for the target IP address of the DDoS attack in the AS, the total traffic volume destined for the target IP address obtained for each target AS is calculated, and the calculated total traffic volume for each target AS On the other hand, the present invention relates to a DDoS cooperation coping apparatus having a processing unit that determines a resource allocation amount of the defense function of the AS, and a communication unit that communicates with another device in the AS and the cooperation AS.

  According to the present invention, it is possible to realize a high degree of scalability for sharing attack information and cooperating when dealing with a DDoS attack in cooperation with the entire Internet.

FIG. 1 is a block diagram of a network according to an embodiment of the present invention. FIG. 2 is a configuration diagram of an AS having a DDoS cooperation handling function according to an embodiment of the present invention. FIG. 3 is a block diagram illustrating a configuration of a DDoS cooperation handling apparatus according to an embodiment of the present invention. FIG. 4 is a simplified process flowchart of the DDoS cooperation handling apparatus according to the embodiment of the present invention. FIG. 5 is a diagram illustrating an example of a target IP address information table according to an embodiment of the present invention. FIG. 6 is a diagram illustrating an example of an attack information table according to an embodiment of the present invention. FIG. 7 is a diagram showing an example of a cooperation destination AS information table according to an embodiment of the present invention. FIG. 8 is a diagram showing an example of a mitigation device information table according to an embodiment of the present invention. FIG. 9 is a sequence diagram showing an example of an operation procedure according to the embodiment of the present invention. FIG. 10 is a sequence diagram showing an example of an operation procedure according to the embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  In the following embodiments, a DDoS cooperation countermeasure device deployed in an autonomous system (hereinafter referred to as AS: Autonomous System) that owns and manages a network configuring the Internet is disclosed. To summarize an embodiment described later, the DDoS cooperation handling apparatus adjusts the sharing of DDoS attack information between ASs and the allocation of defense function resources of each AS against each attack. In addition, as an architecture between DDoS cooperation coping devices, a distributed architecture that directly communicates only with DDoS cooperating devices of neighboring AS improves scalability and repeats local adjustments throughout the Internet. Achieve uniform resource allocation. Compared with DDoS attack destination IP address adjustment by referring to the destination IP address of DDoS attack and adjusting the resource allocation amount of each defense function by grouping those addressed to the same AS as one attack. Thus, the number of adjustments required between ASs can be reduced, and scalability can be improved.

  First, a network (Internet) according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 shows a block diagram of a network according to an embodiment of the present invention. In the present embodiment, it is assumed that a part of the plurality of organization networks (AS) constituting the network (Internet) has the DDoS cooperation countermeasure device of the present invention. Also, as an example, assume that multiple systems in AS1 (ISP network, etc.) are targets of DDoS attacks (target systems) from attacker terminals that exist in other ASs. Parameter adjustment when sharing and cooperating with DDoS attack information (parameters are the amount of defense function resources allocated to each AS to deal with attacks against a target), etc. A method for sharing necessary information and adjusting the coping parameters with other AS using the information will be described.

  As shown in FIG. 1, the network 10 has an arbitrary number of ASs (AS1 to AS8, etc.), and these ASs are interconnected to form a network topology of the network 10 imitating the Internet. . These AS are AS (AS1, AS2, AS3, AS5, AS8) having the mitigation device 50 and the DDoS cooperation countermeasure device 100, and AS (AS4, AS6, AS7) not having the mitigation device 50 and the DDoS cooperation countermeasure device 100. ).

  As will be described later, the DDoS cooperation countermeasure device 100 exchanges DDoS attack information and the like between each AS, adjusts the countermeasure parameter for dealing with the DDoS attack based on the exchanged DDoS attack information, and other ASs. To deal with DDoS attacks. Here, each AS holds in advance cooperation destination AS information indicating which AS's DDoS cooperation coping apparatus 100 should communicate with. An arbitrary number of ASs that are close to the network as viewed from each AS is set in the linked AS. In addition, for example, when dealing with an attack addressed to a target shared by AS1, AS2, and AS3, a countermeasure parameter for coping with a DDoS attack is the mitigation device 50 that determines how much Gbps the traffic addressed to the target in each AS. For example, the amount indicating how to handle by pulling in, the amount indicating how much Gbps the target address communication is reduced in each AS when filtering (threshold for filtering), and the like. These coping parameters are adjusted by calculating based on information such as the target communication amount flowing through each AS and the capacity (resource amount) of the mitigation device 50 held by each AS. Here, a more detailed description including a flow of information acquisition and a calculation formula when adjusting the communication traffic to be handled by taking in the mitigation apparatus 50 will be described in more detail below.

  When an arbitrary system in AS1 is damaged by an attack, AS1 sends the DDoS attack information (local AS number and target system) to the DDoS cooperation response device 100 of the cooperation destination AS (AS2 and AS5). A list of IP addresses), requests for information necessary for parameter adjustment, and requests for countermeasures against attacks are sent. Further, in the cooperation destination AS (for example, AS2), based on the information received from the DDoS cooperation countermeasure device 100 of AS1, the countermeasure to the target addressed communication is performed or the requested information is returned to the requesting AS (AS1). To do. Furthermore, the partner AS (AS2) requests the upstream partner AS (AS3, AS5, and AS8 in the case of AS2) to request DDoS attack information and information necessary for parameter adjustment, and to respond to the attack. Etc. By repeating this in the upstream AS direction, DDoS attack information etc. is propagated to the AS near the attack source.

  In this example, when there are multiple target systems when notifying DDoS attack information etc. from the AS targeted by the system in its own AS (hereinafter referred to as the target AS) to the linked AS. Reduces the necessary number of communications compared to the case of notifying the attack information in units of target IP addresses by collectively reporting the target IP addresses. In addition, the number of adjustments can be adjusted compared to the case where parameter adjustment is performed in units of target IP addresses by combining attacks addressed to IP addresses belonging to the same AS as one attack and making adjustments in units of destination AS. To reduce. Note that the timing of sending attack information, response requests, etc. from a certain AS to the linked AS is arbitrary. For example, when a new attack is detected on a system within the local AS, the response is first handled only by the defense function within the local AS. If the resource of the defense function in the own AS is tight, it is assumed that the attack is performed at regular intervals after detecting an attack on the system in the own AS.

