JP5147819B2 - Application layer protection method and apparatus for computer network system - Google Patents

Description

  The present invention relates to a technology for dealing with a distributed denial of service (DDoS) attack that attacks an application layer of a computer network system, and in particular, a distributed service that prevents a computer network system from providing a normal service. The present invention relates to a method and apparatus for protecting an application layer of a computer network system that detects and blocks a jamming attack.

  In recent years, with the development of networks, electronic technologies, etc., various services such as the web have been easily provided, but with the development of technologies, the services provided by computer network systems due to the appearance of various hacking tools. Interfering and hacking are becoming more frequent.

  In addition, hacking of such computer network systems has changed into various attack forms for obtaining financial benefits, and in particular, distributed denial of service (DDoS) attacks do not provide normal services via the web or the like. It is an attack that makes it possible, and there is a tendency to increase the intensity by exploiting a botnet that is a network group such as a zombie PC.

  Although some detection and response techniques have been developed to deal with such distributed denial of service attacks, most of the response techniques for distributed denial of service attacks are network level SYN flooding (SYN). (Synchronize Sequence Number) flooding) is limited to a method of blocking and blocking, and a method of detecting and responding to a distributed service denial attack that interferes with an application layer service such as a web server is a rate limit (rate limit). As described above, most of the attack mitigation techniques reduce the packets input to the web server, and there is no technique for searching for the distributed denial-of-service attack packet in the application layer and the source IP.

  Currently, in order to detect and respond to application layer distributed denial-of-service attacks, technologies such as transmission rate limitation are utilized, so that the mitigated attack packets are transmitted to the server as they are and a false negative (false) is generated. The risk of generating a negative phenomenon and a false positive in which a packet of a user who has requested a service normally is blocked.

U.S. Patent Publication No. 2008-0271146

  Accordingly, the present invention has been made in view of the above circumstances, and its purpose is to accurately detect a distributed denial of service (DDoS) attack that interferes with application layer services such as web services in a computer network system. An object of the present invention is to provide an application layer protection method and apparatus for a computer network system that can be protected.

  According to one aspect of the present invention, there is provided a method for protecting an application layer of a computer network system, in which a session between a client and a data providing server is performed via a network in response to a session connection request from a client. And if a session termination request is generated from the client before the response packet is transmitted from the data providing server to the client according to a data request from the client to the data providing server, the client is attacked by an application layer attack. And detecting as a client.

  According to another aspect of the present invention, an apparatus for protecting an application layer of a computer network system sets up a session with the client via a network according to a session connection request from the client, and responds to the data request of the client. A data providing server configured to transmit a data packet to the client via the network; and a session between the client and the data providing server established via the network in response to the data request. On the other hand, before a response packet is transmitted from the data providing server to the client, if a session termination request is generated from the client, the client is detected as an application layer attack client. Characterized in that it includes the application layer protection service server.

  According to the present invention, a direct detection and response to an IP or packet that has generated a fin (FIN) packet immediately after the occurrence of a get (GET) packet that is an attacker characteristic clearly distinguished from a normal service request. Therefore, it is possible to search for a distributed service denial attacker and cope with it without generating a false alarm. Conventionally, many resources are required to perform the transmission rate limiting function. However, in the present invention, it is possible to directly search for and respond to an attacker that generates a distributed service disruption packet in the application layer, so resources are saved. Furthermore, in the present invention, after the client connection termination request, an attacker can be searched for by the presence or absence of an ACK packet that is a client response to the service response. In addition, it is confirmed whether a fin (FIN) follows a get (GET) packet. When corresponding to each packet, normal user and zombie PC traffic are mixed in a network using NAT (Network Address Translation). Cases can also be handled.

1 is a block configuration diagram of a computer network system to which an embodiment of the present invention is applied. It is a figure which shows the process in which the web service between the client and data provision server in an application layer is performed. It is a figure which shows the operation | movement of a distributed service denial-of-service attack. 3 is a flowchart illustrating an application layer protection method of a computer network system according to an exemplary embodiment of the present invention.

  The present invention presents a method for detecting and responding to distributed denial of service (DDoS) attacks on the application layer of computer network systems. In order to describe in detail a detection and response method for such an application layer attack, a web service that is a typical application service will be described as an example.

  In order to create a TCP / IP (Transmission Control Protocol / Internet Protocol) communication program on the host, a socket is used. The socket is a kind of API (Application Programming Interface) that connects the TCP / IP layer and the application layer. Some OSs (Operating Systems) do not allow connection in a network layer without using sockets due to security problems, and so most communication programs use sockets.

