KR101072984B1 - SYSTEM AND METHOD FOR DEFENSING DDoS ATTACK TRAFFIC - Google Patents

Abstract

An attack traffic defense system for distributed denial of service attacks in accordance with an embodiment of the disclosed technology comprises a first network comprising a target server and at least one proxy server associated with the target server, at least one client and a global load balancing (GLB) A second network including a DNS and an interlocking network for interworking between the first and second networks, wherein the GLB DNS analyzes traffic destined for the target server through the interlocking network, and when attack traffic occurs; Direct non-attack traffic to one of the at least one proxy server.

Description

Attack traffic defense system for distributed denial of service attack and its method {SYSTEM AND METHOD FOR DEFENSING DDoS ATTACK TRAFFIC}

The disclosed technique relates to a defense technique of a distributed denial of service attack, and more particularly, to an attack traffic defense technique for a distributed denial of service attack capable of maintaining traffic of a normal accessor to a target of a distributed denial of service attack.

Distrubyte Denial of Service (DDoS) is a hacking method that distributes multiple attackers simultaneously and denies a Denial of Service attack (DoS) to prevent the system from providing normal services.

The conventional defense against DDoS attacks is to protect the target server by blocking all network traffic to the target server. However, such a conventional defense technology can not distinguish the traffic of non-attack, so even normal users can not connect to the target server, there is a problem that the target server can not operate.

Among the embodiments, the attack traffic defense system for distributed denial of service attacks includes a first network comprising a target server and at least one proxy server associated with the target server, at least one client and a Global Load Balancing (GLB) DNS. A second network and an interworking network for interworking between the first and second networks, wherein the GLB DNS analyzes the traffic destined for the target server through the interworking network, and, when attack traffic occurs, non-attack traffic To one of the at least one proxy server.

Among the embodiments, the attack traffic defense system for distributed denial of service attacks is directed to a plurality of networks and an interworking network connecting the plurality of networks. The attack traffic defense system includes at least one first proxy server located in each of the plurality of networks and proxy servers located in the plurality of networks, and the non-attack traffic for the target server located in the same network as the target server. GLB Domain Name Servers (DNS) that direct the server to the at least one first proxy server to direct the received traffic to the target server.

Among the embodiments, the attack traffic defense method for a distributed denial of service attack includes (a) analyzing the traffic to identify whether the distributed denial of service attack and a corresponding target server, (b) analyzing the traffic for the target server And distinguishing the attack traffic from the non-attack traffic, and (c) bypassing the non-attack traffic using at least one proxy server located in the same network as the target server.

1 is a configuration diagram according to an embodiment of an attack traffic defense system to which the disclosed technology may be applied.
2 is a block diagram of an attack traffic defense method for distributed denial of service attacks according to an embodiment of the disclosed technology.
3 is a flow chart for the attack traffic defense method of FIG.

The description of the disclosed technique is merely an example for structural or functional explanation and the scope of the disclosed technology should not be construed as being limited by the embodiments described in the text. That is, the embodiments may be variously modified and may have various forms, and thus the scope of the disclosed technology should be understood to include equivalents capable of realizing the technical idea.

On the other hand, the meaning of the terms described in the present application should be understood as follows.

Terms such as "first" and "second" are intended to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, the first component may be named a second component, and similarly, the second component may also be named a first component.

The term “and / or” should be understood to include all combinations that can be presented from one or more related items. For example, the meaning of "first item, second item and / or third item" may be presented from two or more of the first, second or third items as well as the first, second or third item It means a combination of all the items that can be.

When a component is referred to as being "connected" to another component, it should be understood that there may be other components in between, although it may be directly connected to the other component. On the other hand, when a component is referred to as being "directly connected" to another component, it should be understood that there is no other component in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "comprise" or "have" refer to features, numbers, steps, operations, components, parts, or parts thereof described. It is to be understood that the combination is intended to be present and does not exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

In each step, an identification code (e.g., a, b, c, etc.) is used for convenience of description, and the identification code does not describe the order of the steps, and each step clearly indicates a specific order in context. Unless stated otherwise, they may occur out of the order noted. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

1 is a configuration diagram according to an embodiment of an attack traffic defense system to which the disclosed technology may be applied.

