KR101380015B1 - Collaborative Protection Method and Apparatus for Distributed Denial of Service - Google Patents

Abstract

Provided are a cooperative defense method and apparatus for distributed service denial attack. The collaborative defense method for a distributed denial of service attack performed by a network device includes detecting data suspected of the distributed service denial of attack by monitoring traffic forwarded to a service server; And informing the security device that the detected data is suspected of a distributed service denial attack, and receiving a result of the analysis of the detected data from the security device and controlling traffic according to the result of the analysis. And performing at least one of a second operation of controlling traffic according to a predetermined rule before performing the operation.

Description

Collaborative Defense Method and Apparatus for Distributed Denial of Service Attack {Collaborative Protection Method and Apparatus for Distributed Denial of Service}

The present invention relates to a defense system that supports an active and effective defense against distributed denial of service (DDoS) attacks in which a plurality of distributed attackers simultaneously cause a service failure to one service provider.

The present invention is derived from the research conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy and the Ministry of Information and Telecommunication Research and Development. [Task management number: 2007-S-013-03, Task name: All IPv6-based Fixed-Mobile Convergence Networking technology development].

Distributed Denial of Service (DDoS) attacks are a type of attack pattern in which multiple attackers attack a service provider and cause a service failure. In the case of DDoS attacks, the security equipment performs all defense operations such as attack pattern analysis, attack determination, and attack data control on all data. Security equipment is the equipment responsible for the security of the service provider. Network equipment such as routers transmit all incoming data to security equipment.

Such a defense system causes an increase in load because security devices perform defense actions such as analysis, judgment, and control on all data. Increasing load not only increases the error rate of defensive actions, but also reduces the quality of service provided by normal data passing through security equipment. This results in a successful DDoS attack.

Accordingly, an object of the present invention for solving the above problems is to determine the attack from the outside by the collaborative defense system of the network equipment and the security equipment, by minimizing the load of the security equipment by responding to the determined attack In addition, the present invention provides a collaborative defense method and apparatus for denied distributed service attack that can establish a more effective defense system.

According to an embodiment of the present invention, a collaborative defense method for a distributed denial of service attack performed by a network device, the distributed service rejection attack through monitoring of traffic forwarded to a service server Detecting suspected data; Notifying the security device that the detected data is data suspected of the distributed service denial of attack; 'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' And performing at least one of the second operations'.

The detecting may include: checking a generation pattern of the input data based on flow information of the input data; Judging whether the occurrence pattern of the input data corresponds to an attack pattern registered in the network device; And if the occurrence pattern of the input data corresponds to an attack pattern registered in the network device, determining the input data as data suspected of the distributed service denial attack.

The occurrence pattern of the input data may be determined based on at least one of the amount of data input per unit time, whether or not the data having the same size is repeatedly generated, or whether the data is repeatedly generated for a specific function.

The informing may include indicating that the detected data is abnormal symptom data in a manner promised between the network device and a security device; And forwarding the data indicated by the abnormal symptom data to the security equipment.

The notifying may include providing flow information of the detected data, wherein the flow information includes at least one of a source address, a destination address, and a port number; And forwarding the detected data to the security equipment.

The analysis result of the detected data may include information on the attack pattern of the detected data and information on the defense operation to be performed by the network device.

The information on the defensive operation and the predetermined rule each include at least one of a bandwidth limit for the traffic, a dropping of the traffic, and a dropping probability for the traffic. can do.

The first operation may include registering an attack pattern included in the analysis result when the analysis result is an attack pattern of the distributed service denial attack; And blocking a distributed service denial attack of the traffic according to the defense against the traffic included in the analysis result.

The blocking of the distributed service denial attack of the traffic may include registering a defensive operation for the traffic included in the analysis result; And transmitting information on the defensive operation to a network control system so as to block a distributed service denial attack of the traffic at a network entry point device.