  The mitigation device 50 is a device described in Non-Patent Document 2, for example, and performs countermeasures for target addressed communication based on the received DDoS attack information and the like. In addition to the use of the mitigation device 50, technologies for dealing with DDoS attacks include filtering of attack communication using an ACL (Access Control List) by a transfer device such as a router, and bandwidth limitation of communication targeted to the attack ( Rate limit etc.) is also assumed, and the present invention can also be combined with these countermeasure techniques. In the operation procedure in the present embodiment to be described later, a specific operation procedure in the case of cooperating using the mitigation device 50 will be described.

  Next, with reference to FIG. 2, the configuration of an AS having a DDoS cooperation handling apparatus according to an embodiment of the present invention will be described. In the following, the present embodiment will be described focusing on AS1, but it will be easily understood by those skilled in the art that the present embodiment is applicable to other ASs.

  As shown in FIG. 2, the AS includes a mitigation device 50, a DDoS cooperation countermeasure device 100, a traffic information collection / DDoS attack detection device 200, a network control device 300, and a packet transfer device 400.

  The traffic information collection / DDoS attack detection device 200 periodically collects flow information (communication amount for each flow including a set of transmission / reception IP address, transmission / reception port number, protocol number, etc.) from a packet transfer device 400 such as a router. By detecting the collected flow information, the occurrence of a DDoS attack on a specific destination is detected. When an attack is detected, the traffic information collection / DDoS attack detection device 200 transmits an attack detection message including the IP address of the target system to the DDoS cooperation countermeasure device 100 of the self AS. A plurality of target IP addresses included in the attack detection message may be notified when there are a plurality of target systems. Note that the traffic information collection / DDoS attack detection apparatus 200 may be realized by, for example, SAMURAI described in Non-Patent Document 4. Further, the traffic information collection / DDoS attack detection device 200 is configured such that when a DDoS attack occurs or at an arbitrary timing, the traffic amount to the target IP address, the maximum resource amount of the mitigation device 50, and the resources that can be used by the mitigation device 50 It has a function of measuring the amount etc. and notifying it to the DDoS cooperation handling apparatus 100 of its own AS.

  The mitigation device 50 is a device specialized in dealing with a DDoS attack like the device described in Non-Patent Document 2, and distinguishes attack communication from normal communication from among communication to a certain destination, and performs only attack communication. It is possible to take measures such as blocking. As described above, other means for dealing with a DDoS attack can be assumed, but this embodiment describes a case where an AS has a mitigation device 50 as an example of a means for dealing with a DDoS attack.

  The network control device 300 has a function of controlling the packet transfer device 400 such as a router. The network control device 300 may be, for example, an SDN (Software-Defined Networking) controller. Further, the network control device 300 communicates with the DDoS cooperation handling device 100, and based on the information notified from the DDoS cooperation handling device 100 (target IP address list, handling method, handling parameters, etc.), packet transfer By controlling the device 400, the mitigation device 50 performs control such as bypassing communication addressed to the target and setting filtering for each packet transfer device 400. A specific example in the case of using the mitigation device 50 will be described. The network control device 300 uses BGP (Border Gateway Protocol), OpenFlow, or the like to transfer a packet addressed to a target held by each packet transfer device 400. By temporarily rewriting the related routing information (changing the transfer destination to the IP address of the mitigation device 50), only the target-addressed packet can be diverted to the mitigation device 50 to be inspected and dealt with.

  The DDoS cooperation countermeasure device 100 communicates with the network control device 300, DDoS attack information including a list of target IP addresses, a DDoS attack countermeasure method (for example, using the mitigation device 50), and a communication amount to be dealt with (mitigation device 50) Notification of the amount of communication addressed to the target). Further, the DDoS cooperation handling apparatus 100 communicates with the traffic information collection / DDoS attack detection apparatus 200 to acquire the communication amount addressed to the target IP address, the maximum resource amount of the mitigation device 50, the available resource amount, and the like. When receiving the attack detection message, the DDoS cooperation handling apparatus 100 accumulates the target IP address included in the attack detection message in a target IP address table described later. Furthermore, the DDoS cooperation handling apparatus 100 communicates with the DDoS cooperation handling apparatus 100 of the cooperation destination AS, and is necessary for DDoS attack information (number (ID) that can identify the target AS, a list of target IP addresses, etc.) and cooperation handling. Information (a value obtained by summing the communication traffic addressed to the target IP address flowing through each AS in units of destination ASs, available resource amount of the mitigation device 50, handling parameters such as target communication traffic addressed by the mitigation device 50 of each AS) Interact. Here, the DDoS attack information is not limited to the above information, but may include the attack type, the IP address information of the attack source, and the like according to the way of cooperating.

  The DDoS cooperation handling apparatus 100 may typically be realized by a server, and includes, for example, a drive device, an auxiliary storage device, a memory device, a processor, an interface device, and a communication device that are interconnected via a bus. . Various computer programs including programs for realizing various functions and processing described later in the DDoS cooperation handling apparatus 100 are recorded on a recording medium such as a CD-ROM (Compact Disk-Read Only Memory), a DVD (Digital Versatile Disk), or a flash memory. May be provided. When the recording medium storing the program is set in the drive device, the program is installed from the recording medium to the auxiliary storage device via the drive device. However, it is not always necessary to install the program using a recording medium, and the program may be downloaded from any external device via a network or the like. The auxiliary storage device stores the installed program and also stores necessary files and data. The memory device reads and stores the program and data from the auxiliary storage device when there is an instruction to start the program. The processor executes various functions and processes of the DDoS cooperation coping apparatus 100 as described later according to various data such as a program stored in the memory device and parameters necessary for executing the program. The interface device is used as a communication interface for connecting to a network or an external device. The communication device executes various communication processes for communicating with a network such as the Internet.

