JP4280245B2 - Flood attack prevention method and apparatus - Google Patents

Description

  The present invention relates to a flood attack prevention method and apparatus for protecting a device connected to a communication network from a flood attack such as a distributed denial of service (DDoS).

  In order to protect the devices connected to the communication network from flood attacks, a part of the traffic destined for the attacked host is discarded in the network device installed between the attacked host and the attacking host and reaches the attacked host. Conventionally, processing for reducing the traffic rate to be performed has been performed.

In a network device such as an IP router or a layer 2 switch, for traffic matching the packet identifier specified by the destination IP address, source IP address, protocol identifier, etc., the portion exceeding the specified rate limit setting value is discarded, A traffic policing function for transmitting traffic at a traffic rate below the rate limit setting value is widely implemented. Non-Patent Document 1, Non-Patent Document 2, and Non-Patent Document 3 are examples of implementation of this traffic policing function.
Cicco, “Policing and Shaping Overview”, http: // www. cisco. com / en / US / products / sw / iosswrel / ps1835 / products_configuration_guide_chapter09186a00800bd8ed. html Hitachi, "GR2000 Software Manual Manual Vol.2 Ver.08-03 compatible 500-10-158", http: // www. hitachi. co. jp / Prod / comp / network / manual / router / gr2k / 0803 / HTML / KAISETS2 / INDEX. HTM Juniper Networks, “Netscreen Concepts & Examples ScreenOS Reference Guide Volume 2: Fundamentals ScreenOS 5.1.0 P / N093-1367-0000 Rev. A” /http://www.netscreenconcepts&examplesscreenOSReferenceGuideVolume 2: juniper. net / techpubs / software / screenos / screenos5.1.0 / CE_v2. pdf

  However, when the processing for discarding a part of the packet addressed to the attacked host in the network device installed between the attacked host and the attacking host is realized by using the traffic policing function implemented in the conventional network device, Packets received from legitimate hosts that send packets to the attacked host at a small traffic rate are also discarded.

  An object of the present invention is to provide a flood attack prevention method and apparatus capable of protecting a packet received from a legitimate host sending a packet to the attacked host at a low traffic rate.

According to the first aspect of the present invention, the flood attack defense method comprises:
(A) The packet addressed to the attacked host is classified based on the value of the designated traffic identification parameter, and the received traffic rate of the received packet flow is designated as the designated first rate limit setting value for each classified packet flow. A packet that exceeds the first rate limit is transmitted for each classified packet flow at a transmission traffic rate that does not exceed the first rate limit setting value; and
(B) measuring the total transmission traffic rate of packets addressed to the attacked host transmitted in step (a);
(C) The transmission traffic rate addressed to the attacked host measured in step (b) is compared with the designated second rate limit setting value, and the transmission traffic rate addressed to the attacked host is set to the second rate limit setting. If greater than the value, updating the first rate limit set value to a value less than the current value.

According to the first aspect of the present invention, the flood attack protection device comprises:
A packet receiving means for receiving a packet addressed to the attacked host;
The packet addressed to the host under attack received by the packet receiving means is classified based on the value of the designated traffic identification parameter, and the received traffic rate of the received packet flow is designated by the designated first traffic for each classified packet flow. Individual traffic that discards packets that exceed the rate limit setting value and transmits packets addressed to the attacked host for each classified packet flow at a transmission traffic rate that does not exceed the first rate limit setting value Policing means;
Transmission traffic rate measuring means for measuring the total transmission traffic rate of packets addressed to the attacked host transmitted by the individual traffic policing means;
When the total transmission traffic rate measured by the transmission traffic rate measuring means is compared with the designated second rate limit setting value, and the transmission traffic rate addressed to the attacked host is larger than the second rate limit setting value, Rate limit setting value updating means for updating the first rate limit setting value to a value smaller than the current value.

  Packets addressed to the attacked host are classified based on the value of the specified traffic identification parameter, and traffic policing is performed using the same rate limit setting value for each classified packet flow. Therefore, a high traffic rate is addressed to the attacked host. While discarding a large amount of packets received from the attacking host that is sending packets at, the packets received from the legitimate host sending packets to the attacked host at a low traffic rate are either not discarded at all, or Thus, the number of packets to be discarded is reduced, and a large number of packets received from the attacking host are discarded, and packets received from the legitimate host can be transmitted to the attacked host without discarding much.

According to the second aspect of the present invention, the flood attack protection method comprises:
(A) classifying a packet addressed to an attacked host based on a value of a designated traffic identification parameter, and measuring a received traffic rate of a received packet for each classified packet flow;
(B) The received traffic rate addressed to the attacked host for each packet flow classified based on the value of the traffic identification parameter measured in step (a), the specified attack determination threshold value, and the specified traffic identification parameter Comparing each value, and as a result, obtaining all the traffic identification parameter values that result in the received traffic rate being greater than the attack determination threshold;
(C) For each packet flow addressed to the attacked host that matches one of the traffic identification parameter values obtained in step (b), the received traffic rate of the received packet is set to the designated first rate limit setting value. The excess packets are discarded, and packets are sent to the host under attack at the transmission traffic rate that does not exceed the first rate limit setting value for each packet flow, and other packet flows are received. Sending all the packets,
(D) measuring the total transmission traffic rate of packets addressed to the attacked host transmitted in step (c);
(E) The total transmission traffic rate addressed to the attacked host measured in step (d) is compared with a designated second rate limit setting value, and the total transmission traffic rate addressed to the attacked host is the second rate. Updating the value of the first rate limit set value to a value less than the current value if greater than the limit set value.