  Among such communication programs via sockets, in the case of a program using TCP, after forming a session, data communication in the application layer is possible, and the session is terminated after the data communication is completed. Communication takes place in the process.

  In the present invention, in a state in which a session between a client (client) and a server (server) is connected, data is requested from the client to the server, and the session ends within an already set time (or immediately after the data is requested). Or when the client socket has already terminated the session between the client and the server, the client sends a confirmation packet (ACKnowledgement packet) to the server in response to the response packet transmitted by the server to the client. In the case where no “ACK packet” is generated, the client is recognized as a distributed service denial attacker and the connection between the client and the server is blocked.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram of a computer network system to which an embodiment of the present invention can be applied. The computer network system includes a client 100, a communication network 102, an application layer protection service server 104, and a data providing server 106.

  As shown in FIG. 1, a client 100 is a user-side terminal connected to a network 102 and receiving application layer services or the like, such as a desktop (desk-top), a laptop (lap-top), or the like. Thus, a data providing service, an application layer service, and the like can be provided to the user via the communication network 102. Such a client 100 can include not only desktops and laptops, but also zombie PCs that interfere with application layer services. 1 shows one client 100, but this is for convenience of explanation, and it is normal in the technical field of the present invention that a large number of clients can be connected on the communication network. Anyone who has knowledge of this can easily understand.

  The communication network 102 means an open computer network structure such as wired / wireless Internet, and can provide a network connection environment to the client 100.

  The application layer protection service server 104 plays a role of detecting and defending against an attack mode that interrupts an application layer service such as a web service, for example, a DDoS attack. Such an application layer protection service server 104 can be realized, for example, in the form of a dedicated equipment for IDS (Internet Distribution System), IPS (Internet Provider Security), FW (Firewall), Web FW, or DDoS.

  The data providing server 106 is a TCP / IP protocol and various services existing in an upper layer thereof, that is, HTTP (Hyper Text Transfer Protocol), Telnet (FTP), File Transfer Protocol (FTP), and Domain Name System (DNS). , SMTP (Simple Mail Transfer Protocol), SNMP (Simple Network Management Protocol), NFS (Network File Service), and NIS (Network Information Service). The data providing server 106 serves as a web server or a content server that provides services such as data, for example, web pages and / or contents, to the client 100 through the communication network 102.

  In FIG. 1, the application layer protection service server 104 and the data providing server 106 are shown as separate servers. However, for convenience of explanation, this is shown as one embodiment only, and the application layer protection service server 104 and the data providing server 106 are shown. It should be noted that 106 can be integrated into a single server.

  The application layer protection service server 104 is a session following the data request from the client 100 (or immediately after the data request) in a state where the session between the data providing server 106 and the client 100 is set via the communication network 102. When the termination is requested, the client 100 is regarded as a client attacking the application layer (that is, a DDoS attacker), and a packet of data requested from the client 100 is blocked, so that HTTP GET flooding or cache control flooding ( The application layer can be protected from DDoS attacks such as Cache-Control (CC) flooding).

  The application layer protection service server 104 determines that the client 100 does not generate an ACK packet in response to the response packet of the application layer protection service server 104 because the session between the data providing server 106 and the client 100 has already ended. Is recognized as a client attacking the application layer (that is, a DDoS attacker), and the connection between the client 100 and the data providing server 106 is cut off, so that the application layer can be prevented from DDoS attacks such as HTTP GET flooding or CC flooding. Can protect. Such connection blocking of the application layer protection service server 104 can be realized, for example, by blocking the IP (Internet Protocol) of the client 100.

  FIG. 2 is a diagram illustrating a process of performing a network service in such an application layer, for example, a web service between the client 100 and the data providing server 106.

  First, the client 100 requests a session connection to the data providing server 106 for a service request (S200). Such a session connection request can be realized, for example, by transmitting a synchronization sequence number (SYN) packet (hereinafter, referred to as “SYN packet”) from the client 100 to the data providing server 106.

  At this time, if the resource of the data providing server 106 is allowed, the data providing server 106 responds to the session connection request of the client 100 (S202). Such a session connection request response can be realized, for example, by transmitting a (SYN + ACK) packet.

  The client 100 that has received the (SYN + ACK) packet transmits the ACK packet to the data providing server 106 again, so that the session between them can be connected (S204).

  As described above, in a state where the session between the client 100 and the data providing server 106 is connected, the client 100 can request the data providing server 106 for desired data, for example, a web page or content (S206). Such a data request can be realized, for example, by transmitting a GET packet from the client 100 to the data providing server 106.