  However, the DDoS cooperation handling apparatus 100 is not limited to the hardware configuration described above, and may be realized by any other appropriate hardware configuration. Note that the configuration shown in the present embodiment is an example. For example, the traffic information collection / DDoS attack detection device 200 and the network control device 300 may be incorporated in the DDoS cooperation countermeasure device 100.

  Next, with reference to FIG. 3, a DDoS cooperation handling apparatus according to an embodiment of the present invention will be described in detail. FIG. 3 is a block diagram illustrating a configuration of a DDoS cooperation handling apparatus according to an embodiment of the present invention.

  As illustrated in FIG. 3, the DDoS cooperation handling apparatus 100 includes a processing unit 110, a storage unit 120, and a communication unit 130.

  As will be described in detail below, the processing unit 110 acquires the communication amount addressed to the target IP address of the DDoS attack, calculates the total communication amount of the communication amount addressed to the target IP address for each target AS, and calculates The resource allocation amount of the defense function of the AS such as the mitigation device 50 is determined for the total communication amount addressed to the target AS. Specifically, the processing unit 110 includes a message receiving unit 111, an attack detection message processing unit 112, an information request message processing unit 113, an information response message processing unit 114, a countermeasure request message processing unit 115, which will be described in detail below. The readjustment message processing unit 116, the parameter adjustment unit 117, and the attack countermeasure setting unit 118 are included.

  The storage unit 120 stores information related to the DDoS attack of the local AS and the linked AS, and specifically includes a target IP address information table, an attack information table, a linked AS information table, and a mitigation device information table.

  The communication unit 130 communicates with the DDoS cooperation handling apparatus 100 of another AS, the traffic information collection / DDoS attack detection apparatus 200 of the own AS, and the network control apparatus 300 of the own AS. When information is directly acquired or controlled from the packet transfer device 400 or the mitigation device 50, the communication unit 130 also communicates with these devices.

  The message reception unit 111 has a function of waiting for various messages from the traffic information collection / DDoS attack detection device 200 and other DDoS cooperation response devices 100 and distributing them to the corresponding message processing unit according to the type of the received message. As shown in FIG. 4, in step S101, the message receiving unit 111 stores the received message in a queue and transfers the message to a corresponding message processing unit using, for example, a FIFO method. There are five types of messages: attack detection messages, information request messages, information response messages, countermeasure request messages, and readjustment messages. Details of the contents of each message will be described later.

  The attack detection message processing unit 112 performs processing in response to the attack detection message from the traffic information collection / DDoS attack detection apparatus 200. When the attack detection message is received (S110), the attack detection message processing unit 112 adds the target IP address included in the attack detection message to the target IP address information table of its own AS as shown in FIG. 5 (S111). ). Here, the target IP address information table is a table for managing the IP address of the system targeted by the own AS, and may have a table format as shown in FIG. In the example shown in FIG. 5, the target IP address information table is composed of an ID of an AS (“target AS number”) that has suffered damage from the attack and a target IP address. Information on the target IP address in this table is notified from the traffic information collection / DDoS attack detection device 200 every time a new IP address attack is detected, or at an arbitrary timing, for example, and accumulated.

  Further, the attack detection message processing unit 112 acquires the communication amount addressed to each IP address included in the target IP address information table via the traffic information collection / DDoS attack detection device 200, and the attack information as shown in FIG. The sum of the traffic volume addressed to the IP address (“total value of attack traffic volume of target AS unit”) is stored in the table (S112). Here, the attack information table is a table for managing an attack being handled by each AS, and may have a table format as shown in FIG. In the example shown in FIG. 6, the attack information table includes the ID of the AS that has suffered the attack (“target AS number”), and the ID of the direct source AS of the response request message described later (“request source AS”). Number ")," target IP address ", the status information of the local AS (AS2) and other AS (AS3, etc.) for the attack. In the attack information table, a record is prepared with “target AS number” as a primary key, and information on other ASs exists for the number of linked ASs. In addition, the response status information includes the ID of the AS that is taking action (“AS number”), the action that is being taken (“action method”), the “total attack traffic for each target AS”, It is composed of information such as the amount of communication being performed (“communication amount being handled”) and the like. In particular, for the handling status information, for example, when the handling method is a rate limit or the like, a threshold value or the like of how much the limit is applied may be registered, and is not limited to the above information. Also, even if the attack is directed to the same target AS, for example, if it is desired to divide the control finely according to the protocol used for the attack, it is also assumed that a record is prepared with “target AS + attack protocol, etc.” as the primary key The information for managing a certain attack is not limited to the illustrated information.

  In this processing and the subsequent processing, when the traffic volume is acquired by specifying each destination IP address, the load of the traffic information collection / DDoS attack detection device 200 increases, or acquisition takes time. there's a possibility that. For this reason, for example, refer to flow information at a level that is assumed to be obtained from an ISP at normal times (only the information of the top few flows with the most traffic is saved), and the target received in it If there is traffic information destined for an IP address included in the IP address list, it is assumed that only that information is used. The attack detection message processing unit 112 determines whether the total attack traffic amount of the target AS unit is equal to or greater than a preset threshold value (S112). If the total value is equal to or greater than the threshold value, the attack detection message processing unit 112 performs the following two processes. .

  First, the attack detection message processing unit 112 refers to its own cooperation destination AS information table as shown in FIG. 7, and targets the DDoS cooperation handling apparatus 100 of each cooperation destination AS. An information request message including a list of target AS numbers and target IP addresses in the IP address information table and its own AS number is transmitted (S113). In addition, although the setting method of said threshold value is arbitrary, the prior setting by the administrator of each AS is assumed, for example. In addition, the list of target IP addresses may reduce the data size to be transmitted by transmitting only the difference at the previous transmission. Here, the cooperation destination AS information table is a table for managing the information of the cooperation destination AS in each AS, and has a table format as shown in FIG. In the example shown in FIG. 7, the cooperation destination AS information table is composed of “cooperation destination AS ID”, “IP address of DDoS cooperation countermeasure device”, and “available resource amount of the mitigation device”. Other information such as the MAC address and port number of the DDoS cooperation handling apparatus 100 may be registered depending on the communication mode with the DDoS cooperation handling apparatus 100 of the destination AS.