According to the second aspect of the present invention, the flood attack protection device comprises:
A packet receiving means for receiving a packet addressed to the attacked host;
Receiving traffic rate measuring means for classifying the packets addressed to the attacked host received by the packet receiving means based on the value of the designated traffic identification parameter and measuring the received traffic rate of the received packet for each classified packet flow; ,
The traffic identification parameter measured by the reception traffic rate measuring means is compared with the specified attack determination threshold value for each traffic identification parameter value, and as a result, the received traffic rate is greater than the attack determination threshold value. An attack traffic identification parameter value detecting means for obtaining all values of
For each packet flow addressed to the attacked host that matches one of the traffic identification parameter values obtained by the attack traffic identification parameter value detection means, the received traffic rate of the received packet flow is designated as a first rate limit setting value. For each packet flow, a packet is transmitted to the host under attack at a transmission traffic rate not exceeding the first rate limit setting value, and other packet flows are Individually limited traffic policing means for transmitting all received packets;
Transmission traffic rate measuring means for measuring the total transmission traffic rate of packets addressed to the attacked host transmitted by the individual limited traffic policing means;
The total transmission traffic rate addressed to the attacked host measured by the transmission traffic rate measuring means is compared with the designated second rate limit setting value, and the transmission traffic rate addressed to the attacked host is the second rate limit setting value. A rate limit setting value updating means for updating the value of the first rate limit setting value to a value smaller than the current value, if greater,
Have

  Based on the value of the specified traffic identification parameter, the packets addressed to the attacked host are classified. Among the classified packet flows, only the packet flow having the traffic identification parameter value determined to be an attack is classified. Because traffic policing is performed using the same rate limit setting value for each packet flow, a large amount of packets received from the attacking host sending packets to the attacked host at a high traffic rate are discarded, while the attacked host Packets received from legitimate hosts that send packets at a low traffic rate are not discarded at all, so a large amount of packets received from the attacking host are discarded, and packets received from legitimate hosts are not discarded at all. Send a packet to the host under attack Door can be.

  In addition, since the number of traffic policing settings does not depend on the number of types that can be taken by the traffic identification parameter value, the processing load on the flood attack defense device is kept small when the number of types that the traffic identification parameter value can take is large. be able to.

According to the third aspect of the present invention, the flood attack protection method comprises:
(A) classifying a packet addressed to an attacked host based on a value of a designated traffic identification parameter, and measuring a reception rate of a received traffic packet for each classified packet flow;
(B) The received traffic rate measured in step (a) is compared with the specified attack determination threshold value for each value of the specified traffic identification parameter, and as a result, the received traffic rate is greater than the attack determination threshold value. Obtaining all the traffic identification parameter values
(C) comparing the number of types of traffic identification parameter values obtained in step (b) with a designated attack flow number upper limit determination threshold;
(D) If the number of types of traffic identification parameter values is smaller than the attack flow number upper limit determination threshold value as a result of the comparison in step (c),
(D1) For each packet flow addressed to the attacked host that matches one of the traffic identification parameter values obtained in step (b), the received traffic rate of the received packet flow is designated as the first rate limit setting value. Packets that exceed the limit are discarded, and packets are sent to the attacked host at a transmission traffic rate that does not exceed the first rate limit setting value for each packet flow, and other packet flows are received. Send all packets,
(D2) Measure the total transmission traffic rate of packets addressed to the attacked host transmitted in step (d1),
(D3) The total transmission traffic rate addressed to the attacked host measured in step (d2) is compared with the designated second rate limit setting value, and the total transmission traffic rate addressed to the attacked host is the second rate. If greater than the limit set value, update the first rate limit set value to a value less than the current value.
Performing the steps (d1 to d3) in order,
(E) As a result of the comparison in step (c), when the number of types of traffic identification parameter values is larger than the attack flow number upper limit determination threshold, the received traffic rate of the received packet among the received packets addressed to the attacked host is And discarding packets that exceed the second rate limit setting value and transmitting the packet to the host under attack at a transmission traffic rate that does not exceed the second rate limit setting value.

According to the third aspect of the present invention, the flood attack defense apparatus includes the flood attack defense apparatus according to the second aspect,
For packets addressed to the attacked host received by the packet receiving means, discard the packets for which the received traffic rate of the received packet exceeds the specified second rate limit setting value, and the second rate An overall traffic policing means for transmitting a packet to an attacked host at a transmission traffic rate not exceeding a limit setting value;
An attack flow number upper limit determination means for comparing the number of types of traffic identification parameter values obtained by the attack traffic identification parameter value detection means with a specified attack flow number upper limit determination threshold;
If the number of types of the traffic identification parameter value is larger than the attack flow number upper limit determination threshold by the attack flow number upper limit determination means, traffic policing is executed by the overall traffic policing means, and the value of the traffic identification parameter value is When the number of types is smaller than the attack flow number upper limit determination threshold, the traffic policing switching means for executing traffic policing by the individual limited traffic policing means is further provided.

  If the packet addressed to the attacked host is classified based on the value of the specified traffic identification parameter, and there are many types of packet flows with the value of the traffic identification parameter determined to be an attack among the classified packet flows, Since traffic policing is performed by summing up all packet flows, even if the number of traffic identification parameter values determined to be the attack is large, the processing load of the flood attack defense device is kept low, and high for the attacked host Packets received from a number of attacking hosts that are sending packets at the traffic rate can be discarded.

According to the fourth aspect of the present invention, the flood attack defense method is different from the flood attack defense method of the second aspect.
When the value of the first rate limit setting value is set to 0, the transmission traffic rate addressed to the attacked host is compared with the specified second rate limit setting value, and the transmission traffic rate addressed to the attacked host Is larger than the second rate limit setting value, the received packet addressed to the attacked host is a packet for which the received traffic rate of the received packet exceeds the specified second rate limit setting value. And sending a packet to the attacked host at a transmission traffic rate that does not exceed the second rate limit setting value.