  The data providing server 106 that has received the GET packet transmits the data requested by the client 100 to the client 100 in a packet form (S208).

  If the requested data is transmitted from the data providing server 106 to the client 100, the client 100 responds to reception of the packet data from the data providing server 106 (S210). Such a data reception response can be realized, for example, by transmitting an ACK packet from the client 100 to the data providing server 106.

  Thereafter, the data providing server 106 that has transmitted all the packets can request the client 100 to terminate the connection (S212). Such a connection termination request can be realized, for example, as a transmission of a termination packet (FINish Packet, hereinafter referred to as “FIN packet”) from the data providing server 106 to the client 100.

  At this time, when the keep alive value is turned off by the data providing server 106, the FIN packet can be transmitted to the client 100 immediately after the final data is transmitted or simultaneously with the final data. When the keep alive value is turned on by the data providing server 106, the FIN packet can be transmitted to the client 100 if the keep alive time of the data providing server 106 is exceeded.

  Thereafter, the client 100 transmits a FIN packet for requesting termination of the session to the data providing server 106 (S214), and a session between the client 100 and the data providing server 106 by a reset packet (ReSeT packet, hereinafter referred to as “RST packet”). Can end.

  FIG. 3 is a diagram illustrating traffic characteristics that may occur in a DDoS attack tool, eg, a netbot.

  First, the client 100 requests a session connection to the data providing server 106 for a service request (S300). Such a session connection request can be realized, for example, as a transmission of a SYN packet from the client 100 to the data providing server 106.

  At this time, if the resource of the data providing server 106 is allowed, the data providing server 106 can respond to the session connection request of the client 100 (S302). Such a session connection response can be realized, for example, as transmitting a (SYN + ACK) packet.

  The client 100 having received the (SYN + ACK) packet transmits the ACK packet to the data providing server 106 again, so that the session between them can be connected (S304).

  As described above, in a state where the session between the client 100 and the data providing server 106 is connected, the client 100 can request the data providing server 106 for desired data, for example, a web page (S306). Such a data request can be realized, for example, by transmitting a GET packet from the client 100 to the data providing server 106.

  The process described above is the same as the process of executing a service in the application layer of FIG.

  However, when attempting to attack the application layer, the client 100 can immediately generate a FIN packet and request the data providing server 106 to end the session (S308).

  Accordingly, when the client 100 requests session termination between the data service request process (S306) of the client 100 and the response packet transmission process (S310) of the data providing server 106, the data providing server 106 As a response to the received GET packet from the client 100, a response packet is generated and transmitted to the client 100 (S310), and then an RST packet is subsequently generated to end the session (S312).

  Such a process can be interpreted as follows.

  First, since a botnet is also created by a socket program, a session for which a service request has been completed must be terminated in order for many application layer service requests to occur. This is because if the session is not terminated, the socket resources of the client will be depleted and continuous packet generation is impossible.

  For example, if the client does not generate a FIN packet and generates new sessions continuously in the step of FIG. 3 (S308), further communication becomes impossible due to the exhaustion of client socket resources.

  Therefore, in order to continuously generate attack packets at the client, the session must be terminated. In addition, since the data sent from the server in the case of an attacker is not an object of interest, there is no need to receive them. As shown in FIG. 2, if the session is normally maintained, the attacker cannot generate a desired amount of sessions and packets, and in the situation where the server is attacked, the stage (S214) depends on the server load. An attacker can experience a situation in which a request to end a session is delayed and packets cannot be generated. However, since the purpose of the DDoS attacker is to prevent the server from providing the service, the session termination request must be made immediately as in the step (S308) of FIG.

  In the case of a web service, the HTTP 1.0 standard document is described as follows.

  “In an actual application, except for an experimental application program, prior to the transmission of each request message, a connection must first be established by the client, and the server must send a response first to disconnect. At this time, it is necessary to know that the client and the server may be disconnected in the middle due to user action, automatic time-out, or program error. In any case, disconnecting either or both always means deletion for the current request. "

The HTTP 1.0 standard document stipulates that terminating a session after the server completes data communication is a normal service termination, and abnormal session termination is defined as the following three.
1. 1. End by user action 2. Termination by automatic timeout Termination due to program error

  When the situation of FIG. 3 can occur and the situation of the error, the following conclusion can be obtained.

  First, as a result of actually confirming with the netbot and socket program, the time interval between the generation of the GET packet in step (S306) and the FIN packet in step (S308) is, for example, within several tens of microseconds (μsec), specifically 10 to 90 microseconds (μsec), which can be confirmed to be extremely short, and the reason why two packets are generated in such a short time is to generate a maximum number of attack packets. .

