KR101002801B1 - Apparatus and method for defending against ddos attack - Google Patents

Abstract

A resource state analyzer for measuring at least one resource state value of a network system in real time, and comparing the at least one resource state value with respective predetermined thresholds, the at least one A system state determination unit for creating a blocking session in the network system when the resource state value of the network value exceeds the predetermined reference value, and when the resource state value does not exceed the reference value, A traffic measurement unit for measuring traffic for at least one IP, and generating a blocking session for an IP whose measured traffic exceeds a reference traffic among the at least one IP to the network system by the blocking session; Among the at least one packet whose transmission is blocked, Disclosed is a DDoS attack defense apparatus including a packet transmission control unit for controlling only transmission to the network system.

Network, traffic, entropy, packet, IP, resource, attack, defense

Description

APDEFATUS AND METHOD FOR DEFENDING AGAINST DDOS ATTACK}

Disclosed are a distributed denial-of-service attack defense apparatus and method. In particular, a DDoS attack defense apparatus and method for monitoring a DDoS attack on a network system and defending the DDoS attack when there is a DDoS attack on the network system are disclosed.

Recently, as the high-speed Internet environment has been established, damages caused by network attacks such as hacking and internet infringement have been continued. In particular, in the case of a large portal site, if a server is down due to a network attack or a problem such as leakage of personal information, a huge damage can be returned to the operator who operates the portal site.

Types of network attacks include attack methods for hacking Internet sites to obtain confidential or personal information, and infecting a large number of client computers with malicious code, causing the plurality of client computers to send large amounts of packets to a particular network system at a time. There is an attack method for bringing down the server of the network system by transmitting.

In particular, the latter attack method is called a distributed denial-of-service attack. The DDoS attack has a simple attack method, and tools for DDoS attack can be easily obtained from anywhere. Using this, the network system can be attacked.

DDoS attack is a normal packet, so it is difficult to distinguish between normal packet and abnormal packet. Even if defending DDoS attack, it blocks the normal packet as well as abnormal packet, which can damage normal users. .

Therefore, there is a need for a research on a defense base that can effectively defend against such DDoS attacks.

By monitoring the resource status of the network system, by measuring the traffic transmitted to at least one IP of the network system, it is determined whether the DDoS attack, and if there is a DDoS attack in the network system, by blocking only the transmission of abnormal packets To provide a DDoS attack defense system and method that can effectively defend against DDoS attacks.

The DDoS attack defense apparatus according to an embodiment of the present invention is a resource state analyzer for measuring at least one resource state value of a network system in real time, each of the predetermined at least one resource state value (predetermined) A system state determination unit for creating a blocking session in the network system when the at least one resource state value exceeds the predetermined reference values, in comparison with thresholds, the resource state value being Traffic for measuring at least one IP of the network system when the reference values are not exceeded, and creating a blocking session for an IP whose measured traffic among the at least one IP exceeds the reference traffic; At least one packet whose transmission to the network system is blocked by the measurement unit and the blocking session And a packet transmission control unit for controlling only the packets of pre-registered flows to be transmitted to the network system.

In addition, the DDoS attack defense method according to an embodiment of the present invention measuring the at least one resource (Resource) state value of the network system in real time, each of the predetermined criteria (predetermined) of the at least one resource state value Comparing the thresholds, if the at least one resource state value exceeds the predetermined reference values, creating a blocking session in the network system, wherein the resource state values set the reference values; If not exceeding, measuring traffic for at least one IP of the network system, creating a blocking session for an IP whose measured traffic exceeds a reference traffic among the at least one IP and the blocking session Flow registered in at least one packet whose transmission to the network system is blocked by Controlling only the packet of flows to be transmitted to the network system.

By monitoring the resource status of the network system, by measuring the traffic transmitted to at least one IP of the network system, it is determined whether the DDoS attack, and if there is a DDoS attack in the network system, by blocking only the transmission of abnormal packets In addition, the present invention can provide a DDoS attack defense device and method capable of effective defense against DDoS attacks.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention;

1 is a diagram showing the structure of a DDoS attack defense apparatus according to an embodiment of the present invention.

