KR100882809B1 - DDoS PROTECTION SYSTEM AND METHOD IN PER-FLOW BASED PACKET PROCESSING SYSTEM - Google Patents

Abstract

The present invention discloses a distributed denial of service (DDoS) defense system and method for flow-based packet processing for high speed traffic (1 Gbps).

A system for monitoring a packet passing through a node device on a flow-by-flow basis to detect malicious packets and block them from propagating to a network, the system comprising: a filter rule vector list for maintaining information of malicious flows for blocking; A flow information table storing information for each flow; A network monitoring card mounted on the node devices to extract packets passing through the node and block malicious packets according to a rule set in the filter rule vector list; A traffic monitoring component unit for analyzing the packets extracted from the network monitoring card and extracting information for each flow to update the flow information table; And analyzing the flow information table to determine whether the flow is a malicious flow, and if a malicious flow is detected, registers in the filter rule vector list to define a forwarding policy. The present invention can effectively block DDoS attacks even in a 1Gbps high-speed network using the DAG 4.3 GE card.

DDoS, Packet, Flow, Flow Information Table, Attack, Defense, Network Monitoring

Description

DDoS PROTECTION SYSTEM AND METHOD IN PER-FLOW BASED PACKET PROCESSING SYSTEM}

1 is a schematic diagram illustrating a general structure of a distributed denial of service attack (DDoS) attack;

2 is a schematic diagram showing the structure of a typical D-WARD;

3 is a diagram showing the overall structure for defending a distributed denial of service attack according to the present invention;

4 is a block diagram of a network monitoring card used in the present invention.

5 is an external view of the network monitoring card shown in FIG. 4;

6 is a program structure diagram of a network monitoring card according to the present invention.

7 is a flow chart illustrating a procedure for defending a distributed denial of service attack in accordance with the present invention.

* Explanation of symbols for main parts of the drawings

301: network monitoring card 302,303: port

304: DAG Sniffer 305: Dropper

306: Traffic monitoring component 307: DDoS defense component

308: filter rule vector 309: flow information table

310: malicious packet marking unit

The present invention relates to a security technique for protecting network resources, and more particularly, to a distributed denial of service (DDoS) defense system and method for flow-based packet processing for high-speed traffic (1Gbps).

In general, a distributed denial-of-service attack (DDoS) refers to interrupting a system and a network from operating normally by instantaneously sending a large amount of data to a target system and a network such as a specific web server on the Internet.

1 shows the general structure of a DDoS attack. The attacker 101 generates large amounts of attack traffic 104 at various locations simultaneously and sends them to the target victim 105 by using the insecure systems 102 and 103 on the network. Types of attack traffic 104 include TCP SYN floating, ICMP floating, and UDP floating. In particular, in the case of TCP SYN floating, by sending only SYN packets continuously to the server, many TCP connections consume server resources. The damages caused by Distributed Denial of Service (DDos) attacks place a heavy load on the network along with Denial of Service over the network. This attack flow looks normal on the outside, so the technology to detect such attacks is key. As a method of detecting an attack in the flow of attack traffic, there is a method of detecting on the source / attacker side, a method of detecting on the destination / victim side, and a method of detecting on the core network. Representative technologies include pushback and traceback techniques.

Pushback is accomplished by observing packet drop statistics for individual routers on the network. DDoS attack packets generated from distributed places arrive at the destination through various paths, and many packets are blocked by Droptail or RED that can be processed by the router close to the destination where the attack packet was collected. When packet blocking increases in this moment, a pushback message is transmitted to a path from which a packet is sent. The router receiving the message blocks the delivery of the packet to the flow and continues to deliver the attack packet by forwarding the pushback message toward the on-path of the packet.

 The IP traceback technique provides the attack victim system administrator with the IP address of the actual attack source of the DDoS attack. IP traceback techniques can be divided into proactive IP traceback and reactive IP traceback, depending on the countermeasure. First, the proactive traceback technology generates the traceback path information in advance during packet transmission on the network and inserts it into the packet or forwards it to the destination to manage it periodically. If a hacking attack occurs, the information already generated and collected This is a technique to determine the origin of hacking attack using. Probabilistic packet marking and iTrace (ICMP traceback), a variation of traditional ICMP messages, with initial countermeasures such as link testing and logging, and active IP traceback. Etc. Second, in response to a hacking attack, the counter traceback technique tracks the path to the hacked traffic connection in a hop phase in the victim system. Specific techniques may be divided into an overlay network scheme, a hash-based traceback technique, and an IPSec-based traceback technique.

DoS Attack Recognition and Defense (D-WARD) enables the attack originating router to perform this function, thereby minimizing network congestion. All flows passing through the egress node of the router are distinguished and the number of send and receive packets is counted in this flow. In the normal flow, there is a ratio not exceeding a certain number between the send packet and the receive packet. Therefore, when a flow exceeds this certain ratio, it is recognized as an abnormal flow and tries to block. 2 shows the structure of the D-WARD.