Referring to Figure 1, the attack traffic defense system is implemented in an environment consisting of a plurality of networks.

The network is composed of networks 100a to 100d provided by an ISP (Internet Service Provider) and an interworking network (Internet eXchange-IX, 101) interworking them. The interlocking network 101 may perform interworking between domestic networks so that domestic data may be quickly transmitted and received without being transmitted through an overseas line.

When a DDoS attack occurs, the interworking network 101 with less bandwidth than other networks causes the load first, and the interworking network 101 is directed to the target server 140 of the DDoS attack for its operation, that is, the reception is performed. You can block all packets whose IP is that of the target server.

Proxy servers 110a-110d and GLB Domain Name Servers (DNS) 120a-120d are located in each of the networks 100a-100d.

In the following description, the target server 140 exists in the network 100a for convenience of description, and the Global Load Balancing (GLB) DNS installed in the network 100c will be described as an example. However, the GLB DNS ( The operations corresponding to the same may also be performed at 120b and 120d.

An embodiment of an attack traffic defense system will be described with reference to FIG. 1. This embodiment will be described based on the network.

According to the present embodiment, interworking between the first and second networks and the second network 100c, which is at least one of a first network in which the target server 140 exists and a network in which the client exists and is not the first network 100a, is performed. Interworking network (101).

The first network 100a may include a target server 140 and at least one proxy server 110a associated with the target server.

The second network 100c may include at least one client and GLB DNS 120c.

Here, the GLB DNS 120c analyzes traffic of a client destined for the target server 140 through the interworking network 101, and guides non-attack traffic to one of the at least one proxy server 110a when attack traffic occurs. can do.

In more detail, the GLB DNS 120c may serve as a domain name server in the network 100c to which the GLB DNS 120c belongs. The GLB DNS 120c may distinguish the attack traffic from the non-attack traffic by analyzing the traffic destined for the target server 140 from the network 100c to which the GLB DNS 120c belongs. For example, the GLB DNS 120c may determine traffic that directly specifies the IP of the target server 140 as attack traffic, and determine traffic that is a domain name of the target server 140 as non-attack traffic. can do. This is a common case of DDoS attacks, regardless of the user's intention of the client, by infecting the general user's PC through malware or e-mail, creating a large number of so-called zombie PCs, and then controlling the C & C (command control) server. This is because the IP is targeted to a specific time zone (the IP of the target server). That is, since traffic for DDoS attack of a zombie PC is composed of packets directly specifying the IP of the target server, non-attack traffic of a normal user may be composed of packets using the domain name of the target server 140. to be.

GLB DNS 120c may direct non-attack traffic to proxy server 110a of the network where the target server exists. Here, the proxy server 110a may be composed of one or a plurality of server groups, and the GLB DNS 120c may direct non-attack traffic to at least one 110a of one proxy server or a plurality of proxy servers. .

Here, GLB DNS is preferably installed in front of other domain name servers to function. This is because when the non-attack traffic directly specifies the target IP by the general domain name server, it is difficult to distinguish it from the attack traffic. Therefore, it is preferable that each network constitutes a group of dual domain name servers in which GLB DNS is installed at the front.

The proxy server 110a may direct the non-attack traffic directed from the GLB DNS to the target server 140. By the traffic guidance of the GLB DNS 120a and the proxy server 110a, it can be seen that the traffic of the normal user is logically connected through the virtual bypass network rather than the interworking network 101.

When the DDoS attack occurs, the interworking network 101 may inspect packets passing through the interworking network and block traffic destined for the IP of the target server 140. Therefore, the attack traffic may be blocked through the interworking network 101, but the non-attack traffic does not use the IP of the target server 140 as a destination but the IP of the proxy server 110a. It is not blocked by

Another embodiment of an attack traffic defense system will be described with reference to FIG. 1. This embodiment will be described based on each server.