On the other hand, in a collaborative defense method for a distributed denial of service attack performed by a security device according to another embodiment of the present invention, a network device that monitors traffic forwarded to a service server Receiving data from; Checking whether the data is data suspected of the distributed service denial attack based on the flow information of the data provided from the network device or the marking information displayed on the data; If the data is suspected of being a distributed service denial attack, precisely analyzing the data to determine whether the distributed service denial attack is performed; And transmitting the precise analysis result of the data to the network device.

The result of the detailed analysis of the data may include information about an attack pattern on the data and information about a defense operation to be performed by the network device.

Meanwhile, according to another embodiment of the present invention, a network device for collaborative defense against a distributed denial of service attack may be suspected of the distributed service denial attack through monitoring of traffic forwarded to a service server. A data monitoring unit detecting data to be read; A communication unit for notifying a security device that the detected data is data suspected of the distributed service rejection attack; And 'a first operation of receiving an analysis result of the detected data from the security device and controlling the traffic according to the analysis result', or 'controlling the traffic according to a preset rule before performing the first operation'. And a controller for performing at least one of the second operations.

The data monitoring unit checks the occurrence pattern of the input data based on flow information of the input data, and determines whether the identified occurrence pattern corresponds to an attack pattern registered in the network device. A pattern determination unit; And a suspicious data determination unit configured to determine the input data as data suspected of the distributed service denial attack when the occurrence pattern of the input data corresponds to an attack pattern registered in the network device.

And an identification display unit indicating that the detected data is abnormal symptom data in a manner promised between the network device and the security equipment, wherein the communication unit forwards the data indicated by the abnormal symptom data to the security equipment. can do.

 The communication unit may transmit the flow information of the detected data, the flow information including at least one of a source address, a destination address, and a port number, and the detected data to the security device.

The controller registers an attack pattern included in the analysis result when the analysis result is an attack pattern of the distributed service denial of attack, and rejects the distributed service of the traffic according to a defense against the traffic included in the analysis result. By blocking an attack, the first operation can be performed.

The apparatus may further include a defensive operation register configured to register a defensive operation for the traffic included in the analysis result.

The control unit may request the network device to transmit the information on the defensive operation to the network control system so as to block the distributed service denial attack of the traffic at the network entry point device.

On the other hand, according to another embodiment of the present invention, the security equipment for the collaborative defense against distributed denial of service attacks, the flow information of the data provided from the network device or the marking information displayed on the data A data checking unit for checking whether the data is data suspected of the distributed service denial attack; And a determination unit determining whether the distributed service denial of attack is by analyzing the data precisely when the data is suspected of the distributed denial of service attack. And a communication unit configured to receive the data from the network device that monitors the traffic forwarded to the service server and to transmit a precise analysis result of the data to the network device.

According to an embodiment of the present invention, the network device detects the abnormal symptom data and transmits it to the security equipment, and the security equipment precisely analyzes the abnormal symptom data detected by the network apparatus to recognize the attack pattern, thereby reducing the load of the security equipment. Can be reduced. In addition, by setting the attack pattern detected by the security equipment to the network device, the network device can primarily block the attack data while maintaining the original function.

In addition, according to the present invention, it is possible to actively cope with a distributed service denial attack through collaboration with security equipment and network equipment.

In addition, the collaborative defense system reduces the burden of security equipment to reduce the false positive rate of attack, and respond to the attack more quickly, it is possible to establish an active defense system.

1 is a diagram illustrating a network system for collaborative defense against Distributed Denial of Service (DDoS) attacks according to an embodiment of the present invention.
2 is a block diagram illustrating a network device according to an embodiment of the present invention.
3 is a diagram illustrating an example of performing marking to identify suspected data in detected data.
4 is a block diagram illustrating security equipment for collaborative defense against DDoS attacks in accordance with one embodiment of the present invention.
5 is a diagram illustrating a part of a network system for collaborative defense against a DDoS attack according to another embodiment of the present invention.
6 is a flowchart illustrating a method of setting an attack pattern and a rule for defense, which is performed by a network device according to an embodiment of the present invention.
7 and 8 are flowcharts illustrating a collaborative defense method for a DDoS attack, which is performed by a network device according to an embodiment of the present invention.
9 is a flowchart illustrating a collaborative defense method for a DDoS attack, which is performed by a security device according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a network system for collaborative defense against Distributed Denial of Service (DDoS) attacks according to an embodiment of the present invention.