  Second, the attack detection message processing unit 112 acquires the available resource amount of the own AS mitigation device 50 used for parameter adjustment, which will be described later, via the traffic information collection / DDoS attack detection device 200 and is shown in FIG. Is registered in the value of its own mitigation device information table (S114). Here, the mitigation device information table is a table for managing the information of the mitigation device 50 in each AS, and may have a table format as shown in FIG. In the embodiment shown in FIG. 8, the mitigation device information table is composed of information such as “maximum resource amount” and “available resource amount” that is a value obtained by subtracting the resource amount being used for attack countermeasures from the maximum resource amount. Is done. These pieces of information are collected and updated periodically or at an arbitrary timing from the mitigation apparatus 50 or the like via the traffic information collection / DDoS attack detection apparatus 200. Further, the maximum resource amount may be registered by the administrator when the mitigation device 50 is introduced. Here, it is assumed that when there are a plurality of mitigation devices 50 in one AS, it is assumed that the total value is registered, but they may be managed in units of mitigation devices. If the attack addressed to the target AS is already being dealt with, the attack detection message processing unit 112 may acquire the traffic volume addressed to the target AS being dealt with based on the attack information table of the own AS. Note that when an attack detection message is received, an attack countermeasure setting unit 118 described later may perform an attack countermeasure.

  The information request message processing unit 113 performs processing in response to the information request message from the DDoS cooperation handling apparatus 100 of another AS. When receiving the information request message (S120), the information request message processing unit 113 stores the target AS number, the list of target IP addresses, and the AS number of the message transmission source included in the information request message in its own attack information table. Register (S121). Further, the information request message processing unit 113 acquires the traffic amount addressed to each IP address included in the list of target IP addresses received via the traffic information collection / DDoS attack detection device 200, and the total value is obtained as the attack information table. Is registered as the total attack traffic volume of the target AS unit (S122). At this time, the information request message processing unit 113 uses, for example, BGP (Border Gateway Protocol) route information or the like to determine whether the communication addressed to the target is flowing from the own AS to the message transmission source AS. If there is not, the target communication volume is registered as 0. Further, the information request message processing unit 113 determines whether the total attack traffic amount of the target AS unit is equal to or greater than a preset threshold value (S122). If the total value is equal to or greater than the threshold value, the following three processes are performed.

  First, the information request message processing unit 113 is included in the received message to the DDoS cooperation handling apparatus 100 of the cooperation destination AS (excluding the message transmission source) included in the cooperation destination AS information table of its own AS. An information request message including a target AS number, a list of target IP addresses, and its own AS number is transmitted (S123).

  Secondly, the information request message processing unit 113 acquires the available resource amount of the defense function (such as the mitigation device 50) via the traffic information collection / DDoS attack detection device 200, and sets the value in its own mitigation device information table. sign up. Further, when the attack addressed to the target AS is already being dealt with, the information request message processing unit 113 acquires the communication amount addressed to the target AS being dealt with based on the attack information table of the own AS. Thirdly, the information request message processing unit 113 sets the same target AS number as that included in the received information request message, its own AS number, and the target AS unit flowing in its own AS to the source AS of the information request message. An information response message including the total value of the attack traffic, the available resource amount of the mitigation device 50, and the traffic addressed to the target AS being dealt with is transmitted (S124).

  The information response message processing unit 114 performs processing in response to the information response message from the DDoS cooperation handling apparatus 100 of another AS. When the information response message is received (S130), the information response message processing unit 114 refers to the target AS number included in the message and receives the information part regarding the other AS in the corresponding row in the attack information table (S131). Specifically, the information response message processing unit 114 updates the message transmission source AS number (in the case of new registration), the total attack traffic volume for each target AS, and the target AS traffic volume being dealt with. Further, the information response message processing unit 114 updates the available resource amount (value of the message transmission source AS) of the mitigation device 50 in the cooperation destination AS information table.

  In addition, "If the target AS number included in the message is the same as its own AS number, an information response message including the target AS number has been received from all ASs that have transmitted information request messages including the target AS number. In the case of (S132), or the target AS number included in the message is different from its own AS number, the target AS number is obtained from all ASs that have transmitted the information request message including the target AS number. In the case where the information response message including the target AS number has been received and the countermeasure request message including the target AS number has been received from the downstream AS (S136), the parameter adjustment unit 117 described later with the cooperation destination AS Perform the adjustment process.

  The information response message processing unit 114 uses the “communication amount handled by each AS for the communication addressed to the target AS” obtained as a result of the parameter adjustment processing, so that the value of the available resource amount (self Subtracting the amount of traffic handled by the AS), the total attack traffic volume of the target AS unit in the information related to the local AS in the attack information table (subtracting the amount of traffic handled by the other AS) and the information of the local AS and other AS The value of the traffic volume being dealt with (the value of the traffic volume dealt with by each AS is set) is updated (S133, S134, S137, S138). In addition, a countermeasure to the target addressed communication is performed by the attack countermeasure setting unit 118 described later.

  Further, the information response message processing unit 114 transmits a readjustment message to the DDoS cooperation handling apparatus 100 of the handling request message transmission source AS (downstream AS) (S139) (this processing is performed by the target AS included in the message). (Only when the number is different from the AS number) In the readjustment message, the target AS number (set to the same value as that included in the received message), its own AS number, the total amount of attack traffic for each target AS, the amount of resources available for the mitigation device 50, and being handled The amount of traffic to the target AS is included.