This embodiment includes proxy servers 110a through 110d located in each of the plurality of networks and GLB DNSs 120a through 120d located in each of the plurality of networks.

The GLB DNS 120c may direct the non-attack traffic to the target server 140 to the first proxy server 110a. Here, the first proxy server 110a is in the same network as the target server 140. In one embodiment, GLB DNS 120c may direct the first proxy server to the non-attack traffic of at least one client belonging to the same network.

The proxy server 110a may direct the received traffic to the target server 140.

In one embodiment, the attack traffic defense system may further include an attack analyzer 130. The attack analysis device 130 may analyze the traffic to distinguish the attack traffic from the non-attack traffic, and provide information on the identified non-attack traffic to the GLB DNS 120a to 120d. The attack analysis device 130 may be installed in each or at least one of the plurality of networks 100a to 100d or may be installed in the companion network 101. The attack analysis device 130 may determine traffic that directly specifies the IP of the target server 140 as attack traffic, and determine traffic that is a domain name of the target server 140 as non-attack traffic.

In one embodiment, the attack traffic defense system may further comprise a control server (not shown). The control server may assign an IP of the target server 140 to at least one of GLB DNSs 120a through 120d, proxy servers 110a through 110d, and at least one network device installed in the plurality of networks 100a through 110d or 101. Can provide. Here, the control server may be provided with information on whether the DDoS attack has been initiated from the attack analysis device 130 and the IP of the target server, and may provide such information to GLB DNSs 120a to 120d. The control server may be installed in each or at least one of the plurality of networks 100a to 100d or may be installed in the interworking network 101. Here, the control server collects information about the attacking client generating the attack traffic (eg, the blacklisted IP including the attacking client's IP) and provides it to the control server, GLB DNSs or other network control equipment of another network. can do. The control server may provide a notification message to the attacking client that it is currently performing a DDoS attack.

FIG. 2 is a block diagram illustrating an attack traffic defense method for a distributed denial of service attack according to an embodiment of the disclosed technology, and FIG. 3 is a flowchart illustrating the attack traffic defense method of FIG. 2.

Referring to FIG. 2, the attack traffic defense method for the distributed denial of service attack may include (a) analyzing traffic to identify whether the distributed denial of service attack and a corresponding target server are performed, and (b) analyzing traffic to the target server. And distinguishing the attack traffic from the non-attack traffic, and (c) bypassing the non-attack traffic by using at least one proxy server located in the same network as the target server.

Referring to FIG. 3, the attack traffic defense method analyzes traffic (step S310), identifies whether a distributed denial of service attack (step S320, YES), and a corresponding target server (step S330). Thereafter, traffic for the target server is analyzed to distinguish attack traffic from non-attack traffic (step S340), and the non-attack traffic is bypassed using at least one proxy server located on the same network as the target server (step S350). .

In order to distinguish the attack traffic from the non-attack traffic (step S340), the attack traffic defense method may determine the traffic that directly specifies the IP of the target server as the attack traffic, and deny the traffic targeting the domain name of the target server. It can be determined by the attack traffic.

In order to bypass the non-attack traffic (step S350), the attack traffic defense method may direct the non-attack traffic to the at least one proxy server and provide the IP of the target server to the at least one proxy server. In more detail, since the non-attack traffic may be traffic targeting the domain name of the target server, the attack traffic defense method may replace the target server's IP to provide the IP of the proxy server associated with the target server. Accordingly, even if all the packets specifying the IP of the target server are blocked in the interlocked network, normal traffic does not correspond to this, and thus, the interworking network may be blocked. Since the proxy server must provide the received non-attack traffic to the target server, the attack traffic defense method can provide the proxy server with the IP of the target server.

In one embodiment, the attack traffic defense method may send a notification message to at least one client generating attack traffic. This can be done by analyzing the packet generating the attack traffic and confirming the originating IP. Through this, the attack client can inform the user if the attacking client is an infected zombie PC. Here, the notification message includes the fact that the client is performing a DDoS attack, information to confirm whether or not the zombie PC is applicable, how to delete malicious programs related to the zombie PC, information to prevent the zombie PC, etc. can do.

