KR101352553B1 - Method and System for DDoS Traffic Detection and Traffic Mitigation using Flow Statistic - Google Patents

Abstract

The present invention relates to a distributed denial of service attack (DDoS) detection and traffic mitigation method and system using the statistical information for each flow.
According to the present invention, the distributed denial of service attack detection and traffic reduction method using the statistical information for each flow, the first statistical information for each flow based on the flow information generated in accordance with the traffic movement of the device connecting the network, The data is aggregated for each flow and processed into second statistical information including at least one of a byte number, a packet number, and a flow number per unit time. And calculating the change rate of the second statistical information to determine a distributed denial of service attack when the change rate exceeds a preset threshold rate, and perform a rate-limit function to perform the rate limit function. Limit the amount of traffic moving.

Description

Distributed denial of service attack (DOS) detection and traffic mitigation method using flow-specific statistical information and method thereof {Method and System for DDoS Traffic Detection and Traffic Mitigation using Flow Statistic}

The present invention relates to a distributed denial of service attack (DDoS) detection and traffic mitigation method and system using the statistical information for each flow.

The present invention is derived from a study conducted as part of the IT growth engine business of the Ministry of Knowledge Economy. [Task management number: 2009-S-020-01, Title: Development of next generation wired / wireless convergence gateway technology]

In general, Distributed Denial Of Sevice (DDoS) allows a malicious attacker to send a large amount of data instantaneously to a target system, such as a web service providing server on the Internet, and to the network to which the system belongs. It means not working.

1 is a network diagram illustrating an example of a general distributed denial of service attack (DDoS).

The attack terminal 100 is infected with a malicious virus such as a zombie PC and generates a large amount of traffic to the target server 500. In general, the router 200 sends all incoming traffic to a network including the DDoS defense system 300, the IPS defense system 400, and the target server 500. At this time, various devices located behind the router 200 fail to properly perform their functions due to the influx of too much aggressive traffic and are unable to service traffic of a normal user due to a heavy down load. In addition, due to the large amount of aggressive traffic, there is a problem in that it is impossible to efficiently use expensive resources by increasing traffic throughout the network.

Traffic types for such attacks include TCP SYN Flooding, ICMP Flooding, and UDP Flooding.

The TCP SYN Flooding attack is an attack that sends out only SYN packets to the server, causing the server to make many TCP connections and exhaust the server's resources. Since this type of attack appears to be a normal flow of traffic, it is quite difficult to detect such an attack. Existing detection methods do not fully detect DDoS attacks, and recognize and respond to attacks only after many hours have elapsed.

On the other hand, the conventional attack detection method is a method of detecting at the source (attachment / side) side, a method of detection at the destination (destination / victim) side, a method of detecting in the core network. Typical technologies include pushback techniques and IP traceback techniques.

Among them, pushback technique detects attacks by observing packet drop statistics of individual routers on the network. Since DDoS attacks caused by attackers such as zombie PCs arrive at their destinations through various paths, a large amount of packet dropping occurs at routers near the destination where attack packets increase. That is, in this case, the router near the destination forwards the pushback message along the path from which the packet was sent, the other router that received the message blocks the delivery of that traffic, and continues forwarding the pushback message toward the path the packet came from. By doing so, you can block attack packets as a whole.

However, the existing pushback technique has a problem that it is difficult to adequately cope with the current DDoS attack trends that are performed on many zombie PCs. Because there are distributed attack PCs on the network, delivering pushback messages to all individual routers can be time-consuming and resource-intensive. Thus, a problem arises that the delivery of pushback messages results in loads on the network.

The IP traceback technique provides the target system administrator with the IP address of the actual attack source of the DDoS attack. IP traceback technique is mainly a packet-based marking methodology, a method of managing the forwarding path information of the source packet through modifications to protocols such as the Internet Control Message Protocol (ICMP) protocol, and management in terms of network structure It is divided into techniques using protocols. In addition, according to the response method to the attack, it is divided into a forward and backward tracking technology.