On the other hand, the network speeds that are currently offered at the end-level are now increasing from 100 Mbps to 1 Gbps. As the network speeds up, the power of DDoS attacks increases. Therefore, the ability to detect and stop DDoS attacks should also be able to handle 1Gbps.

Existing technologies, however, have already put a lot of load on the network to detect DDoS attacks and find the source of the attack so that devices (routers) on the network can block the transmission of packets. However, in the high-speed network environment above the Gbps level, the prior art measures have already suffered a lot of damage. Therefore, the DDoS attack should be detected more quickly.

The present invention has been proposed to meet the above necessity, and an object of the present invention is to detect malicious DDoS attacks (especially SYN Flooding, ICMP Flooding) packets in the source network and prevent their transmission. It is to provide a distributed denial of service attack defense system and method of flow-based packet processing for high-speed traffic to protect the network and services.

In order to achieve the above object, the system of the present invention is a system for monitoring a packet passing through a node device for each flow to block malicious packets from being transmitted to the network, and the information of malicious flow for blocking A filter rule vector list that maintains; A flow information table storing information for each flow; A network monitoring card mounted on the node devices to extract packets passing through the node and block malicious packets according to a rule set in the filter rule vector list; A traffic monitoring component unit for analyzing the packets extracted from the network monitoring card and extracting information for each flow to update the flow information table; And analyzing the flow information table to determine whether the corresponding flow is a malicious flow, and if a malicious flow is detected, registers in the filter rule vector list to define a forwarding policy. It is done.

The traffic monitoring component unit classifies the flow through a hash function using the source IP address, the destination IP address, the source port number, the destination port number, and the protocol type of the extracted packet as key values, and the DDS defense component unit By observing the flow information table, the malicious flow is found, and a predetermined timer is set, and if the attack of the malicious flow does not continue for a predetermined time, the attack is stopped and the flow is removed from the filter rule vector list.

In addition, to achieve the above object, the method of the present invention comprises the steps of: extracting a packet from the network monitoring card; Using the extracted packet as a source value, source IP address, destination IP address, source port number, destination port number, and protocol type data, the flow is classified through a hash function, and information is extracted for each flow to update the flow information table. Doing; Analyzing the flow information table to detect a malicious flow and registering the malicious flow in a filter rule vector list; And blocking the packet registered in the filter rule vector list to prevent malicious flow from propagating to the network. The distributed denial of service attack defense method further includes the step of removing the flow from the filter rule vector list by determining that the attack is stopped if the attack of the harmful flow does not continue for a predetermined time using a predetermined timer.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In the embodiment of the present invention, the DDoS attack defense function is added to the basic packet forwarding function by using the ability of the DAG 4.3GE gigabit network monitoring card to capture packets at a maximum speed of 2.4 Gbps. In other words, the present invention is a traffic-policing component for capturing a packet and performing a forwarding policy, a traffic monitoring component for distinguishing a flow of a packet, and a malicious flow. It consists of a DDoS Protection Component that determines whether it is a flow and defines a forwarding policy.

First, the traffic-policing component uses a library provided by the DAG card. The DAG card has two optical ports and traffic flows through these two ports. The provided utility includes an API to capture and filter packets on the DAG card.

Second, the traffic monitoring component classifies the packets captured by the DAG card, and classifies the packets by flow and stores them in a flow information table. Basically, it stores the number of transmitted and received packets with 5-tuples (source / destination IP, source / destination port numbers, type of protocol). Here, the flow is classified through the ELF hash function through the above 5-tuples, and stores the key value of the flow information table (FlowInfoTable) in the key queue.

Third, the DOSS Protection Component monitors the information stored in the FlowInfoTable and determines whether each flow is harmful. A flow information table (FlowInfoTable) has a process of calculating the ratio of the transmission packet and the reception packet of each flow. In case of TCP flow, the number of sent packets (Psent) for received packets (Prcv) exceeds TCPrto (set to 3) or ICMPrto (set to 1.1) for ICMP flows. The filter rule of the DAG card is applied to allow the packet having the flow to be dropped. The application of these rules should only be maintained for a certain amount of time (approximately 30 seconds to 1 minute). This is because DDoS attacks typically explode within one minute. Therefore, it is necessary to detect DDoS attack through fast flow classification. Also these days, many DDoS attacks occur mainly through TCP flood. Therefore, in order to detect such a pattern attack, the DDoS attack can be detected and prevented by comparing the ratio of SYN packets and SYN + ACK packets in the TCP connection establishment process. In addition, the FlowInfoTable is composed of a linked-list structure with 65536 entries.