  Further, the information response message processing unit 114 transmits a handling request message to the DDoS cooperation handling apparatus 100 of the cooperation destination AS (excluding the message transmission source) (S135, S140). In the action request message, the target AS number (set the same value as the target AS number of the received message), its own AS number, the target AS traffic handled by the message destination AS (value obtained as a result of adjustment), The value obtained by subtracting the target AS traffic addressed by the message destination AS used for adjustment from the target AS traffic addressed by the message destination AS (value obtained as a result of adjustment) (hereinafter referred to as target AS communication) Difference value of coping amount with respect to). In addition, the difference value of the handling amount with respect to the communication addressed to the target AS is used to correct a shift in information when dealing with a plurality of attacks targeting different ASs in parallel.

  The handling request message processing unit 115 performs processing in response to a handling request message from another DDoS cooperation handling apparatus 100. When the countermeasure request message is received (S150), the countermeasure request message processing unit 115 uses the difference value of the countermeasure amount with respect to the communication addressed to the target AS, and the available resource amount (subtraction of difference value) and attack of the mitigation device information table Updates the traffic (target difference) for the target AS that is being handled by the local AS in the information table. Further, a countermeasure to the target addressed communication is performed by the attack countermeasure setting unit 118 described later (S151). "When an information response message including the target AS number has been received from all ASs that have transmitted the information request message including the target AS number included in the message (S152)", parameter adjustment described later with the cooperation destination AS Parameter adjustment processing by the unit 117 is performed (S153). The process after the parameter adjustment is the same as the process after the parameter adjustment of the information response message processing unit (S154 to S156).

  The readjustment message processing unit 116 performs processing in response to the readjustment message from the DDoS cooperation handling apparatus 100 of another AS. When the readjustment message is received (S160), the readjustment message processing unit 116 refers to the target AS number included in the received message, and information on the other AS in the corresponding row in the attack information table (message source AS The part corresponding to the number is updated with the received information (S161). Specifically, the readjustment message processing unit 116 updates the total attack traffic volume of the target AS unit and the target AS traffic volume being dealt with. Further, the readjustment message processing unit 116 updates the available resource amount (value of the message transmission source AS) of the mitigation device 50 in the cooperation destination AS information table. Thereafter, parameter adjustment processing by a parameter adjustment unit described later is performed with the cooperation destination AS (S162). The process after the parameter adjustment is the same as the process after the parameter adjustment of the information response message processing unit described above (S163 to S165).

  The parameter adjustment unit 117 is called by another processing unit, and is stored in the attack information table, the cooperation destination AS information table, and the mitigation device information table (total attack traffic volume of the target AS unit of the local AS and the cooperation destination AS). Value, communication volume being handled, and amount of available resources), it has a function of calculating the traffic volume to be handled between the local AS and the linked AS for attacks directed to any AS. Here, the number of adjustments required can be reduced by adjusting the amount of communication to be handled by each AS by collecting attacks in the target AS unit, compared to the case of adjusting one by one in the target IP address unit. In the embodiment described later, when each AS handles using the mitigation device 50, the amount of communication handled by each AS is adjusted so that the usage rate of the mitigation device 50 of each AS is as uniform as possible. A method will be described. However, the policy (objective function) for adjustment is not limited to the above.

  The attack countermeasure setting unit 118 is called by another processing unit and refers to the target IP address information table and the attack information table, so that the target IP address list, the countermeasure method, and the target AS-addressed traffic to be dealt with by the own AS are determined. It has a function of acquiring and notifying the network control device 300 of such information. As described above, based on the received information, the network control device 300 performs the communication for the target AS (including the communication for the IP address included in the target IP address list) by the notified communication amount. Pull to 50 to deal with it. In addition, the timing of calling the attack countermeasure setting unit 118 by another processing unit is also arbitrary. For example, it is assumed that the attack processing setting unit 118 is called at a timing when various messages are received and when a parameter adjustment process is completed by the message processing unit.

  Next, with reference to FIGS. 9 to 10, when the operation procedure between the DDoS cooperation countermeasure devices according to an embodiment of the present invention and each AS has the mitigation device 50, cooperation countermeasures are performed between a plurality of ASs. An example of coping logic when performing will be described. 9 and 10 are sequence diagrams showing an operation procedure between the DDoS cooperation countermeasure apparatuses according to the embodiment of the present invention. In this coping logic, the amount of communication processed by each mitigation device 50 so that the usage rate of the mitigation device 50 of each AS is as uniform as possible so that it becomes impossible to deal with even when multiple locations are attacked simultaneously. Take action while adjusting. This countermeasure logic is an example. For example, any countermeasure logic such as dealing with attacks targeted to each target AS up to the resource upper limit of the mitigation apparatus 50 in order from the AS closest to the attack source can be applied.

  Here, assuming that the downstream AS can distinguish between the packet that has been inspected by the mitigation device 50 of the upstream AS and the packet that has not been inspected, each AS targets only the unaddressed packet addressed to the target. The specified amount of communication is drawn into the mitigation device 50 to deal with it. As a method for making it possible to distinguish between an inspected packet and an uninspected packet, for example, using OpenFlow or the like, in the upstream AS, the destination IP address of the target destination packet that has been inspected by the mitigation device 50 is Damage can be done by rewriting to an arbitrary IP address that is not used normally in the damaged AS, returning to the original IP address after reaching the damaged AS, or using tunneling technology such as GRE (Generic Routing Encapsulation). Methods such as encapsulating and transferring to any router in the AS are conceivable, but the method is not limited to these methods. (In either method, if the upstream AS mitigation device 50 has inspected the AS, Then, since it looks like a packet with a destination IP address different from the target, double pull-in to the mitigation device 50 can be avoided). In this case, the IP address information used for rewriting and the IP address of the node that is the start point and end point of the tunnel are added between the DDoS cooperation response device 100 of the damaged AS and the DDoS cooperation response device 100 of the AS that performs the countermeasure. For example, it can be considered to be included in the handling request message.