According to the fourth aspect of the present invention, the flood attack defense apparatus is a flood attack defense apparatus according to the second aspect,
When the value of the first rate limit setting value is set to 0, the transmission traffic rate addressed to the attacked host measured by the transmission traffic rate measuring means is compared with the specified second rate limit setting value. When the transmission traffic rate addressed to the attacking host is larger than the second rate limit setting value, the received traffic rate of the received packet is set to the designated second rate limit with respect to the packet addressed to the attacked host received by the packet receiving means. It further comprises overall traffic policing means for discarding packets that exceed the set value and transmitting the packet to the attacked host at a transmission traffic rate that does not exceed the second rate limit set value.

  Packets addressed to the attacked host are classified based on the value of the specified traffic identification parameter, and even if it cannot be determined as an attack in the classified packet flow unit, addressing to the attacked host while reducing the processing load of the flood attack defense device Packets received from a number of attacking hosts that are sending packets to can be discarded.

  In any of the first to fourth aspects of the present invention, the received line information, the source IP address and subnet mask, the protocol number, the source port number, the destination port number, Type of Service, and Total Length are used as the traffic identification parameters. , Any of Time to Live and combinations thereof can be used.

  The present invention has the following effects.

  The inventions of claims 1 and 6 classify a packet addressed to an attacked host based on a traffic identification parameter such as a receiving line, and perform traffic policing using the same rate limit setting value for each classified packet flow. While discarding a large amount of packets received from the attacking host that is sending packets to the attacked host at a high traffic rate, packets received from legitimate hosts that are sending packets to the attacking host at a low traffic rate The packet can be transmitted to the attacked host without discarding much.

  According to the second and seventh aspects of the present invention, packets addressed to the attacked host are classified based on traffic identification parameters such as a receiving line, and a packet flow having a traffic identification parameter value determined as an attack among the classified packet flows. Only when the traffic policing is performed using the same rate limit setting value for each classified packet flow, when the number of types that the traffic identification parameter value can take is large, the flood attack protection device process The load can be reduced.

  According to the third and eighth aspects of the present invention, packets addressed to the attacked host are classified based on traffic identification parameters such as a receiving line, and the number of traffic identification parameter values determined as attacks is large in the classified packet flow. Even in this case, it is possible to discard traffic received from a large number of attacking hosts that are sending packets to the attacked host at a high traffic rate while keeping the processing load of the flood attack protection apparatus small.

  The inventions of claims 4 and 9 classify packets addressed to the host under attack based on traffic identification parameters such as receiving lines, and reduce the processing load of the flood attack defense device even when it cannot be determined as an attack for each classified packet flow. While being kept small, traffic received from a large number of attacking hosts that are sending packets to the attacked host at a high traffic rate can be discarded.

  According to the first to tenth aspects of the present invention, packets addressed to the attacked host are classified based on the received line information, and the same rate limit setting value is set for each packet flow with respect to the packet flows classified for each value of the received line information. When traffic policing is used, even if there is a possibility that the source address of a packet may be spoofed as in an IP network, it is possible to specify the attack source.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a configuration diagram of a flood attack defense apparatus according to a first embodiment of the present invention.

  Referring to FIG. 1, the flood attack protection apparatus 1A is installed on a network 10 that connects an attacked host 11 and attack hosts 12, 13, and 14.

  The flood attack protection apparatus 1A includes a communication port 2, a packet transmitting / receiving unit 3, a traffic policing unit 4 for each traffic identification parameter value, a transmission traffic amount measuring unit 5, a rate limit set value updating unit 6, and a traffic identification parameter registration. The table 7 includes a rate limit set value A registration table 8 and a rate limit set value B registration table 9.

  The communication port 2 receives the packet addressed to the attacked host 11 and transfers the packet to the packet transmitting / receiving unit 3. The communication port 2 transmits the packet received from the packet transmitting / receiving unit 3 to the network 10. Note that the communication port for reception and the communication port for transmission may be configured independently. Further, in any case of reception, transmission, and transmission / reception, the communication port may be composed of a plurality of communication ports.

  The packet transmitting / receiving unit 3 transfers the packet received from the communication port 2 to the traffic policing unit 4 for each traffic identification parameter value, transfers the packet received from the traffic policing unit 4 for each traffic identification parameter value to the communication port 2, and Is transferred to the transmission traffic amount measuring unit 5.

  The traffic policing unit 4 for each traffic identification parameter value classifies the packet received from the packet transmitting / receiving unit 3 based on the value of the traffic identification parameter registered in the traffic identification parameter registration table 7, and for each classified packet flow. Then, traffic policing is performed using the rate limit setting value A registered in the rate limit setting value A registration table 8, and packets that are not discarded by the traffic policing are transferred to the packet transmitting / receiving unit 3.

  The transmission traffic amount measurement unit 5 periodically measures the transmission traffic amount per unit time addressed to the attacked host 11 based on the packet received from the packet transmission / reception unit 3, and notifies the rate limit setting value update unit 6 of the measurement result as needed. To do. Note that the transmission traffic amount measurement unit 5 may perform the packet transmission process in the packet transmission / reception unit 3 without receiving a copy of the packet from the packet transmission / reception unit 3.

  The rate limit set value update unit 6 registers the rate of transmission traffic per unit time addressed to the attacked host 11 notified from the transmission traffic amount measurement unit 5 in the rate limit set value B registration table 9. If the amount of traffic transmitted per unit time addressed to the attacked host 11 is greater than the rate limit setting value B compared to B, the value of the rate limit setting value A registered in the rate limit setting value A registration table 8 is Update to a value smaller than the current value.