The attack traffic defense method described above with reference to FIGS. 2 and 3 may be implemented by the GLB DNS of FIG. 1 or by at least one of the GLB DNS, the attack analysis device, and the control server. This is because GLB DNS, attack analysis device, and control server can be logically distinguished, but can be implemented to operate as one server in implementation.

The disclosed technique may have the following effects. It is to be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, as it is not meant to imply that a particular embodiment should include all of the following effects or only the following effects.

The attack traffic defense system for the distributed denial of service attack according to an embodiment may normally operate the interworking network and the target server even if the DDoS attack is performed. This is because the attack traffic is divided and blocked at the interlocking network, so that the bandwidth of the interlocking network can be secured while the load on the target server can be eliminated.

In addition, the attack traffic defense system for a distributed denial of service attack according to an embodiment can ensure the access of the normal user while defending the DDoS attack. This is because it can identify non-attack traffic and provide a bypass network to the target server.

Although described above with reference to a preferred embodiment of the present application, those skilled in the art various modifications and changes to the present application without departing from the spirit and scope of the present application described in the claims below I can understand that you can.

Claims (14)

A first network comprising a target server and at least one proxy server associated with the target server;
A second network comprising at least one client and a Global Load Balancing (GLB) DNS; And
Including a interworking network for interworking between the first and second networks,
The GLB DNS analyzes the traffic destined for the target server through the interworking network, and directs non-attack traffic to one of the at least one proxy server when an attack traffic occurs, and the at least one proxy server is configured from the GLB DNS. And attack traffic defense system for distributed denial of service attacks, wherein the guided non-attack traffic is directed to the target server.
The method of claim 1, wherein the GLB DNS is
And a traffic that directly designates an Internet Protocol (IP) of the target server as the attack traffic.
The method of claim 1, wherein the GLB DNS is
Attack traffic defense system for a distributed denial of service attack, characterized in that for determining the traffic to the domain name of the target server as non-attack traffic.
delete The method of claim 1, wherein the interworking network is
If a DDoS attack occurs against the target server, the attack traffic defense system for a distributed denial of service attack, characterized in that to block the traffic corresponding to the IP of the target server.
In the attack traffic defense system for a plurality of networks and a coordinated network connecting the plurality of networks,
Proxy servers located in each of the plurality of networks;
GLB Domain Name Servers (DNS) located in each of the plurality of networks and directing non-attack traffic to a target server to at least one first proxy server located on the same network as the target server; And
And analyzing the traffic to classify the attack traffic and the non-attack traffic, and providing the GLB DNS with information about the identified non-attack traffic,
The at least one first proxy server directs the received traffic to the target server.
delete The method of claim 6, wherein the attack analysis device
It is determined that the traffic that directly specifies the IP of the target server as the attack traffic, and the attack traffic defense system for distributed denial of service attacks, characterized in that the traffic targeting the domain name of the target server is determined as non-attack traffic .
The system of claim 6, wherein the attack traffic defense system is
Distributed denial of service attack further comprising at least one control server for providing the IP of the target server to at least one of the GLB DNS, the proxy server, at least one network equipment installed in the plurality of networks Attack traffic defense system against.
10. The method of claim 9, wherein the at least one control server
The attack traffic defense system for distributed denial of service attacks, characterized in that for collecting the information about the client generating the attack traffic to the GLB DNS.
(a) analyzing the traffic to identify whether there is a distributed denial of service attack and a corresponding target server;
(b) analyzing traffic for the target server to differentiate attack traffic from non-attack traffic; And
(c) directing the non-attack traffic to at least one proxy server located in the same network as the target server; And
(d) providing the at least one proxy server with the IP of the target server.
The method of claim 11, wherein step (b)
(b-1) determining the traffic directly specifying the IP of the target server as the attack traffic; and
and (b-2) determining the traffic targeting the domain name of the target server as the non-attack traffic.
delete The method of claim 11, wherein the attack traffic defense method,
And transmitting a notification message to at least one client generating the attack traffic.

Images