  In the following, the operation procedure when automatically cooperating between ASs will be described, triggered by the detection of attacks on the target system 1 and the target system 2 by the AS1 traffic information collection / DDoS attack detection device 200. . Here, the DDoS cooperation response device 100 of each AS always waits for a message from the traffic information collection / DDoS attack detection device 200 or the DDoS cooperation response device 100 of another AS and receives the message as described above. The processing for the message is performed. In addition, when another message is received during processing of a certain message, the received message is stored in a queue, and processing is performed one by one from the oldest message. Moreover, although the following example describes the case where one AS (AS1) is targeted, even when multiple ASs are attacked simultaneously, each attack can be dealt with in parallel. it can.

  As shown in FIG. 9, in step S201, the AS1 traffic information collection / DDoS attack detection device 200 detects the occurrence of an attack, and the AS1 DDoS cooperation response device 100 receives the IP between the target system 1 and the target system 2. Send an attack detection message containing the address.

  In step S202, the DDoS cooperation handling apparatus 100 of AS1 adds the target IP address included in the attack detection message to the target IP address information table of its own AS.

  In step S203, the DDoS cooperation handling apparatus 100 of AS1 acquires the traffic volume addressed to the IP address included in the target IP address information table via the traffic information collection / DDoS attack detection apparatus 200, and calculates the total value of the traffic volume itself. Stored in the attack information table.

  In step S204, the DDoS cooperation handling apparatus 100 of AS1 determines whether the total attack traffic volume of the target AS unit is an amount that is equal to or greater than a preset threshold value. With reference to the table, an information request message including a target AS number, a list of target IP addresses, and its own AS number is transmitted to the DDoS cooperation handling apparatus 100 of each cooperation destination AS (AS2, AS5). Furthermore, the DDoS cooperation handling apparatus 100 of AS1 acquires the available resource amount of the own AS mitigation apparatus 50 used for parameter adjustment described later via the traffic information collection / DDoS attack detection apparatus 200, and its own mitigation apparatus information table. Register with. If the attack addressed to the target AS is already being dealt with, the DDoS cooperation handling apparatus 100 of AS1 acquires the traffic volume addressed to the target AS being dealt with based on the attack information table of the own AS. Here, the traffic volume addressed to the target AS being dealt with is assumed to be zero.

  In step S205, the DDoS cooperation handling apparatus 100 of AS2 and AS5 registers the target AS number, the list of target IP addresses, and the AS number of the transmission source of the message included in the information request message from AS1 in its own attack information table. .

  In step S206, the AS2 and AS5 DDoS cooperation response device 100 acquires the traffic volume addressed to the IP address included in the list of target IP addresses via the traffic information collection / DDoS attack detection device 200 of its own AS, and the total value thereof Is registered as the total attack traffic volume of the target AS unit in the attack information table. At this time, the DDoS cooperation handling apparatus 100 of AS2 and AS5 determines whether communication addressed to the target is flowing from its own AS to the message transmission source AS using, for example, BGP route information or the like. Registers the traffic addressed to the target as 0.

  In step S207, the AS2 and AS5 DDoS cooperation countermeasure device 100 determines whether the total attack traffic volume of the target AS unit is greater than or equal to a preset threshold value. For the DDoS cooperation handling device 100 of the cooperation destination AS (excluding the message transmission source) included in the destination AS information table, the target AS number included in the received message, the list of target IP addresses, and its own AS number are included. Send an information request message. Here, AS2 is associated with AS1, AS3, and AS8, and AS5 is associated with AS1. That is, AS2 transmits information request messages to AS3 and AS8, and AS5 does not transmit information request messages to other ASs. Also, AS3 and AS8 that have received the information request message from AS2 perform the information request message reception process of step S205 described above in the same manner. By sending an information request message in the upstream AS direction first, as in this procedure, each AS can start the target traffic volume acquisition process without waiting for adjustments in other ASs. As quick adjustments can be made. Further, the AS2 and AS5 DDoS cooperation coping apparatus 100 acquires the available resource amount of the mitigation apparatus 50 via the traffic information collection / DDoS attack detection apparatus 200 and registers it in its own mitigation apparatus information table. If the attack addressed to the target AS is already being dealt with, the DDoS cooperation countermeasure device 100 of AS2 and AS5 acquires the traffic volume addressed to the target AS being dealt with based on the attack information table of the own AS. Here, the traffic volume addressed to the target AS being dealt with is assumed to be zero. Furthermore, the DDoS cooperation handling apparatus 100 of AS2 and AS5 sends the same target AS number, its own AS number, and the target AS unit that flows in its own AS to the source AS of the information request message. The information response message including the total value of the attack traffic of the target, the available resource amount of the mitigation device, and the traffic addressed to the target AS being dealt with is transmitted. Here, a case where AS1 receives the information response message from AS2 first and then receives the information response message from AS5 will be described.

  In step S208, when the DDoS cooperation handling apparatus 100 of AS1 receives the information response message from AS2, it refers to the target AS number included in the message, and information on the other AS in the corresponding row in the attack information table. Update the part with the received information. Specifically, the DDoS cooperation handling apparatus 100 of AS1 registers the received total attack traffic volume of the target AS unit and the target AS traffic volume being dealt with as AS2 information of the message transmission source.

  In step S209, the DDoS cooperation handling apparatus 100 of AS1 registers the available resource amount (message transmission source AS value) of the mitigation apparatus 50 in the cooperation destination AS information table.

  In step S210, the DDoS cooperation coping apparatus 100 of AS1 responds to the information response message from AS2, “if the target AS number included in the message is the same as its own AS number, and includes the target AS number. If an information response message including the target AS number has been received from all ASs that sent the request message, or if the target AS number included in the message is different from its own AS number, and the target AS number When the information response message including the target AS number has been received from all ASs that have transmitted the information request message including the number and the response request message including the target AS number has been received from the downstream AS. It is determined whether or not the condition is met, and the process is terminated because the condition is not met.

  In step S211, when the information response message from AS5 is received, the DDoS cooperation handling apparatus 100 of AS1 looks at the target AS number included in the message, and the information part regarding other AS in the corresponding row in the attack information table Is updated with the received information. Specifically, the DDoS cooperation handling apparatus 100 of AS1 registers the received attack traffic volume in units of target AS and the traffic volume addressed to the target AS being dealt with as AS5 information of the message transmission source.