  FIG. 2 is a flowchart showing an example of a flood attack defense processing procedure in the flood attack defense apparatus 1A of FIG.

  The traffic identification parameter, the rate limit setting value A, and the rate limit setting value B are set in the traffic identification parameter table 7, the rate limit setting value A registration table 8, and the rate limit setting value B registration table 9, respectively (step 101). The traffic policing unit 4 for each traffic identification parameter value performs the traffic policing process (step 102), and the transmission traffic amount measuring unit 5 and the rate limit set value update unit 6 cooperate to rate limit set value update process (steps 103 to 105). Execute.

  In the traffic policing process, received packets addressed to the attacked host are classified based on the value of the traffic identification parameter, and the traffic policing is executed for each classified packet flow using the rate limit setting value A (step 102). Step 102 is repeated. In the rate limit set value update processing, the amount of transmission traffic per unit time addressed to the attacked host is measured (step 103), and it is determined whether the amount of transmission traffic per unit time addressed to the attacked host is greater than the rate limit set value B ( Step 104) If there is more, the value of the rate limit set value A is updated to a value smaller than the current value (Step 105). If the amount of traffic transmitted to the attacked host is not greater than the rate limit set value B at step 104, and after the processing at step 105 is completed, the processing returns to step 103 and repeats the processing at steps 103 to 105.

[Second Embodiment]
FIG. 3 shows a block diagram of a flood attack defense apparatus according to the second embodiment of the present invention.

  Referring to FIG. 3, the flood attack protection device 1 </ b> B is installed on the network 10 that connects the attacked host 11 and the attacking hosts 12, 13, and 14.

  The flood attack protection apparatus 1B includes a communication port 2, a packet transmitting / receiving unit 3, a traffic policing unit 4 for each traffic identification parameter value, a transmission traffic amount measuring unit 5, a rate limit set value updating unit 6, and a traffic identification parameter registration. Table 7, rate limit set value A registration table 8, rate limit set value B registration table 9, received traffic amount measurement unit 15 for each traffic identification parameter value, attack traffic identification parameter value detection unit 16, and attack determination threshold It consists of a registration table 17.

  The communication port 2 receives the packet addressed to the attacked host 11 and transfers the packet to the packet transmitting / receiving unit 3. The communication port 2 transmits the packet received from the packet transmitting / receiving unit 3 to the network 10. Note that the communication port for reception and the communication port for transmission may be configured independently. Further, in any case of reception, transmission, and transmission / reception, the communication port may be composed of a plurality of communication ports.

  The packet transmitting / receiving unit 3 transfers the packet received from the communication port 2 to the traffic policing unit 4 for each traffic identification parameter value, and transfers a copy of the packet to the received traffic amount measuring unit 15 for each traffic identification parameter value. Further, the packet transmitting / receiving unit 3 transfers the packet received from the traffic policing unit 4 for each traffic identification parameter value to the communication port 2 and transfers a copy of the packet to the transmission traffic amount measuring unit 5.

  The received traffic amount measuring unit 15 for each traffic identification parameter value classifies the packet received from the packet transmitting / receiving unit 3 based on the value of the traffic identification parameter registered in the traffic identification parameter registration table 7, and the classified packet flow Every time, the received traffic volume per unit time addressed to the attacked host 11 is periodically measured, and the measurement result is notified to the attack traffic identification parameter value detection unit 16 as needed. Note that the received traffic amount measuring unit 15 for each traffic identification parameter value may not be received from the packet transmitting / receiving unit 3 but may be integrated with the packet receiving process in the packet transmitting / receiving unit 3.

  The attack traffic identification parameter value detection unit 16 registers the received traffic amount per unit time addressed to the attacked host 11 notified from the received traffic amount measurement unit 15 for each traffic identification parameter value in the attack determination threshold registration table 17. Compared with the attack determination threshold value, all traffic identification parameter values for which the received traffic amount per unit time addressed to the attacked host 11 is larger than the attack determination threshold value are obtained, and the result is notified to the traffic policing unit 4 for each traffic identification parameter value. To do.

  The traffic policing unit 4 for each traffic identification parameter value responds to a packet flow that matches one of the traffic identification parameter values notified from the attack traffic identification parameter value detection unit 16 among the packets received from the packet transmitting / receiving unit 3. Only based on the value of the rate limit setting value A registered in the rate limit setting value A registration table 8 for each packet flow classified by the value of the traffic identification parameter registered in the traffic identification parameter registration table 7. Then, the traffic policing is performed, and the packet that is not discarded by the traffic policing is transferred to the packet transmitting / receiving unit 3.

  The transmission traffic amount measurement unit 5 periodically measures the transmission traffic amount per unit time addressed to the attacked host 11 based on the packet received from the packet transmission / reception unit 3, and notifies the rate limit setting value update unit 6 of the measurement result as needed. To do. Note that the transmission traffic amount measurement unit 5 may perform the packet transmission process in the packet transmission / reception unit 3 without receiving a copy of the packet from the packet transmission / reception unit 3.

  The rate limit set value update unit 6 registers the rate of transmission traffic per unit time addressed to the attacked host 11 notified from the transmission traffic amount measurement unit 5 in the rate limit set value B registration table 9. If the amount of traffic transmitted per unit time addressed to the attacked host 11 is larger than the rate limit setting value B as compared with B, the rate limit setting value A registered in the rate limit setting value A registration table 8 is Update to a value smaller than the value of.

  FIG. 4 is a flowchart showing an example of a flood attack defense processing procedure in the flood attack defense apparatus 1B of FIG.