Referring to FIG. 1, a network system 110 and a DDoS attack defense device 120 are shown.

The DDoS attack defense device 120 may include a resource state analyzer 121, a system state determiner 122, a traffic measurer 123, and a packet transfer controller 124.

First, the resource state analyzer 121 measures at least one resource state value of the network system 110 in real time.

According to an embodiment of the present invention, the at least one resource state value may include a CPU load rate, a packet change amount of a network interface card (NIC), a device session count rate, or routing. Table count rate.

The system state determiner 122 compares the at least one resource state value measured by the resource state analyzer 121 with respective predetermined threshold values, and compares the at least one resource state value. It is determined whether the selected reference values are exceeded.

Then, if any one or more of the at least one resource state value exceeds each predetermined reference value, the system state determination unit 122 indicates that the packet is transmitted to the network system 110. A blocking session is created in the network system 110 to block.

For example, when the resource state analyzer 121 measures the CSI load rate of the network system 110, the packet change amount of the NIC, the device session count rate, and the routing table count rate, the system state determiner 122 measures the measured state. The CPI load rate, the packet change amount of the NIC, the device session count rate and the routing table count rate are compared with respective predetermined reference values.

According to an embodiment of the present invention, the resource state analyzer 121 may calculate average values for a specific period for each of at least one resource state value of the network system 110. In this case, according to an embodiment of the present invention, the selected reference values may be the average values.

For example, the resource state analyzer 121 measures the CSI load rate of the network system 110, the packet change amount of the NIC, the equipment session count rate, and the routing table count rate in real time, and during a specific period of time. The average values may be calculated using the measured CSI load rate, the packet change amount of the NIC, the device session count rate, and the routing table count rate.

Then, the system state determining unit 122 receives the CPI load rate, the packet change amount of the NIC, the equipment session count rate, the routing table count rate, and the average values from the resource state analyzing unit 121. Using the average values as reference values, it may be determined whether the CPI load rate, the packet change amount of the NIC, the device session count rate, and the routing table count rate exceed respective average values.

If the CPI load rate measured in real time exceeds the average value of CPI load measured during a specific period, the system state determination unit 122 determines that the network system 110 is subjected to a DDoS attack, A blocking session can be created in the system 110.

According to an embodiment of the present invention, the resource state analyzer 121 may measure the packet change amount of the NIC by measuring the traffic volume of the NIC of the network system 110.

The measurement of the traffic volume of the NIC refers to a measurement method of measuring the time that a packet arrives at the NIC, and determining whether the traffic of the NIC increases according to the measured time. If the measured time suddenly decreases, it can be seen that the traffic of the NIC is suddenly increasing.

The traffic volume measurement of the NIC may be represented by Equation 1 below.

Where k is the number of packets arriving at the NIC, for example, assuming that 50 packets arrive at the NIC, k = 50. The resource state analyzer 121 may measure the packet change amount of the NIC by measuring the time that the packet arrives at the NIC using Equation 1, and the system state analyzer 122 determines the packet change amount and the reference of the NIC. By comparing the values, when the amount of packet change of the NIC exceeds a reference value, a blocking session may be created in the network system 110.

According to an embodiment of the present invention, the system state determination unit 122 may determine that at least one resource state value of the network system 110 measured by the resource state analyzer 121 does not exceed a predetermined reference value. If there is a blocking session in the system 110, the blocking session may be released. Through this, after the network system 110 has received a DDoS attack in the past and a blocking session is generated by the DDoS attack defense device 120, the system state determination unit 122 may determine whether at least one resource of the network system 110 is stored. As a result of determining the current state, when it is determined that the network system 110 is normal, the blocking session may be released, and the packet may be normally transmitted to the network system 110.