  In step S212, the DDoS cooperation handling apparatus 100 of AS1 registers the available resource amount (value of the message transmission source AS) of the mitigation apparatus 50 in the cooperation destination AS information table.

  In step S213, the DDoS cooperation handling apparatus 100 of AS1 makes a determination on the information response message from AS5 based on the same conditions as in step S210. If “the target AS number included in the message is the same as its own AS number” In order to match the case where the information response message including the target AS number has been received from all ASs that have transmitted the information request message including the target AS number, by solving the following optimization problem, Calculate the traffic to the target AS that is handled by each AS (AS1, AS2, AS5). In generalized terms, the optimization problem can be:

AS1、AS2、AS5で調整する場合には、以下の最適化問題を解くことになる。

When adjusting with AS1, AS2, and AS5, the following optimization problem is solved.

ステップＳ２１４において、AS1のDDoS連携対処装置１００は、パラメータ調整処理の結果得られた、「その標的AS宛通信に対して各ASで対処する標的AS宛通信量」を用いて、mitigation装置情報テーブルの利用可能リソース量の値（自ASで対処する通信量分減算）、攻撃情報テーブルの自ASに関する情報の標的AS単位の攻撃通信量の合計値（他ASで対処する通信量分減算）と自ASと他ASの情報内の対処中の通信量の値（それぞれのASで対処する通信量の値を設定）を更新する。

In step S214, the DDoS cooperation handling apparatus 100 of AS1 uses the “communication amount addressed to each target AS to be handled by each AS for the communication addressed to the target AS” obtained as a result of the parameter adjustment process, and the mitigation apparatus information table Available resource amount value (subtracting traffic amount handled by own AS), total attack traffic amount of target AS unit of information related to own AS in attack information table (subtracting traffic amount handled by other AS) and Update the value of the traffic volume being handled in the information of the local AS and other ASs (set the value of the traffic volume handled by each AS).

  In step S215, the DDoS cooperation handling apparatus 100 of AS1 notifies the network control apparatus 300 of the target IP address and the target AS-addressed communication volume to be dealt with by its own AS.

  In step S <b> 216, the network control device 300 takes care of the communication addressed to the target IP address described in the attack information table to the mitigation device 50 by the communication amount addressed to the target AS.

In step S217, the DDoS cooperation handling apparatus 100 of AS1 transmits a handling request message to the DDoS cooperation handling apparatus 100 of the cooperation destination AS (AS2, AS5). In the action request message, target AS number (set AS1 that is the same value as the target AS number of the received message), own AS number (set AS1), and target AS traffic handled by the message destination AS (adjustment) The difference value (x _AS −X _AS ) of the handling amount with respect to the x _AS and the communication addressed to the target AS obtained as a result of

  As shown in FIG. 10, in step S218, the AS2 and AS5 DDoS cooperation handling apparatus 100 uses the difference value of the handling amount for the communication destined for the target AS included in the received message, and the available resources of the mitigation apparatus information table Update the amount (subtraction for the difference value) and the communication amount for the target AS being handled by the local AS in the attack information table (addition for the difference value).

  In step S 219, the AS2 and AS5 DDoS cooperation handling apparatus 100 takes in the communication for the target IP address by the requested amount via the network control apparatus 300 and deals with it.

  In step S220, the DDoS cooperation handling apparatus 100 of AS2 "if the information response message including the target AS number has been received from all ASs that transmitted the information request message including the target AS number included in the message" Parameter adjustment processing similar to that in step S205 is performed with the cooperation destination AS (AS3, AS8). Note that AS5 has not transmitted an information request message (because there is no AS that can handle further upstream), so only update the table and handle the request, and end the response request message processing.

  In step S221, the DDoS cooperation handling apparatus 100 of AS2 uses the target AS-addressed communication volume that is dealt with by each AS for the communication addressed to the target AS, which is obtained as a result of the parameter adjustment process. Update the value of.

  In step S222, the DDoS cooperation handling apparatus 100 of AS2 handles the communication addressed to the target IP address by the amount corresponding to the target AS addressed communication amount via the network control apparatus to deal with it.

  In step S223, since the target AS number included in the message is different from its own AS number, the DDoS cooperation handling apparatus 100 of AS2 re-sends the DDoS cooperation handling apparatus 100 of the handling request message source AS (AS1). Send an adjustment message. The readjustment message includes the target AS number (set the same value AS1 as included in the received message), its own AS number (set AS2), the total attack traffic for each target AS, and the use of the mitigation device 50 This includes the amount of possible resources and the traffic to the target AS being dealt with.

In step S224, the DDoS cooperation handling apparatus 100 of AS2 transmits a handling request message to the DDoS cooperation handling apparatus of the cooperation destination AS (AS3, AS8). In the action request message, target AS number (set AS1 that is the same value as the target AS number of the received message), own AS number (set AS2), and target AS traffic handled by the message destination AS (adjustment) X _AS ) obtained as a result of the above and a difference value (x _AS −X _AS ) of the amount of handling for the communication addressed to the target AS. The AS3 and AS8 that have received the response request message execute response request message processing.

  In step S225, the DDoS cooperation handling apparatus 100 of AS1 refers to the target AS number included in the received message, and obtains information on the other AS of the corresponding row in the attack information table (part corresponding to the message transmission source AS2). Update with the received information. Specifically, the DDoS cooperation countermeasure device 100 of AS1 updates the total attack traffic volume of the target AS unit and the target AS traffic volume being dealt with. Further, the DDoS cooperation handling apparatus 100 of AS1 updates the available resource amount (value of the message transmission source AS2) of the mitigation apparatus 50 in the cooperation destination AS information table.

  In step S226, the DDoS cooperation coping apparatus 100 of AS1 uses the updated value to solve the optimization problem described above again, and calculates the target AS-addressed communication addressed by each AS (AS1, AS2, AS5).