  A traffic identification parameter, an attack determination threshold, a rate limit setting value A, and a rate limit setting value B are set in the traffic identification parameter registration table 7, the rate limit setting value A registration table 8, and the rate limit setting value B registration table 9, respectively (step 201) In parallel, the traffic policing unit 4 for each traffic identification parameter value performs the traffic policing process (steps 202 to 204), and the transmission traffic amount measuring unit 5 and the rate limit set value update unit 6 cooperate to update the rate limit set value. Processing (steps 205 to 207) is executed.

  In the traffic policing process, the received packets addressed to the attacked host are classified based on the value of the traffic identification parameter, and the received traffic amount per unit time addressed to the attacked host is measured for each classified packet flow (step 202). The value of the traffic identification parameter in which the received traffic volume per unit time of the packet flow addressed to the attacked host classified based on the identification parameter value is compared with the attack determination threshold value, and the received traffic volume per unit time is larger than the attack determination threshold value. (Step 203), and only for the packet flow that matches one of the traffic identification parameter values obtained in step 203, the rate limit set value A for each packet flow classified by the traffic identification parameter value. Based on Trahi Run the click policing (step 204), returns to step 202 to repeat the processes of steps 202 to 204.

  In the rate limit set value update processing, the amount of transmission traffic per unit time addressed to the host under attack is measured (step 205), and it is determined whether the amount of traffic transmitted per unit time destined for the host under attack is greater than the rate limit set value B. (Step 206) If it is greater, the rate limit set value A is updated to a value smaller than the current value (Step 207). If the amount of traffic transmitted to the attacked host is not greater than the rate limit set value B in step 206, and after the process of step 207 is completed, the process returns to step 205, and the processes of steps 205 to 207 are repeated.

[Third Embodiment]
FIG. 5 is a configuration diagram of a flood attack defense apparatus according to the third embodiment of the present invention.

  Referring to FIG. 5, the flood attack protection device 1 </ b> C is installed on the network 10 that connects the attacked host 11 and the attack hosts 12, 13, and 14.

  The flood attack protection apparatus 1C includes a communication port 2, a packet transmitting / receiving unit 3, a traffic policing unit 4 for each traffic identification parameter value, a transmission traffic amount measuring unit 5, a rate limit set value updating unit 6, and a traffic identification parameter registration. Table 7, rate limit set value A registration table 8, rate limit set value B registration table 9, received traffic amount measurement unit 15 for each traffic identification parameter value, attack traffic identification parameter value detection unit 16, and attack determination threshold The registration table 17 includes an attack flow number upper limit determination traffic policing switching unit 18, an overall traffic policing unit 19, and an attack flow number upper limit determination threshold registration table 20.

  A functional difference between the flood attack defense apparatus 2C of the present embodiment and the flood attack defense apparatus 2B of the second embodiment of the present invention shown in FIG. 3 will be described.

  The packet transmitting / receiving unit 3 transfers the packet received from the communication port 2 to the attack flow number upper limit determination traffic policing switching unit 18 and transfers a copy of the packet to the received traffic amount measuring unit 15 for each traffic identification parameter value. The packet transmitting / receiving unit 3 transfers the packet received from the attack flow number upper limit determination traffic policing switching unit 18 to the communication port 2 and transfers a copy of the packet to the transmission traffic amount measuring unit 5.

  The attack traffic identification parameter value detection unit 16 registers the received traffic amount per unit time addressed to the attacked host 11 notified from the received traffic amount measurement unit 15 for each traffic identification parameter value in the attack determination threshold registration table 17. Compared with the attack determination threshold value, all traffic identification parameter values for which the received traffic amount per unit time addressed to the attacked host 11 is larger than the attack determination threshold value are obtained, and the results are obtained by the traffic policing unit 4 for each traffic identification parameter value and the attack. The flow number upper limit determination traffic policing switching unit 18 is notified.

  The attack flow number upper limit determination traffic policing switching unit 18 uses the number of traffic identification parameter values notified from the attack traffic identification parameter value detection unit 16 as the attack flow registered in the attack flow number upper limit determination threshold registration table 20. If the number of traffic identification parameter values exceeds the attack flow number upper limit determination threshold value compared with the number upper limit determination threshold value, the packet received from the packet transmitting / receiving unit 3 is forwarded to the overall traffic policing unit 19, The packet received from the traffic policing unit 19 is transferred to the packet transmitting / receiving unit 3. When the number of the traffic identification parameters does not exceed the same threshold value for determining the attack flow number upper limit, the packet received from the packet transmitting / receiving unit 3 is forwarded to the traffic policing unit 4 for each traffic identification parameter value, and the traffic identification parameter value The packet received from the traffic policing unit 4 is transferred to the packet transmitting / receiving unit 3.

  The overall traffic policing unit 19 performs traffic policing on the packet received from the attack flow number upper limit determination traffic policing switching unit 18 based on the value of the rate limit setting value B registered in the rate limit setting value B registration table 9. Then, the packet that is not discarded by the traffic policing is transferred to the attack flow number upper limit determination traffic policing switching unit 18.

  The traffic policing unit 4 for each traffic identification parameter value receives one of the traffic identification parameter values notified from the attack traffic identification parameter value detection unit 16 among the packets received from the attack flow number upper limit determination traffic policing switching unit 18. Only for matching packet flows, the rate limit setting registered in the rate limit setting value A registration table 8 for each packet flow classified according to the value of the traffic identification parameter registered in the traffic identification parameter registration table 7 Based on the value A, traffic policing is performed, and packets that are not discarded by the traffic policing are transferred to the attack flow number upper limit determination traffic policing switching unit 18.