The traffic measurer 123 determines that at least one resource state value of the network system 110 does not exceed respective reference values when the system state determiner 122 determines that at least one IP of the network system 110 is determined. Measure traffic for the IP, and create a blocking session for the IP where the measured traffic exceeds the reference traffic. As a result, even when the system state determining unit 122 determines that the network system 110 is in a normal state, the traffic measuring unit 123 monitors traffic for at least one IP of the network system 110 to prevent a DDoS attack. It can strengthen your defense against it.

According to an embodiment of the present invention, the traffic measurement unit 123 may include an IP detection unit and an entropy measurement unit.

Therefore, hereinafter, the structure of the traffic measuring unit 123 will be described in detail with reference to FIG. 2.

2 is a diagram illustrating a structure of a traffic measuring unit according to an embodiment of the present invention.

Referring to FIG. 2, a network system 210 and a traffic measurement unit 220 are shown.

The traffic measurer 220 may include an IP detector 221 and an entropy measurer 222.

The IP detector 221 monitors the number of source IPs connected to at least one IP of the network system 210, and a plurality of source IPs exceeding a reference number among the at least one IP are connected. Detect target IP.

According to an embodiment of the present invention, the IP detection unit 221 generates a list of a plurality of source IPs connected to the at least one IP, and the plurality of IPs connected to the at least one IP at predetermined time intervals. It may be determined whether the number of source IPs exceeds the reference number.

The entropy measuring unit 222 measures an entropy value of the plurality of source IPs connected to the target IP detected by the IP detector 221, and the entropy value exceeds a predetermined entropy value. , For the target IP, creates a blocking session.

In this case, according to an embodiment of the present invention, the entropy value may be calculated through Equation 2 below.

only,

Here, total is the total number of packets transmitted to the network system 210, and srccnt is the number of source IPs connected to the target IP.

As a result, the traffic measuring unit 220 detects a target IP to which a plurality of source IPs exceeding a reference number from among at least one IP of the network system 210 is connected, thereby transmitting an excess packet. After detecting the suspected IP, the entropy measuring unit 222 determines whether the excess packet is actually transmitted to the target IP by measuring the entropy of the target IP, and if the excess packet is transmitted to the target IP, If determined, by creating a blocking session for the target IP, it is possible to defend against DDoS attacks.

The structure of the traffic measurement unit 220 has been described above. Hereinafter, the structure of the DDoS attack defense apparatus will be described with reference to FIG. 1.

The packet transmission control unit 124 is a flow that is registered among at least one packet whose transmission to the network system 110 is blocked due to the blocking session generated by the system state determination unit 122 or the traffic measurement unit 123. Only the packets of the flows are controlled to be transmitted to the network system 110.

In general, when the network system 110 is subjected to a DDoS attack, since the conventional DDoS attack defense device blocks transmission of all packets transmitted to the network system 110, normal network packets cannot be transmitted to the network system 110. There were many cases. However, the packet transmission control unit 124 normally registers a normal packet, and when a blocking session is generated in the network system 110 by a DDoS attack, the packet transmission control unit 124 transmits the registered normal packet to the network system 110. By doing so, it is possible to block transmission of abnormal packets only by DDoS attacks, thus enabling effective defense against DDoS attacks.

According to an embodiment of the present invention, the packet transmission control unit 124 may include a packet registration unit.

Therefore, hereinafter, the structure of the packet transmission control unit 124 will be described in detail with reference to FIG. 3.

3 is a diagram illustrating a structure of a packet transmission control unit according to an embodiment of the present invention.

Referring to FIG. 3, a network system 310 and a packet transfer control unit 320 are shown.

The packet transmission control unit 320 may include a packet registration unit 321.

When there is no blocking session in the network system 310, the packet registerer 321 registers at least one packet transmitted to the network system 310.

In other words, when the network system 310 is not subjected to a DDoS attack, the packet registerer 321 may determine the transmitted packets as normal packets and register the packets.