3 is a diagram showing the overall structure for defending a distributed denial of service attack (DDoS) according to the present invention, Figure 4 is a block diagram of a network monitoring card used in the present invention, Figure 5 is shown in Figure 4 6 is an external view of the network monitoring card, and FIG. 6 is a program structure diagram of the network monitoring card according to the present invention.

Referring to FIG. 3, the present invention provides a network monitoring card 301 mounted on node devices such as a router, a traffic monitoring component 306 which is a software module for operating the network monitoring card 301, and a malicious flow ( flow, and a DDoS defense component 307 that defines a forwarding policy.

In the embodiment of the present invention, the network monitoring card 301 is a DAG 4.3 GE card configured as shown in FIG. 4, and includes two optical ports 302 and 303, a DAG sniffer 304 and a dropper 305, It is connected between full-duplex links between two nodes to exchange data. Inside the DAG card, the DAG sniffer 304 reads and modifies the passing packets, and the dropper 305 blocks the packets by a predefined policy. The present invention adds a traffic monitoring component 306 and a DDoS defense component 307 on the network monitoring card 301 to detect a DDoS attack while creating and maintaining a flow information table (FlowInfoTable) 309 with information of packets read. do.

DAG 4.3 GE used as a network monitoring card 301 in the sinking of the present invention, as shown in Figure 4, two optical modules, a framer (Framer), DAG 4.3 FPGA, FIFO, coprocessor connector (Coprocessor connector), It consists of flash memory, CPLD, LEDs, synchronous I / O, and timing stamp clocks, allowing packets to be header-only or variable-length in applications on 10/100 and Gigabit Ethernet Networks. You can capture it. The two ports can independently transmit and receive at full line rate on two channels simultaneously. One card also allows bidirectional monitoring and transmission over a full duplex link and can operate inline.

This DAG 4.3 GE card, as shown in FIG. 5, indicates that the FPGA image has been successfully configured in the DAG Card chipset when LED 1 lights blue. If LEDs 3 and 5 light green, the link of Port A, B is working normally.If LEDs 4 and 6 light, the link A, B link error ( error) has occurred. LED 2 indicates that data capture is in progress.

If this DAG 4.3 GE card 301 is properly installed and the link is successfully connected to port A 302 and port B 303, LED 1 will appear blue and LED 3 will show green.

The DAG 4.3 GE card 301 can operate in two modes, nic and nonic. First, nic mode assumes that the DAG card 301 is directly connected to a Gigabit Ethernet switch or a card by using a full-duplex cable, and Gigabit Ethernet auto-negotiation. -negotiation). The nonic mode can be set when used with optical fiber splitters. Receive sockets of ports A and B are connected to the outputs of the installed optical splitters between the network links between the two devices, and the transmit packets are disconnected.

The DAG 4.3 GE card 301 includes a function of receiving and immediately sending a packet using a single memory buffer. A sample program for testing an inline forwarding function called "dagfwddemo" is provided. The structure of the "dagfwddemo" program is shown in FIG. Since the DAG 4.3 GE card 301 is known, further description thereof will be omitted.

Referring again to FIG. 3, the traffic monitoring component 306 and the DDoS defense component 307 added in accordance with the present invention each operate as independent threads. Specifically, the thread of the traffic monitoring component 306 performs analysis on packets read from the DAG sniffer 304. The traffic monitoring component 306 thread spends most of its processing time processing the indication 310 of malicious packets. In the indication 310 of malicious packets, flow is distinguished through a hash function by using 5-tuple of the packet as a key value. Here, the hash function uses a 32-bit ELF hash function, which has a processing capability of O (1). The information of packets divided by flows is recorded in the flow information table 309.

In the flow information table 309, 65536 entries are configured in the form of a linked list, and the flow rate of the flow, the number of SYN packets, the number of SYN_ACK packets, and the total number of forwarded packets are recorded.

If the flow is already determined to be harmful, the packet is marked for blocking. The filter rule vector 308 thus maintains information of harmful flows for blocking. The filter rule vector 308 and the flow information table 309 are shared by the traffic monitoring component 306 thread and the DDoS defense component 307 thread.

The DDoS defense component 307 thread continues to observe the flow information table 309 to find harmful flows. In addition, since the blocking information on the harmful flow cannot be maintained indefinitely, if the attack of the harmful flow does not continue for a predetermined time with a predetermined timer, the attack is determined to be stopped and removed from the list of the filter rule vector 308.

7 is a flow chart illustrating a procedure for defending a distributed denial of service attack in accordance with the present invention, showing the process for packet processing in the traffic monitoring component 306 module, which is the core of the present invention.