  FIG. 6 is a flowchart showing an example of a flood attack defense processing procedure by the flood attack defense apparatus 1C of FIG. Here, differences from the flowchart shown in FIG. 4 showing an example of the flood attack defense processing procedure of the second embodiment of the present invention will be described.

  Between step 203 and step 204, the attack flow number upper limit determination traffic policing switching unit 18 determines whether or not the number of types of traffic identification parameter values obtained in step 203 is greater than the attack flow number upper limit determination threshold. If yes, traffic policing is executed on the received packet addressed to the host under attack based on the rate limit setting value B (step 209). If it is determined in step 208 that the number of types of the traffic identification parameters is not greater than the attack flow number upper limit determination threshold value, the process of step 204 is performed. After the completion of step 204 and step 209, the process returns to step 202, and the processes of steps 202 to 204 and 208 to 209 are repeated.

[Fourth Embodiment]
FIG. 7 is a configuration diagram of a flood attack defense apparatus according to the fourth embodiment of the present invention.

  Referring to FIG. 7, the flood attack protection apparatus 1D is installed on the network 10 that connects the attacked host 11 and the attack hosts 12, 13, and 14.

  The flood attack prevention apparatus 1D includes a communication port 2, a packet transmitting / receiving unit 3, a traffic policing unit 4 for each traffic identification parameter value, a transmission traffic amount measuring unit 5, a rate limit set value updating unit 6, and a traffic identification parameter registration. Table 7, rate limit set value A registration table 8, rate limit set value B registration table 9, received traffic amount measurement unit 15 for each traffic identification parameter value, attack traffic identification parameter value detection unit 16, and attack determination threshold The registration table 17 includes a rate limit set value update determination traffic policing switching unit 21 and an overall traffic policing unit 19.

  A functional difference between the flood attack defense apparatus 1D of the present embodiment and the flood attack defense apparatus 1B of the second embodiment of the present invention shown in FIG. 3 will be described.

  The packet transmitting / receiving unit 3 transfers the packet received from the communication port 2 to the rate limit set value update determination traffic policing switching unit 21 and transfers a copy of the packet to the received traffic amount measuring unit 15 for each traffic identification parameter value. Further, the packet transmitting / receiving unit 3 transfers the packet received from the rate limit set value update determination traffic policing switching unit 21 to the communication port 2 and transfers a copy of the packet to the transmission traffic amount measuring unit 5.

  The rate limit set value update unit 6 registers the rate of transmission traffic per unit time addressed to the attacked host 11 notified from the transmission traffic amount measurement unit 5 in the rate limit set value B registration table 9. If the amount of traffic transmitted per unit time addressed to the attacked host 11 is greater than the rate limit setting value B as compared with B, the rate limit setting value A registered in the rate limit setting value A registration table 8 is changed to the current value. Update to a smaller value.

  When the rate limit set value A is set to 0 and the amount of traffic transmitted per unit time to the attacked host 11 is larger than the rate limit set value B, the entire rate limit set value update determination traffic policing switching unit 21 is Instruct to switch to traffic policing.

  The attack flow number upper limit determination traffic policing switching unit 1G transfers the packet received from the packet transmitting / receiving unit 3 to the general traffic policing unit 19 when receiving an instruction to switch to the total traffic policing from the rate limit setting value updating unit 6. Then, the packet received from the overall traffic policing unit 19 is transferred to the packet transmitting / receiving unit 3. When the switching instruction to the total traffic policing is not received from the rate limit set value updating unit 6, the packet received from the packet transmitting / receiving unit 3 is transferred to the traffic policing unit 4 for each traffic identification parameter value, and for each traffic identification parameter value The packet received from the traffic policing unit 4 is transferred to the packet transmitting / receiving unit 3.

  The overall traffic policing unit 19 performs traffic policing on the packet received from the rate limit set value update determination traffic policing switching unit 21 based on the rate limit set value B registered in the rate limit set value B registration table 9. Then, the packet that has not been discarded due to the traffic policing is transferred to the rate limit set value update determination traffic policing switching unit 21.

  The traffic policing unit 4 for each traffic identification parameter value is one of the values of the traffic identification parameter received from the attack traffic identification parameter value detection unit 16 among the packets received from the rate limit setting value update determination traffic policing switching unit 21. Rate limit registered in the rate limit setting value A registration table 8 for each packet flow classified by the traffic identification parameter value registered in the traffic identification parameter registration table 7 only for packet flows that match Based on the set value A, traffic policing is performed, and packets that are not discarded by the traffic policing are transferred to the rate limit set value update determination traffic policing switching unit 21.

  FIG. 8 is a flowchart showing an example of a flood attack defense processing procedure by the flood attack defense apparatus 1D of FIG. Here, differences from the flowchart shown in FIG. 4 showing an example of the flood attack defense processing procedure of the second embodiment of the present invention will be described.

  Immediately after step 201, the traffic policing switching determination flag is set to OFF (step 210). In step 206, if the amount of transmission traffic addressed to the host under attack is larger than the rate limit set value B, it is determined whether the rate limit set value A is 0 (step 211). If the rate limit set value A is 0, A traffic policing switching determination flag is set to ON (step 213). If the rate limit set value A is not 0 in step 211, the rate limit set value A is updated to a value smaller than the current value (step 207).

  If the amount of traffic transmitted per unit time addressed to the host under attack is not greater than the rate limit setting value B in step 206, the traffic policing switching determination flag is set to OFF (step 212), and after the processing in steps 207, 212, and 213 is completed. Returning to step 205, the processes of steps 205-207 and 211-213 are repeated.