Then, if the network system 310 is subjected to a DDoS attack, the packet transmission control unit 320 is only for the normal packets registered in the packet register 321 among the packets blocked transmission by the blocking session. By controlling the transmission to the network system 310, it is possible to effectively defend against DDoS attacks.

According to an embodiment of the present invention, the packet registration unit 321 shakes three times when a blocking session does not exist in the network system 310 and at least one packet is transmitted to the network system 310 through the TCP protocol. Only packets that have been authenticated (Three Hand Shaking) can be registered.

In this way, the packet register 321 may reduce the risk of registering an abnormal packet.

4 is a flowchart illustrating a DDoS attack defense method according to an embodiment of the present invention.

In step S410, at least one resource state value of the network system is measured in real time.

According to an embodiment of the present invention, the at least one resource state value may be a CPI load rate, a packet change amount of a NIC, an equipment session count rate, or a routing table count rate.

In addition, in step S410, the amount of packet change of the NIC may be measured by measuring the NIC traffic volume according to Equation (1).

In operation S420, it is determined whether at least one resource state value measured in operation S410 exceeds respective predetermined reference values.

If at least one resource state value of the at least one resource state value exceeds each predetermined reference value in step S420, a blocking session is created in the network system in step S430.

However, if the at least one resource state value does not exceed each predetermined reference value in step S420, it is determined in step S440 whether a blocking session exists in the network system.

As a result of the determination in step S440, if there is a blocking session in the network system, the blocking session is released in step S450.

As a result, when it is determined in step S420 that the resource state of the network system is abnormal, in step S430, a blocking session may be generated to block a DDoS attack by blocking a packet transmitted to the network system.

In addition, when the network system is receiving the DDoS attack in the past and is defending the DDoS attack through a blocking session, as a result of determining the current resource state of the network system in step S420, it is determined that the current resource state is normal. If it is determined in step S440 that the blocking session exists in the network system, by releasing the blocking session in step S450, the packet may be normally transmitted to the network system.

In step S460, if the blocking session does not exist in the network system as a result of the determination in step S440, or if the blocking session that existed in the network system is released in step S450, at least one IP of the network system is determined. Traffic is measured, and a blocking session is created for the IP where the measured traffic exceeds the reference traffic.

If there is no IP exceeding the reference traffic among the at least one IP, in step S460, it is determined that the network system is not subjected to a DDoS attack, and a blocking session is not created in the network system.

According to an embodiment of the present invention, in step S460, detecting a target IP to which a plurality of source IPs exceeding a reference number from among at least one IP of the network system are connected and referring to Equation 2 above. And measuring an entropy value of the plurality of source IPs connected to the target IP, and generating a blocking session for the target IP when the entropy value exceeds a predetermined entropy value. have.

As a result, even when it is determined in step S420 that the resource state of the network system is normal, through step S460, by measuring the traffic for at least one IP of the network system, DDoS attack on the network system By determining whether or not, a solid defense against the DDoS attack is possible.

In step S470, it is determined whether there is a pre-registered packet among at least one packet whose transmission to the network system is blocked by the blocking session generated in step S430 or step S460.

As a result of the determination in step S470, if there is a pre-registered packet among the at least one packet, the pre-registered packet is controlled to be transmitted to the network system in step S480.

Through this, even when a blocking session is created in the network system to protect the DDoS attack, the normal packet is transmitted to the network system, thereby effectively defending the DDoS attack.

DDoS attack defense method according to the present invention is implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and floptical disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

1 is a diagram showing the structure of a DDoS attack defense apparatus according to an embodiment of the present invention.

2 is a diagram illustrating a structure of a traffic measuring unit according to an embodiment of the present invention.

3 is a diagram illustrating a structure of a packet transmission control unit according to an embodiment of the present invention.