  In step S227, the DDoS cooperation handling apparatus 100 of AS1 uses the obtained target AS traffic volume, and the value of the available resource amount in the mitigation apparatus information table (subtracts the traffic volume to be handled by its own AS). , The total attack traffic volume for each target AS in the information related to the local AS in the attack information table (subtracting the traffic volume handled by the other AS) and the traffic volume currently being handled in the information of the local AS and the remote AS (each Update the traffic value to be handled by the AS.

  In step S228, the DDoS cooperation handling apparatus 100 of AS1 notifies the network control apparatus 300 of the target IP address and the target AS-addressed traffic to be dealt with by its own AS.

  In step S229, the network control device takes in the communication addressed to the target IP address by the amount corresponding to the communication amount addressed to the target AS, and deals with it.

  In step S230, the DDoS cooperation handling apparatus 100 of AS1 transmits a handling request message to the DDoS cooperation handling apparatus 100 of the cooperation destination AS (AS2, AS5). The AS2 and AS5 that have received the handling request message perform handling request message processing.

  In each AS, each time various messages are received, processing corresponding to the received messages is performed. By repeating this, parameter adjustment is performed for the entire Internet for communication to a certain target AS (the amount of communication handled by each AS is optimized).

  In addition, as a convergence condition for preventing infinite parameter adjustment, for example, in each AS, the value of F obtained as a result of the previous adjustment processing for communication to a target and the current adjustment When the F value obtained as a result is compared and the improvement is not more than the preset threshold value, the message processing may be terminated without performing the parameter adjustment. The convergence condition is arbitrary and is not limited to this method.

  Further, in order to follow changes in the attack amount, the DDoS cooperation handling apparatus 100 of the target AS receives the attack detection message, sends the first handling request message, etc. By retransmitting the information request to the AS, the parameter adjustment may be performed again using the latest traffic information and the like at that time.

  In addition, each function part and each step of the above-described DDoS cooperation handling apparatus 100 may be realized by a processor executing a program stored in a memory device of a computer.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to the specific embodiment mentioned above, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 10 Network 50 mitigation apparatus 100 DDoS cooperation response apparatus 110 Processing part 120 Storage part 130 Communication part 200 Traffic information collection and DDoS attack detection apparatus 300 Network control apparatus 400 Packet transfer apparatus

Claims (7)

It is a DDoS cooperation coping device equipped in an autonomous system (hereinafter referred to as AS: Autonomous System)
A storage unit for storing information related to the DDoS attack of the AS and the linked AS;
Obtaining the traffic amount addressed to the target IP address of the DDoS attack in the AS, calculating the total traffic amount addressed to the acquired target IP address for each target AS, and for the calculated total traffic amount for each target AS A processing unit that determines the resource allocation amount of the defense function of the AS;
A communication unit that communicates with other devices in the AS and the associated AS;
DDoS cooperation coping device with   When the processing unit receives an attack detection message including a list of target IP addresses, for each AS to which the target IP address belongs, the processing unit calculates a total communication amount of traffic addressed to the IP addresses included in the list of target IP addresses. If the calculated total traffic is equal to or greater than a predetermined threshold, an information request message including a target AS number, a list of target IP addresses, and an AS number of the transmission source AS is transmitted to the DDoS cooperation countermeasure device of the cooperation AS. The DDoS cooperation coping apparatus according to claim 1.   When the processing unit receives an information request message including a target AS number, a list of target IP addresses, and an AS number of a source cooperative AS, the target IP addresses in the target IP address list are summed in units of destination ASs. When the traffic volume (hereinafter referred to as the total traffic volume) is calculated and the calculated total traffic volume addressed to the target AS is equal to or greater than a predetermined threshold, the target AS number and target An information request message including a list of IP addresses and the AS number of the transmission source AS is transmitted, and the target AS number, the AS number of the AS, the total communication amount addressed to the target AS, and a defense function The DDoS cooperation coping apparatus according to claim 1 or 2, wherein an information response message including an available resource amount and a communication amount addressed to the target AS being dealt with is transmitted.   The processing unit includes a target AS number, an AS number of a cooperation AS of the transmission source, a total communication amount that is a total of communication amounts destined for a target IP address belonging to the target AS, an available resource amount of the defense function, and the target being dealt with When receiving the information response message including the traffic volume addressed to the AS, the total traffic volume addressed to the target AS, the available resource amount of the defense function, Based on the traffic volume destined for the target AS, the traffic volume destined for the target AS to be dealt with by the AS and the linked AS is determined and the target AS number, the AS number of the local AS, the linked AS The DDoS cooperation coping device according to any one of claims 1 to 3, wherein a coping request message including a communication amount addressed to the target AS to be dealt with and a difference value of the coping amount for the communication directed to the target AS is transmitted.   The processing unit includes a handling request message including a target AS number, an AS number of a cooperative AS of the transmission source, a communication amount addressed to the target AS to be dealt with in the transmission destination AS, and a difference value of a handling amount for the communication addressed to the target AS. When received, the total traffic volume destined for the target AS, the traffic volume destined for the target AS to be dealt with in the cooperation destination AS, excluding the transmission source AS, and the target so that the usage rate of the defense function of each AS becomes uniform The DDoS cooperation coping apparatus according to any one of claims 1 to 4, wherein a communication quantity destined for the target AS to be dealt with by the AS and the cooperative AS is determined based on a difference value of a coping quantity for communications addressed to the AS. It is a DDoS cooperation coping method by the DDoS cooperation coping device provided in AS
Receiving a predetermined message from another device in the AS and the associated AS;
Obtaining a traffic amount addressed to the target IP address of the DDoS attack in the AS, and calculating a total traffic amount addressed to the acquired target IP address for each target AS;
Determining a resource allocation amount of the defense function of the AS with respect to the calculated total communication amount addressed to the target AS;
DDoS linkage coping method with.   The program for functioning a processor as each part of the DDoS cooperation response apparatus as described in any one of Claims 1 thru | or 5.

Images