  It is determined between step 203 and step 204 whether or not the traffic policing switching determination flag is ON (step 214). If ON, based on the rate limit setting value B for the received packet addressed to the attacked host. Then, traffic policing is executed (step 215). If the traffic policing switching determination flag is off in step 214, the processing in step 204 is performed. After completion of step 204 and step 215, the process returns to step 202, and the processes of steps 202 to 204 and 214 to 215 are repeated.

  In any of the first to fourth embodiments of the present invention described above, as the traffic identification parameter, received line information, source IP address and subnet mask, protocol number, source port number, destination port number, Any of Type of Service, Total Length, Time to Live and combinations thereof may be used.

  In addition to the functions of the flood attack defense apparatus described above, which are realized by dedicated hardware, a program for realizing the functions is recorded on a computer-readable recording medium, and the recording medium is recorded on the recording medium. The recorded program may be read into a computer system and executed. The computer-readable recording medium refers to a recording medium such as a flexible disk, a magneto-optical disk, a CD-ROM, or a hard disk device built in a computer system. Furthermore, a computer-readable recording medium is a server that dynamically holds a program (transmission medium or transmission wave) for a short time, such as when transmitting a program via the Internet, and a server in that case. Some of them hold programs for a certain period of time, such as volatile memory inside computer systems.

It is a figure which shows the structural example of the flood attack defense apparatus by the 1st Embodiment of this invention. It is a flowchart which shows an example of the flood attack defense process sequence by the flood attack defense apparatus of 1st Embodiment. It is a figure which shows the structural example of the flood attack defense apparatus of the 2nd Embodiment of this invention. It is a flowchart which shows an example of the flood attack defense process sequence by the flood attack defense apparatus by 2nd Embodiment. It is a figure which shows the structural example of the flood attack defense apparatus by the 3rd Embodiment of this invention. It is a flowchart which shows an example of the flood attack defense process procedure by 3rd Embodiment. It is a figure which shows the structural example of the flood attack defense apparatus by the 4th Embodiment of this invention. It is a flowchart which shows an example of the flood attack defense process sequence by the flood attack defense apparatus of 4th Embodiment.

Explanation of symbols

1A, 1B, 1C, 1D Flood attack defense device 2 Communication port 3 Packet transmission / reception unit 4 Traffic policing unit for each traffic identification parameter value 5 Transmission traffic amount measurement unit 6 Rate limit set value update unit 7 Traffic identification parameter registration table 8 Rate limit setting Value A registration table 9 Rate limit setting value B registration table 10 Network 11 Attacked host 12-14 Attack host 15 Traffic identification parameter value received traffic amount measurement unit 16 Attack traffic identification parameter value detection unit 17 Attack determination threshold value registration table 18 Attack Flow number upper limit determination traffic policing switching unit 19 Overall traffic policing unit 20 Attack flow number upper limit determination threshold registration table 21 Rate limit set value update determination traffic policing switching unit 1 1～105,201～215 step

Claims (10)