4 is a flowchart illustrating a DDoS attack defense method according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: network system 120: DDoS attack defense device

121: resource state analysis unit 122: system state determination unit

123: traffic measurement unit 124: packet transmission control unit

210: network system 220: traffic measurement unit

221: IP detection unit 222: entropy measuring unit

310: network system 320: packet transmission control unit

321: packet register

Claims (14)

A resource state analyzer for measuring at least one resource state value of the network system in real time; Comparing the at least one resource state value with respective predetermined thresholds, when the at least one resource state value exceeds the predetermined reference values, a system state determination unit generating a session); When the resource state value does not exceed the reference values, the traffic for the at least one IP is measured by monitoring the number of source IPs connected to at least one IP of the network system, A traffic measuring unit configured to generate a blocking session for an IP in which the measured traffic among the at least one IP exceeds a reference traffic; And Only normal packets of flows that are pre-registered among the at least one packet whose transmission to the network system is blocked due to the blocking session generated by the system determining unit or the traffic measuring unit are transmitted to the network system. A packet transmission control unit for controlling to The traffic measuring unit, An IP detector configured to detect a target IP to which a plurality of source IPs exceeding a reference number from among the at least one IP are connected; And An entropy measuring unit for measuring an entropy value of the plurality of source IPs connected to the target IP, and generating a blocking session for the target IP when the entropy value exceeds a predetermined entropy value. DDoS attack defense device comprising a. The method of claim 1, The at least one resource state value is DDoS, characterized in that one or more of the CPU load rate (CPU Load rate), the packet change amount of the Network Interface Card (NIC), the equipment session count rate, the routing table count rate Attack defense device. The method of claim 2, The resource state analysis unit, DDoS attack defense device characterized in that for measuring the packet change amount of the NIC by measuring the traffic volume (Volume) of the NIC. The method of claim 1, The system state determination unit, And if the resource state value does not exceed the predetermined reference value and there is a blocking session in the network system, releasing the blocking session. delete The method of claim 1, The IP detection unit, And generating a list of the plurality of source IPs and determining whether the number of the plurality of IPs exceeds the reference number at predetermined time intervals. The method of claim 1, The packet transmission control unit, If there is no blocking session in the network system, the packet registration unit for registering at least one packet transmitted to the network system as a normal packet DDoS attack defense device comprising a. The method of claim 7, The packet registration unit, When the at least one packet is transmitted to the network system through the TCP protocol, the DDoS attack defense device, characterized in that registers only the packet that has been made three times handshake authentication (Three Hand Shaking). Measuring at least one resource state value of the network system in real time; Comparing the at least one resource state value with respective predetermined thresholds, when the at least one resource state value exceeds the predetermined reference values, creating a session); When the resource state value does not exceed the reference values, the traffic for the at least one IP is measured by monitoring the number of source IPs connected to at least one IP of the network system, Creating a blocking session for the IP among the at least one IP where the measured traffic exceeds a reference traffic; And Only for normal packets of flows already registered among at least one packet blocked for transmission to the network system due to a blocking session created in the network system and a blocking session created in the IP exceeding the reference traffic. Controlling the transmission to the network system; For an IP that exceeds the reference traffic, creating a blocking session may include: Detecting a target IP to which a plurality of source IPs exceeding a reference number from among the at least one IP are connected; And Measuring an entropy value of the plurality of source IPs connected to the target IP, and if the entropy value exceeds a predetermined entropy value, generating a blocking session for the target IP; DDoS attack defense method comprising the. 10. The method of claim 9, The at least one resource state value is DDoS, characterized in that one or more of the CPU load rate (CPU Load rate), the packet change amount of the Network Interface Card (NIC), the equipment session count rate, the routing table count rate Attack defense method. The method of claim 10, Measuring the at least one resource state value in real time, DDoS attack defense method characterized in that for measuring the packet change amount of the NIC by measuring the traffic volume (Volume) of the NIC. 10. The method of claim 9, Creating a blocking session in the network system, Releasing the blocking session when the resource state value does not exceed the predetermined reference value and there is a blocking session in the network system. DDoS attack defense method comprising the. delete A computer-readable recording medium having recorded thereon a program for performing the method of any one of claims 9 to 12.

Images