However, the IP traceback technique has a lot of problems in finding the source IP address in the situation of the current multi-level attack form. In addition, backtracking requires a lot of memory in the router, and since the router must process a large amount of information, it causes a lot of negative effects on the performance of the router. And, there is a disadvantage that a lot of time passes to block the actual traffic.

As such, the existing DDoS detection methods take a lot of time and resources to determine whether the DDoS attack, and there is a problem that can not protect the target server from a large amount of attack traffic. Therefore, there is an urgent need for a method to quickly determine and cope with DDoS attacks or abnormal traffic generation.

Accordingly, an object of the present invention is to provide a method and system for quickly detecting a distributed denial of service attack (DDoS) using traffic statistics and reducing traffic accordingly.

In order to solve the above technical problem, a distributed denial of service attack detection and traffic reduction method using statistical information for each flow according to an embodiment of the present invention,

a) collecting first statistical information for each flow based on flow information generated according to the movement of traffic of a device connecting a network; b) grouping the first statistical information for each flow by flow and classifying the flow into second statistical information including at least one of a predetermined number of bytes per unit time, a packet number, and a flow number; c) calculating a change rate of the second statistical information and determining that the change rate is a distributed denial of service attack when the change rate exceeds a preset threshold rate; And d) performing a rate limit function according to the determination to limit the amount of movement of the traffic according to a preset policy.

Here, the step d) may further include reporting the distributed denial of service attack event to a policy management server managing a network policy according to the determination.

On the other hand, the distributed denial of service attack detection and traffic reduction system using the statistical information for each flow according to an embodiment of the present invention,

A flow statistics information collecting unit for collecting first statistical information for each flow based on flow information generated according to traffic movement of a device connecting a network; A statistical information processing unit which aggregates the first statistical information for each flow and divides each flow into second statistical information including at least one of a predetermined number of bytes per unit time, a packet number, and a flow number; A determination unit calculating a change rate of the second statistical information and determining that the change rate exceeds a preset threshold rate as a distributed denial of service attack; And a controller configured to limit the amount of movement of the traffic according to a preset policy by performing a rate limit function according to the determination.

The packet forwarding processor retrieves a packet received at a line card interface of a router system from a routing table, delivers the packet to a corresponding node, and generates a packet of flow information divided into a plurality of tuples. ; And a database in which a statistical information table having the routing table and the second statistical information is stored.

According to the present invention, according to the present invention, the DDoS suspicious traffic is checked in real time by using the statistical information for each flow in individual routers on the network, and it is quickly reported to the policy management server managing the network, so that the policy management server can quickly generate DDoS. This has the effect of enabling correspondence.

In addition, even in the absence of a policy server, it can be expected to reduce or block a large amount of inflow traffic of its own so that various equipment in the network can be continuously serviced.

1 is a network diagram illustrating an example of a general distributed denial of service attack (DDoS).
2 is a block diagram schematically illustrating a router having a DDoS detection and traffic reduction system using statistical information for each flow according to an embodiment of the present invention.
3 is a flowchart illustrating a DDoS detection and traffic reduction method using statistical information for each flow according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

Now, a distributed denial of service attack (DDoS) detection and traffic reduction method using the statistical information for each flow according to an embodiment of the present invention and a system thereof will be described in detail with reference to the accompanying drawings.

The present invention performs a rapid detection of DDoS attack using the rate of change of statistical information per unit time using the statistical information for each flow in the flow-based router. When DDoS attack is detected, it can report to the network policy server (not shown) to reduce the inflow of traffic to prevent the depletion of network resources, and set the rate-limit function on the inflow traffic for quick response. To reduce traffic volume.

Referring to a network configuration illustrating an example of a distributed denial of service attack (DDoS) of FIG. 1, the attack terminals 100 are source nodes connected to a zombie PC infected with a malicious virus through a wired or wireless Internet. The target server 500 is a server of an operator that provides various services according to access of a source node.

Here, the distributed denial of service attack (DDoS) detection and traffic reduction system using statistical information for each flow according to an embodiment of the present invention may be applied to the router 200.