A method for preventing a flood attack on a device connected to a communication network,
(A) The packet addressed to the attacked host is classified based on the value of the designated traffic identification parameter, and the received traffic rate of the received packet flow is designated as the designated first rate limit setting value for each classified packet flow. A packet that exceeds the first rate limit is transmitted for each classified packet flow at a transmission traffic rate that does not exceed the first rate limit setting value; and
(B) measuring a total transmission traffic rate of packets addressed to the attacked host transmitted in the step (a);
(C) The total transmission traffic rate addressed to the attacked host measured in the step (b) is compared with a designated second rate limit setting value, and the total transmission traffic rate addressed to the attacked host is determined as the second transmission rate. A flood attack defense method comprising: updating the first rate limit setting value to a value smaller than a current value when the rate limit setting value is larger than the current rate limit setting value. A method for preventing a flood attack on a device connected to a communication network,
(A) classifying a packet addressed to an attacked host based on a value of a designated traffic identification parameter, and measuring a received traffic rate of a received packet for each classified packet flow;
(B) The received traffic rate measured in the step (a) is compared with the designated attack determination threshold value for each value of the designated traffic identification parameter, and as a result, the received traffic rate is greater than the attack decision threshold value. Determining all values of traffic identification parameters to be increased;
(C) For each packet flow addressed to the attacked host that matches one of the traffic identification parameter values obtained in the step (b), the received traffic rate of the received packet flow is set to the designated first rate limit setting. Packets that exceed the value are discarded, and packets are sent to the attacked host at a transmission traffic rate that does not exceed the first rate limit setting value for each packet flow. Sends all received packets, and
(D) measuring a total transmission traffic rate of packets addressed to the attacked host transmitted in the step (c);
(E) The total transmission traffic rate measured in the step (d) is compared with a specified second rate limit setting value, and the total transmission traffic rate addressed to the attacked host is set to the second rate limit setting value. If larger, the flood rate protection method comprising: updating the first rate limit setting value to a value smaller than a current value. A method for preventing a flood attack on a device connected to a communication network,
(A) classifying a packet addressed to an attacked host based on a value of a designated traffic identification parameter, and measuring a received traffic rate of a received packet for each classified packet flow;
(B) The received traffic rate measured in the step (a) is compared with the designated attack determination threshold value for each value of the designated traffic identification parameter, and as a result, the received traffic rate is greater than the attack decision threshold value. Determining all values of traffic identification parameters to be increased;
(C) comparing the number of types of traffic identification parameter values obtained in step (b) with a specified attack flow number upper limit determination threshold;
(D) As a result of the comparison in the step (c), when the number of types of values of the traffic identification parameter is smaller than the attack flow number upper limit determination threshold,
(D1) For each packet flow destined for the attacked host that matches one of the traffic identification parameter values obtained in step (b), the received traffic rate of the received packet flow is designated as a first rate limit setting. Packets that exceed the value are discarded, and packets are sent to the attacked host at a transmission traffic rate that does not exceed the first rate limit setting value for each packet flow. Sends all received packets,
(D2) Measure the total transmission traffic rate of the packets addressed to the attacked host transmitted in the step (d1),
(D3) The total transmission traffic rate measured in the step (d2) is compared with the designated second rate limit setting value, and the total transmission traffic rate addressed to the attacked host is compared with the second rate limit setting value. If larger, update the first rate limit setting value to a value smaller than the current value;
Performing the steps (d1 to d3) in order,
(E) As a result of the comparison in step (c), when the number of types of the traffic identification parameter value is larger than the attack flow number upper limit determination threshold, reception of received packets among the received packets addressed to the attacked host Discarding packets whose traffic rate exceeds the second rate limit setting value, and transmitting the packet to the attacked host at a transmission traffic rate not exceeding the second rate limit setting value; A flood attack defense method comprising:   When the value of the first rate limit setting value is 0, the transmission traffic rate addressed to the attacked host is compared with the second rate limit setting value, and the transmission traffic rate addressed to the attacked host is If the rate limit setting value is greater than 2, the received packet destined for the attacked host discards the packet whose received traffic rate exceeds the second rate limit setting value, The flood attack prevention method according to claim 2, further comprising a step of transmitting a packet to an attacked host at a transmission traffic rate not exceeding a rate limit set value of 2.   The traffic identification parameter is any one of a received line information, a source IP address and a subnet mask, a protocol number, a source port number, a destination port number, a Type of Service, a Total Length, a Time to Live, and a combination thereof. The flood attack protection method according to claim 1. A device that prevents a flood attack on a device connected to a communication network,
A packet receiving means for receiving a packet addressed to the attacked host;
The packet addressed to the host under attack received by the packet receiving means is classified based on the value of the designated traffic identification parameter, and the received traffic rate of the received packet flow is designated for each classified packet flow. Packets that exceed the rate limit setting value of 1 are discarded, and packets are sent to the attacked host at a transmission traffic rate that does not exceed the first rate limit setting value for each classified packet flow. Individual traffic policing means;
Transmission traffic rate measuring means for measuring the total transmission traffic rate of packets addressed to the attacked host transmitted by the individual traffic policing means;
When the total transmission traffic rate measured by the transmission traffic rate measuring means is compared with the designated second rate limit setting value, and the transmission traffic rate addressed to the attacked host is larger than the second rate limit setting value A flood attack defense apparatus comprising: rate limit setting value updating means for updating the first rate limit setting value to a value smaller than a current value. A device that prevents a flood attack on a device connected to a communication network,
A packet receiving means for receiving a packet addressed to the attacked host;
Received traffic rate measurement for classifying packets addressed to the attacked host received by the packet receiving means based on the value of a designated traffic identification parameter and measuring the received traffic rate of the received packet for each classified packet flow Means,
The received traffic rate measured by the received traffic rate measuring means is compared with a specified attack determination threshold value for each value of the traffic identification parameter, and as a result, the traffic identification in which the received traffic rate is greater than the attack determination threshold value. Attack traffic identification parameter value detection means for obtaining all parameter values;
For each packet flow addressed to the attacked host that matches one of the traffic identification parameter values obtained by the attack traffic identification parameter value detecting means, the received traffic rate of the received packet flow is designated as a first rate limit setting. Packets that exceed the value are discarded, and packets are sent to the attacked host at a transmission traffic rate that does not exceed the first rate limit setting value for each packet flow. Is an individual traffic policing means for transmitting all received packets, and
Transmission traffic rate measuring means for measuring the total transmission traffic rate of packets addressed to the attacked host transmitted by the individual limited traffic policing means;
The total transmission traffic rate addressed to the attacked host measured by the transmission traffic rate measuring means is compared with a designated second rate limit setting value, and the transmission traffic rate addressed to the attacked host is set to the second rate limit setting. If greater than the value, rate limit setting value updating means for updating the value of the first rate limit setting value to a value smaller than the current value;
A flood attack defense device having: For packets destined for the attacked host received by the packet receiving means, discard packets for which the received traffic rate of the received packet exceeds the specified second rate limit setting value, An overall traffic policing means for transmitting packets to an attacked host at a transmission traffic rate not exceeding the rate limit setting value of
Attack flow number upper limit determination means for comparing the number of types of traffic identification parameter values obtained by the attack traffic identification parameter value detection means with a specified attack flow number upper limit determination threshold;
When the number of types of the traffic identification parameter value is larger than the attack flow number upper limit determination threshold, traffic policing is performed by the overall traffic policing means, and the number of type of the traffic identification parameter value is the attack flow. The flood attack protection apparatus according to claim 7, further comprising: a traffic policing switching unit that performs traffic policing by the individual limited traffic policing unit when the number upper limit determination threshold is smaller.   When the value of the first rate limit setting value is set to 0, the transmission traffic rate addressed to the attacked host measured by the transmission traffic rate measuring unit is compared with the designated second rate limit setting value; When the transmission traffic rate addressed to the attacked host is larger than the second rate limit setting value, the received traffic rate of the received packet is set to the designated second traffic rate for the packet addressed to the attacked host received by the packet receiving means. A total traffic policing unit that discards packets that exceed the rate limit setting value and transmits the packet to the host under attack at a transmission traffic rate that does not exceed the second rate limit setting value. Item 8. The flood attack defense device according to Item 7.   The traffic identification parameter is any one of a received line information, a source IP address and a subnet mask, a protocol number, a source port number, a destination port number, a Type of Service, a Total Length, a Time to Live, and a combination thereof. The flood attack defense device according to any one of claims 6 to 9.

Images