Referring to FIG. 7, in step 401, a frame is received using a capture function module (DAG sniffer) of a DAG card. The embodiment of the present invention focuses on defense against TCP SYN Floating and ICMP SYN Floating attacks during DDoS attacks. Therefore, in step 402, it is checked whether the received frame is an IP packet. If the received frame is not an IP packet, the frame is sent without any processing. In step 403, it is checked whether the packet is a TCP packet. If it is not a TCP packet, it is checked once again in step 410 whether it is an ICMP packet. If the received frame is not a TCP packet or an ICMP packet, it passes without any processing.

If it is determined in step 403 that the packet is a TCP packet, the value of the TCP header is examined in more detail from step 404. In step 404, it is checked whether the packet is a TCP_SYN packet, and in step 405, the flow ID value of the packet is found through the ELF hash function. In step 406, a check is made to see if there is a flow ID already found, otherwise a new flow information entry is created and registered in the flow information table 309. If the flow ID already exists, the flow information is updated in the flow information table 309. This means increasing the number of SYN packets. The packet is then sent to filtering and forwarding process 413.

In step 404, if it is determined that the packet is not a SYN packet, it is checked once again whether it is a SYN + ACK packet. If it is confirmed as a SYN + ACK packet, it has a process using a hash function as in the case of a SYN packet. However, if there is no information on the flow of the SYN packet corresponding to the SYN + ACK is ignored.

If it is confirmed as an ICMP packet in step 410, it is checked whether the packet is an echo request packet (411) or an echo response packet (412). According to the result confirmed in this way, the flow ID is distinguished using a hash function, and the information of the flow information table 309 is updated.

Although the present invention has been described in detail through specific embodiments, the present invention is not limited to the above-described embodiments, and various changes may be made by those skilled in the art to which the present invention pertains without departing from the scope of the technical idea. It may be changed and implemented.

As described above, the DDoS defense method according to the present invention is a traffic monitoring component that distinguishes the flow of packets on the network monitoring card, and determines whether it is a malicious flow and forwarding ( By adding a DDoS Protection Component that defines a forwarding policy, it can detect malicious DDoS attacks in the attacker network to protect the network early by preventing malicious traffic from being delivered to the network. In particular, the present invention can effectively block DDoS attacks even in a high-speed network of 1Gbps using the DAG 4.3 GE card.

Claims (7)

In the system for monitoring the packets passing through the node device for each flow to detect malicious packets and to prevent them from propagating to the network, A filter rule vector list that maintains information of malicious flow for blocking; Flow information, which is configured in the form of a linked list, stores flow information including the transmission speed of the flow, the number of transmission packets (SYN packets), the number of received packets (SYN_ACK packets), and the total number of forwarded packets for each flow. table; A network monitoring card mounted on the node devices to extract packets passing through the node and block malicious packets according to a rule set in the filter rule vector list; Key 5-tuples (source / destination IP, source / destination port numbers, type of protocol) of the packet extracted from the network monitoring card, that is, source IP address, destination IP address, source port number, destination port number, protocol type Traffic that updates the flow information table by classifying flows through the ELF hash function, extracting flow information including the number of transmission packets and received packets with 5-tuples for each flow, and storing the flow information in the flow information table. A monitoring component unit; And The flow information table is analyzed to calculate the ratio of the transmission packet and the reception packet of each flow, and in the case of the TCP flow, the number of sent packets Psent to the number of received packets Prcv exceeds TCPrto (set to 3) or In case of ICMP flow, ICMPrto (set to 1.1) is determined as malicious flow.If malicious flow is detected, it is registered in the filter rule vector list to define a forwarding policy. A defense component unit (DDoS) for removing the flow from the filter rule vector list by determining that the attack is stopped if the attack of the in-flow does not continue; Distributed denial of service attack defense system of a flow-based packet processing method comprising the. delete delete delete Extracting a packet from the network monitoring card; 5-tuples (source / destination IP, source / destination port numbers, type of protocol) of the extracted packet, that is, source IP address, destination IP address, source port number, destination port number, protocol type as ELF Classifying the flow through a hash function, updating the flow information table by extracting flow information including the number of transmission packets and received packets with 5-tuples for each flow and storing the flow information in a flow information table; The flow information table is analyzed to calculate the ratio of the transmission packet and the reception packet of each flow, and in the case of the TCP flow, the number of sent packets Psent to the number of received packets Prcv exceeds TCPrto (set to 3) or In the case of an ICMP flow, determining a malicious flow when the ICMPrto (set to 1.1) is exceeded, and if a malicious flow is detected, registering a filter rule vector list to define a forwarding policy; Blocking a packet registered in the filter rule vector list to prevent malicious flow from propagating to a network; And Placing a predetermined timer and determining that the attack is stopped if the attack of the malicious flow does not continue for a predetermined time and removing the flow from the filter rule vector list; Distributed denial of service attack defense method of a flow-based packet processing method comprising the. delete delete

Images