That is, the router 200 of FIG. 1 is equipped with a DDoS detection and traffic reduction system according to an embodiment of the present invention to quickly detect attack traffic when a DDoS attack occurs, and report to a network policy server. In addition, it is possible to protect various devices (eg, 300, 400, 500) in the network by reducing the traffic volume through a rate-limit function on the detected traffic.

Hereinafter, in the embodiment of the present invention, a DDoS detection and traffic reduction system is described as being mounted in the router 200 for convenience. However, the DDoS detection and traffic reduction system is not limited to being applied to the router 200 and may be configured as a separate independent device and interworked with the router as well as other network devices capable of traffic management or applied to the system.

On the other hand, Figure 2 is a block diagram schematically showing a router having a DDoS detection and traffic reduction system using the flow-specific statistical information according to an embodiment of the present invention.

Referring to FIG. 2, the router 200 according to an embodiment of the present invention may include a packet forwarding processor 210, a flow statistics information collector 220, a statistics information processor 230, and a database ( 240, the DDoS determination unit 250 and the control unit 260.

The packet forwarding processor 210 looks up the packet received at the interface of the line card of the router system in the routing table stored in the database 240 and delivers the packet to the corresponding destination. In addition, the packet forwarding processor 210 processes (generates) a packet based on a flow divided into five tuples (5-tuples). In addition, the first packet, the middle n-th packet, and the flow end packet are transmitted to the flow statistics information collecting unit 220 for each flow.

Here, the flow includes five tuples (5-tuple) such as a source address, a destination address, a source port, a destination port, and a protocol ID, which are header information of an IP packet. Means that packets with the same information are collected and configured.

The packet forwarding processor 210 may configure the above-described five tuples by collecting only the same packets, and only some of the five tuples may configure the same packet. For example, the flow may be configured by collecting only packets having the same source address, destination address, source port, destination port, and protocol ID, or collecting only packets having the same source address and destination address. In addition, depending on the purpose of use, additional items may be added or the flow may be configured using only some of the five tuples.

The flow statistics information collecting unit 220 receives each packet from the packet forwarding processing unit 210, and provides statistical information for each flow such as the number of bytes processed, the number of packets, and the number of blocked packets. 1 called statistical information).

The statistical information processing unit 230 divides the first statistical information for each flow collected by the flow statistical information collecting unit 220 by a set of a source address, a destination address, a source-destination address, a protocol, and the like, and outputs a predetermined byte per unit time. Processed into statistical information (hereinafter referred to as second statistical information) including the number, the number of packets, and the number of flows. The statistical information processing unit 230 stores the processed second statistical information in the statistical information table of the database 240.

The database 240 has various data and programs for detecting a distributed denial of service attack (DDoS) using traffic statistics and traffic reduction, and stores data generated according to the operation.

The DDoS determination unit 250 calculates a change rate of the second statistical information per unit time stored in the statistical information table at regular intervals, and when the change rate is changed beyond a preset threshold rate, determines that the DDoS attack is a control unit 260. Informed by That is, the DDoS determination unit 250 periodically reads the second statistical information from the statistical information table for DDoS determination at regular intervals and periodically calculates the rate of change of the second statistical information between the previous (previous) period and the current period, and based on this. If the ratio changes above a certain level, it is determined as a DDoS attack.

 At this time, the DDoS determination unit 250 may set the threshold ratio in a plurality of stages, and abnormal traffic, DDoS attack suspicion, and DDoS attack according to a range in which the change ratio of the second statistical information exceeds a preset threshold ratio in stages. You can judge by.

In addition, the DDoS determination unit 250 checks the number of packets (eg, pps (Packet per Second)) that have passed per unit time, and if a packet is generated that is higher than an appropriate level that may occur in one source node (PC), the DDoS attack is performed. You can also judge. Here, the packet above the appropriate level may be a packet generation threshold allowed for one source node per unit time according to a policy, and may be confirmed based on the number of unit time packets of a source address or a source port.

In addition, the DDoS determination unit 250 may determine whether the DDoS attack in various combinations according to the location of the router 200 on the network by processing the information by source address, destination address, source-destination address, protocol set.