  At this time, it is considered that the above-described termination due to the user's operation is very low. If a user generates a GET packet as a web service request through a web browser and immediately generates a FIN packet, the web browser must be closed within several tens of microseconds (μsec). It is impossible for the user to close the web browser in this way.

  Second, in the case of termination due to automatic timeout, in general, the timeout is set to several seconds, for example, 2 to 5 seconds, which is a very large time compared to several tens of microseconds (μsec). It turns out that termination due to timeout is impossible in practice.

  Finally, in the case of termination due to a program error, this can be clearly analyzed as a client program error, so it is excluded from the assumption that abnormal session termination is specified.

  Therefore, in the present embodiment, as shown in FIG. 3, when the client 100 generates a FIN packet immediately after a GET packet is generated, the client 100 is determined to be a DDoS attacker and data to the client 100 is determined. Packet transmission can be blocked.

  Further, the GET packet in step (S306) and the FIN packet in step (S308) are generated with a difference of several tens of microseconds (μsec), but the ACK packet in step (S310) is generated after several milliseconds (msec). obtain.

  Therefore, in this embodiment, after the normal session setting is completed in this manner, the session of the client 100 is performed between the data (service) request (S306) of the client 100 and the ACK packet transmission (S310) of the data providing server 106. When the termination request (S308) occurs, the client 100 can be determined to be an attacker and the connection between the client 100 and the data providing server 106 can be blocked. At this time, an RST packet may be used as the session end packet in step (S308) instead of the FIN packet.

  In this embodiment, when the socket of the client 100 is activated for the service response in the step (S310), the client 100 generates an ACK packet and notifies the server that the response has been received normally. However, since the socket is terminated in response to the session termination request in step (S308) in the case of an attacker, an ACK packet for the response packet in step (S310) is not generated. Therefore, the client 100 can be determined as an attacker even when the ACK packet of the client 100 is not generated in response to the response packet (S310) of the data providing server 106.

  Hereinafter, the application layer protection method on the network according to the present embodiment, specifically, the service process between the client 100, the application layer protection service server 104, and the data providing server 106 will be described with reference to the state transition diagram (state machine) of FIG. And will be described by way of example.

  The state transition diagram of FIG. 4 may be generated for each session for the web service.

  First, the state S0 is a process of monitoring whether the client 100 requests a new session. If the SYN packet of the client 100 is monitored, the application layer protection service server 104 changes the state S0 to the state S1, Wait for the (SYN + ACK) packet of the data providing server 106.

  At this time, if the (SYN + ACK) packet is transmitted from the data providing server 106, the application layer protection service server 104 changes the state S1 to the state S2, and monitors whether the client 100 transmits the ACK packet to complete the session. Then, the state S2 is changed to the state S3.

  In the state S3, the application layer protection service server 104 can move to the state S4 for detecting an attack when the client 100 generates a GET packet.

  In the state S4, when the response of the data providing server 106 is monitored first, the application layer protection service server 104 changes the current state to the state S6 and feeds back to the state S0 again on the path where the normal connection ends.

  At this time, in the process of transition from the state S6 to the state S0, the client 100 and the data providing server 106 exchange a large number of packets. exclude.

  When the client 100 generates a FIN packet or an RST packet in the state S4, the application layer protection service server 104 determines the current client as an application layer attack client, and moves to the state S5 to perform an operation corresponding to the attack. Do. The operation corresponding to such an attack may include, for example, an operation of immediately blocking the IP of the corresponding client or an operation of transmitting the IP to IPS, FW or the like and blocking it.

  Further, the packet is exchanged several times between the client 100 and the data providing server 106 while transitioning from the state S5 to the state S0. This is a part unrelated to the application layer protection method of the present embodiment. Omitted.

  In order to avoid detection in the state S3, the state can be maintained when the client 100 transmits a packet other than the GET packet, and the current state can be transitioned to the state S0 when session connection is terminated.

  In the remaining states excluding the state S0, the normal / abnormal connection termination action can be performed according to the protocol. However, since this is not related to the application layer protection method of the present embodiment, a specific description is omitted.

  The method for detecting and responding to a DDoS attack on the application layer has been described above by taking the HTTP protocol as an example. However, in the case of another application program, a client that opens a session and requests a session termination together with the service request responds to the service request. Since the response is not referenced, such a client can be detected and dealt with as a denial of service attacker. In particular, when the server keep-alive option is turned off, the server immediately terminates the session after receiving one GET packet in one session, so that the attack can be more effectively prevented.