Referring to FIG. 1, a network system may include a network control system 100, a network device 200, a security device 300, and a service server 400.

The network control system 100 is a server that manages and controls the network device 200.

The network device 200 may forward data input from the external devices 10, 20, and 30 to the security device 300, for example, a router. In addition, the network device 200 may primarily defend a DDoS attack based on cooperation with the security device 300. DDoS attacks are attacks in which multiple attackers are distributed and simultaneously cause service interruption. Multiple attackers may originate from at least one of the external devices 10, 20, 30 shown in FIG. 1.

The security device 300 is a device that is responsible for the security of the service server 400, and may secondarily defend a DDoS attack based on cooperation with the network device 200. For example, the security device 300 may detect an attack pattern by precisely analyzing data provided with flow information from the network device 200 or data in which a marking is added to a packet. If it is determined that the data for the attack, the security device 300 may request the network device 200 to perform a defensive operation. Examples of the security equipment 300 include an intrusion detection system (IDS), an intrusion prevention system (IPS), or a firewall.

The service server 400 is a service provider that provides a service to a plurality of users connected through a network.

2 is a block diagram illustrating a network device 200 according to an embodiment of the present invention.

Referring to FIG. 2, the network device 200 may include a first communication unit 210, an attack pattern registration unit 220, a defense operation registration unit 230, a data monitoring unit 240, an identification display unit 250, and a first control unit ( 260).

The first communication unit 210 communicates with a plurality of external devices 10, 20, 30, the network control system 100, and the security equipment 300. The first communication unit 210 may communicate in a wired or wireless manner. The plurality of external devices 10, 20, 30 may be terminals for receiving a service from the service server 400 or zombie terminals for attacking the service server 400.

For example, the first communication unit 210 may transfer data input from the plurality of external devices 10, 20, 30 to the data monitoring unit 240. In addition, the first communication unit 210 may inform the security device 300 that the data detected by the data monitoring unit 240 is suspect data suspected of a DDoS attack. The first communication unit 210 may receive an analysis result of the detected suspicious data from the security device 300.

The attack pattern register 220 may register an attack pattern set by an administrator. For example, an attack pattern includes a volume attack in which data having the same size is continuously repeated, and an attack in which data that is difficult to occur repeatedly, such as Internet Control Message Protocol (ICMP) and Hypertext Transfer Protocol (HTTP) GET, is repeated. This is only an example and is not limited thereto. In addition, an attack pattern analyzed by the security device 300 may be registered in the attack pattern register 220.

When the data suspected of an attack is detected from the external devices 10, 20, and 30, the defense operation registration unit 230 presets a rule to be used for the second operation to be described later. The preset rule may include at least one of a bandwidth limit for traffic, a complete dropping of traffic, and a dropping probability for traffic. In addition, the defense action register 230 may register the defense action for traffic included in the analysis result. The defense operation included in the analysis result is a defense method applied to the first operation to be described later.

If data suspected of an attack is detected from the new traffic, the predetermined rule and the registered defense action may be used when defending the attack data using the second action. In addition, the rule or defense action may be set or registered for each attack pattern.

The data monitoring unit 240 may detect data suspected of a DDoS attack through monitoring the traffic forwarded to the service server 400. To this end, the data monitoring unit 240 may include a pattern determination unit 241 and the suspicious data determination unit 243.

The pattern determination unit 241 checks the occurrence pattern of the input data based on the flow information of the data input from the external devices 10, 20, 30, and the confirmed occurrence pattern is the attack pattern registration unit ( It may be determined whether it corresponds to the attack pattern registered at 220.

The generation pattern of the input data may be determined based on at least one of the amount of data input per unit time, whether the data having the same size is repeated, or whether the data is repeatedly generated for a specific function.