For example, in the case of the router 200 in FIG. 1, when processing and confirming flow information for each source address, a zombie PC performing a DDoS attack can be easily identified. In addition, when processing and confirming flow information for each destination address, a server that is a target of DDoS attack may be identified.

The control unit 260 serves to control the operation of each unit in the router for detecting a distributed denial of service attack (DDoS) using traffic information and flow reduction.

When the control unit 260 receives the DDoS attack occurrence event according to the determination of the DDoS determination unit 250, the control unit 260 sends suspicious traffic information to the network policy management server that manages the network policy and notifies the occurrence of abnormal traffic in the network. You can check the attack pattern.

In particular, even if the controller 260 does not have a network policy management server or has a policy management server, when a rapid response for DDoS attack and abnormal traffic is required, the controller 260 may reduce the traffic rate for the corresponding traffic in the router 200. It can control to perform the limit-limit function to apply and report the traffic movement limit. In this case, the restriction application includes all functions of reducing a large amount of traffic or blocking traffic of a source node suspected of being a zombie PC.

As such, the router 200 according to an embodiment of the present invention has the advantage of detecting abnormal traffic very quickly by periodically checking and processing the real-time information collected therein to detect whether the traffic is DDoS. In addition, the event information on the occurrence of the detected traffic anomaly can be quickly reported to an external network policy management server, or a rate limit function can be performed on the abnormal traffic detected by the router 200 in order to deal with the traffic more quickly. By applying restrictions, there is an advantage that can proactively cope with DDoS attacks.

The DDoS detection and traffic reduction system according to an embodiment of the present invention is applicable to all routers 200 on the network including the core network, and in this case, the individual router 200 blocks the attack traffic quickly and reports the network quickly. It is effective to use the whole resource efficiently.

Meanwhile, a method of performing DDoS detection and traffic reduction using the flow-specific statistical information by the router 200 according to the embodiment of the present invention described so far through FIG. 3 will be described.

3 is a flowchart illustrating a DDoS detection and traffic reduction method using statistical information for each flow according to an embodiment of the present invention.

Referring to FIG. 3, the packet forwarding processor 210 of the router 200 equipped with the system according to an embodiment of the present invention monitors traffic passing through the router 200, and transmits five tuples 5 of packets. Flow information is generated by processing based on a flow divided by -tuple (S301).

The router 200 collects first statistical information for each flow, such as the number of flows, the number of bytes, and the number of packets, based on the generated flow information (S302). The collected first statistical information for each flow is divided into source addresses, destination addresses, source-destination addresses, and protocol sets, respectively, and processed into second statistical information including bytes, packets, and flows per unit time. It stores in the statistical information table (S303).

The router 200 checks the rate of change of the second statistical information per unit time stored in the statistical information table at regular intervals (S304), and determines that the change rate exceeds the preset threshold rate as a DDoS attack (S305). .

The router 200 reports the occurrence of the DDoS attack to the policy management server according to a preset policy or determines whether to perform a rate limit function (S306). The router 200 reports the DDoS attack occurrence event to the policy management server managing the network policy according to the determination (S307), or performs a rate limit function for itself to reduce traffic (S308). In this case, in some cases, the policy management server may perform a rate limit function in order to reduce traffic by itself.

According to the embodiment of the present invention, the DDoS suspicious traffic is checked in real time by using the statistical information for each flow in individual routers on the network, and quickly reported to the policy management server managing the network, so that the policy management server can quickly generate DDoS. This has the effect of enabling correspondence.

In addition, even in the absence of a policy server, it can be expected to reduce or block a large amount of inflow traffic of its own to enable continuous service of various equipment in the network.

In addition, in the related art, when the DDoS occurs, the web server and the service server may not operate normally due to too slow response, which may cause enormous loss and loss of corporate image. However, according to the exemplary embodiment of the present invention, a large amount of attack traffic is easily recognized from the router 200 stage, and a quick response thereto enables an uninterrupted service of the target server.

In addition, the conventional pushback scheme has a load for transmitting a pushback message to the previous router, but according to an embodiment of the present invention, the individual router 200 determines whether the DDoS and traffic abnormality, respectively, and transmits the pushback message. It has the advantage of not generating the same load.