  As described above, the present invention detects the DDoS attack by searching for the IP indicating the act of the attacker described in FIG. 3 and blocking the IP, or blocking the GET packet generated by the FIN packet simultaneously with the GET packet. It corresponds to this. In addition, the case where the session is terminated using an RST packet instead of the FIN packet is included.

  In the present invention, it is possible to directly detect and respond to the IP or packet that generated the FIN packet immediately after the generation of the GET packet, which is a characteristic of the attacker of FIG. 3 clearly distinguished from the normal service request of FIG. Therefore, it is possible to search and respond to a DDoS attacker without generating an error alarm. In addition, the existing method requires many resources to perform the transmission rate limiting function, but the method according to the present embodiment can directly search for and respond to an attacker that generates an application layer DDoS packet, thereby saving resources. . Furthermore, an attacker can be searched for by the presence or absence of an ACK packet that is a client response to a service response. In addition, it is confirmed whether the FIN packet follows the GET packet, and it is possible to cope with a case where a normal user and a zombie PC traffic coexist in a network using NAT.

Claims (16)

A computer network system is a method for protecting an application layer, comprising:
Setting a session between the client and the data providing server via a network in response to a session connection request from the client;
Before transmitting a response packet from the data providing server to the client in accordance with a data request from the client to the data providing server in a state where the session between the client and the data providing server is connected by the step of setting the session And an application layer protection method for a computer network system, comprising the step of detecting the client as an application layer attack client when a session termination request is generated from the client. If an acknowledgment packet (ACK packet) from the client does not occur for the response packet transmitted from the data providing server to the client in accordance with a data request from the client to the data providing server, the computer network system The method of claim 1, further comprising detecting the client as the application layer attack client.   3. The application layer protection method of a computer network system according to claim 1, wherein the application layer attack client is a client that performs a distributed denial of service (DDoS) attack.   4. The computer network according to claim 3, wherein the distributed denial-of-service attack includes an HTTP (Hyper Text Transfer Protocol) get flooding attack (GET flooding) attack and a cache control flooding (Cache-Control (CC) flooding) attack. System application layer protection method. When the client is detected as the an application layer attacks the client, the computer network system, in claim 1 or 2, further comprising the step of interrupting the connection between the said client data providing server An application layer protection method for the computer network system described.   The method according to claim 1 or 2, wherein the data request includes transmitting a GET packet from the client to the data providing server.   3. The computer network system according to claim 1, wherein the session termination request includes transmitting a termination packet (FIN packet) or a reset packet (RST packet) from the client to the data providing server. Application layer protection method.   3. The application layer protection method for a computer network system according to claim 1, wherein the computer network system is based on a TCP / IP protocol. An apparatus for protecting an application layer of a computer network system,
Via the network to set a session with the client according to the session connection request from a client, before Symbol configured data provided to the data packets in response to a data request of the client via the network and transmits to the client Server,
A session termination request is sent from the client before transmitting a response packet from the data providing server to the client in response to the data request in a state where the session between the client and the data providing server is connected by setting the session. An application layer protection apparatus for a computer network system, comprising: an application layer protection service server configured to detect the client as an application layer attack client if generated.   The apparatus for protecting an application layer of a computer network system according to claim 9, wherein the application layer attack client is a client that performs a distributed denial of service (DDoS) attack.   The computer network according to claim 10, wherein the distributed denial-of-service attack includes an HTTP (Hyper Text Transfer Protocol) get flooding attack (GET flooding) and a cache control flooding (Cache-Control (CC) flooding) attack. System application layer protection device.   The application layer protection service server additionally receives the confirmation packet (ACK packet) from the client in response to the response packet transmitted from the data providing server to the client according to the data request of the client. The apparatus for protecting an application layer of a computer network system according to claim 9, wherein the apparatus is detected as the application layer attack client.   13. The application layer protection service server is configured to block the connection between the client and the data providing server when the client is detected as the application layer attack client. An application layer protection device of the computer network system described.   13. The application layer protection apparatus of a computer network system according to claim 9, wherein the data request transmits a GET packet from the client to the data providing server.   13. The application layer protection of a computer network system according to claim 9, wherein the session termination request transmits a termination packet (FIN packet) or a reset packet (RST packet) from the client to the data providing server. apparatus.   13. The apparatus for protecting an application layer of a computer network system according to claim 9, wherein the computer network system is based on a TCP / IP protocol.

Images