The suspicious data determiner 243 may determine the input data as suspicious data suspected of a DDoS attack when the occurrence pattern of the input data corresponds to the attack pattern registered in the attack pattern register 220. Thus, suspicious data is detected.

The identification display unit 250 may indicate that the detected data is suspicious data, that is, abnormal symptom data, according to a method promised between the network device 200 and the security device 300. The identification display unit 250 may perform a corresponding operation when the identification display mode is set in the network device 200.

3 is a diagram illustrating an example of performing marking to identify suspected data in detected data. Referring to FIG. 3, the detected data includes data and an IP header. The identification display unit 250 may add an identification header to the packet of data to indicate that the detected data is suspect data. Alternatively, the identification display unit 250 may mark the detected data with an identifier indicating that it is suspect data instead of adding the identification header.

The detected suspicious data may be notified to the security equipment 300 in at least one of two ways. This is to allow the security device 300 to easily identify the data to be analyzed in more detail.

First, when suspicious data is detected by the data monitoring unit 240, when the identification display mode is set, the first controller 260 controls the identification display unit 250 to indicate that the suspect data is displayed and secures the displayed suspect data. The first communication unit 210 may be controlled to transmit the equipment 300.

Alternatively, when the identification display mode is turned off, the first controller 260 may control the first communication unit 210 to transfer the flow information of the detected suspicious data and the detected suspicious data to the security device 300. Can be. The flow information may include at least one of a source address, a destination address, and a port number of the suspicious data. The source address may be an address of the external device 10 and the destination address may be an address of the service server 400.

By the above-described method, the first communication unit 210 may forward the suspect data or the flow information of the suspect data indicated by the abnormal symptom data to the security device 300. In addition, the first communication unit 210 receives the analysis result for the suspicious data from the security equipment 300 and transmits to the first control unit 260.

The first control unit 260 controls the traffic according to the analysis result of the suspicious data provided from the security device 300, or the second operation of controlling the traffic according to a predetermined rule before performing the first operation. At least one of the following may be performed.

The case of performing the first operation will be described first.

The analysis result of the suspicious data provided from the security device 300 may include information on the attack pattern of the detected suspicious data and information on the defensive operation to be performed by the network device 200. The information on the defensive operation included may include at least one of bandwidth limit for traffic, complete dropping of traffic, and dropping probability for traffic.

When the attack pattern included in the analysis result is the attack pattern of the DDoS attack, the first control unit 260 may block the DDoS attack of the traffic according to the defensive operation for the traffic included in the analysis result. In addition, the first controller 260 may register the attack pattern included in the analysis result in the attack pattern registration unit 220, and register the defense operation for traffic included in the analysis result in the defense operation registration unit 230.

A case of performing the second operation is as follows. When suspicious data is detected, the first controller 260 may control traffic by using at least one of rules preset in the defense operation register 230. That is, the first controller 260 may defend the attack by the suspicious data by using at least one of the rules preset in the defense operation register 230.

When the analysis result is received from the security device 300 while the first control unit 260 performs the second operation, the first control unit 260 defends the attack by the suspicious data according to the defense operation included in the analysis result. can do.

4 is a block diagram illustrating a security device 300 for collaborative defense against a DDoS attack in accordance with one embodiment of the present invention.

The security device 300 illustrated in FIG. 4 may receive the detected suspicious data from the network device 200, and may transmit a result of analyzing the suspicious data to the network device 200. To this end, the security equipment 300 may include a second communication unit 310, a data checking unit 320, a determination unit 330, and a second control unit 340.

The second communication unit 310 may receive data from the network device 200 and transmit a precise analysis result of the data to the network device 200. The network device 200 is a device that monitors traffic forwarded to the service server 400.

The data checking unit 320 may check whether the data is suspect data suspected of a DDoS attack, based on the flow information of the data received from the network device 200 or the marking information displayed on the data. For example, if the identification header as shown in FIG. 3 is added to the packet of the received data, the data checking unit 320 may determine the data provided from the network device 200 as suspect data.