In addition, while the conventional IP traceback technique requires a lot of memory and processing capability, according to an embodiment of the present invention, a relatively small amount of memory is required than the IP traceback scheme by managing only statistical information for each set by a set. Therefore, there is an advantage that the processing power is also required small.

In addition, the core of the DDoS attack is the rapid attack judgment and countermeasures, while conventional DDoS detection equipment takes a lot of time to determine whether the DDoS attack, and the web server and service server, such as a large amount of attack traffic There was a problem of not functioning.

In order to solve this problem, according to an embodiment of the present invention, by detecting a rapid DDoS occurrence in each router on the network, and according to the determination to report an immediate DDoS occurrence event or to reduce the traffic to prevent the worst situation such as server down You can expect the effect.

The embodiments of the present invention are not limited to the above-described apparatuses and / or methods, but may be implemented through a program for realizing functions corresponding to the configuration of the embodiment of the present invention, a recording medium on which the program is recorded And such an embodiment can be easily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (10)

In the distributed denial of service attack detection and traffic mitigation method using flow-specific statistical information,
a) collecting first statistical information for each flow based on flow information generated according to the movement of traffic of a device connecting a network;
b) grouping the first statistical information for each flow by flow and classifying the flow into second statistical information including at least one of a predetermined number of bytes per unit time, a packet number, and a flow number;
c) calculating a rate of change of the second statistical information, and determining that the rate of change of the second statistical information is a distributed denial of service attack when the calculated rate of change exceeds the threshold rate set for the unit time; And
d) performing a rate limit function according to the determination to restrict and apply the amount of movement of the traffic according to a preset policy;
Distributed denial of service attack detection and traffic mitigation method comprising a. The method of claim 1,
The step d)
And reporting the distributed denial of service attack event to a policy management server managing a network policy according to the determination. The method of claim 1,
The first statistical information for each flow,
Distributed denial of service attack detection and traffic mitigation method comprising at least one of the number of flows, bytes, and packets processed periodically. The method of claim 1,
The step b)
And aggregating the first statistical information for each flow into at least one of a source address, a destination address, a source-destination address, and a protocol. The method of claim 1,
The step c)
And determining the number of packets that have passed per unit time and determining that the distributed denial of service attack occurs when a packet exceeding a threshold that can occur at one source node is determined as the distributed denial of service attack. The method of claim 1,
Applying the limitation of step d) above,
And reducing the traffic movement amount or blocking traffic of a source node suspected of the distributed denial of service attack. A flow statistics information collecting unit for collecting first statistical information for each flow based on flow information generated according to traffic movement of a device connecting a network;
A statistical information processing unit which aggregates the first statistical information for each flow and divides each flow into second statistical information including at least one of a predetermined number of bytes per unit time, a packet number, and a flow number;
A determination unit configured to calculate a change rate of the second statistical information and determine that the distributed change denial of service attack occurs when the calculated change rate exceeds a threshold rate set for the unit time; And
The controller performs a rate limit function according to the determination to limit the amount of traffic movement according to a preset policy.
Distributed denial of service attack detection and traffic system comprising a. The method of claim 7, wherein
A packet forwarding processing unit which searches for a packet received at an interface of a line card of a router system in a routing table, transfers the packet to a corresponding destination node, and generates flow information divided into a plurality of tuples; And
A database storing a statistical information table having the routing table and the second statistical information
Distributed denial of service attack detection and traffic system further comprising. The method of claim 7, wherein
The control unit,
Report the distributed denial of service attack event to a policy management server managing network policy according to the determination, and reduce the traffic movement or block traffic of the source node suspected of the distributed denial of service attack. Distributed Denial of Service Attack Detection and Traffic Systems. The method of claim 7, wherein
The determination unit,
The threshold ratio may be set in a plurality of stages to determine one of an abnormal traffic, a distributed denial of service attack, and a distributed denial of service attack according to a range in which the change rate of the second statistical information exceeds a predetermined threshold ratio. Distributed denial of service attack detection and traffic systems.

Images