If the received data is suspicious data suspected of being a DDoS attack, the determination unit 330 may accurately analyze the suspicious data to determine whether it is a DDoS attack, and extract an attack pattern. In the past, precision analysis was performed by checking signatures stored for each flow of received data. However, the determination unit 330 may check the signature only on the suspicious data and perform precise analysis.

The second control unit 340 may include information on the defense operation against the attack pattern of the suspicious data in the precise analysis result. Therefore, the detailed analysis result may include information about the attack pattern of the suspicious data and information about the defense operation to be performed by the network device 200. The second controller 340 controls the second communication unit 310 to transmit the precise analysis result to the network device 200.

In addition, if it is determined that the data received by the determination unit 330 is not suspicious data, the second control unit 340 may stop the operation of indicating that the network device 200 indicates suspicious data and request to transmit the data. . This is because the traffic expected to be an abnormal symptom traffic was determined to be a normal service.

The security device 300 may transmit the analysis result to the network device 200 using a data channel or a management channel. When using the data channel, the network device 200 may recognize the analysis result transmitted as the attack pattern. Therefore, in order to prevent this, the security device 300 may request the network device 200 to preset that the analysis result is allowed data.

FIG. 5 is a diagram illustrating a part of a network system for collaborative defense against a distributed denial of service attack according to another embodiment of the present invention.

Referring to FIG. 5, the network system may include the security device 300 and the service server 400 illustrated in FIG. 1, the network control system 510, the first network device 520, and the second network device 530. It may further include.

When at least one of the external devices 10, 20, 30 performs an attack on the service server 400, the first network device 520 transmits data to the second network device 530. The second network device 530 monitors traffic of the transmitted data and detects data suspected of a DDoS attack, that is, suspect data. The second network device 530 displays the detected suspicious data in a predetermined manner with the security device 300, and transmits the suspicious data to the security device 300.

The security device 300 precisely analyzes the suspicious data to determine the attack pattern, and transmits an analysis result including the information on the defense operation to the second network device 530. At this time, the security device 300 requests the second network device 530 to block a DDoS attack of traffic at the network entry point device. As a result, the second network device 530 transmits information on the defensive operation included in the received analysis result to the network control system 510, and the network control system 510 uses the information on the defensive operation to perform an attack. The first network device 520 may be controlled to block.

6 is a flowchart illustrating a method of setting an attack pattern and a rule for defense, which is performed by a network device according to an embodiment of the present invention.

The method of FIG. 6 may be performed by the network devices 200 and 530 described with reference to FIG. 1 or 5.

In operation 610, the network device may register an attack pattern and a permission pattern input by an administrator. The attack pattern is an attack pattern of data input from external devices, and the allow pattern is a pattern for determining that the input data is not attack data.

In operation 620, the network device may set a rule that may be used to defend data suspected of an attack input from external devices. The preset rule may include at least one of a bandwidth limit for traffic, a complete dropping of traffic, and a dropping probability for traffic.

7 and 8 are flowcharts illustrating a collaborative defense method for a distributed denial of service attack performed by a network device according to an embodiment of the present invention.

The method of FIGS. 7 and 8 may be performed by the network devices 200 and 530 described with reference to FIG. 1 or 5.

In operation 705, the network device may monitor traffic of data forwarded from the external devices to the service server and check a generation pattern of the input data based on the flow information of the input data.

In operation 710, the network device may determine whether the identified occurrence pattern corresponds to an attack pattern registered in the attack pattern register.

In operation 715, if the confirmed occurrence pattern is an attack pattern registered in the attack pattern register, the network device may determine the input data as suspect data suspected of a DDoS attack. The generation pattern of the input data may be determined based on at least one of the amount of data input per unit time, whether the data having the same size is repeated, or whether the data is repeatedly generated for a specific function.

If the identification display mode is set in the network device in operation 720, in operation 725, the network device may display an identifier indicating the abnormality indication data on the detected data. For example, the network device may add a header or use marking.

In operation 730, the network device may transmit suspicious data marked with an identifier to the security device.

On the other hand, if the identification display mode is not set, in step 735, the network device may transmit the suspicious data and the flow information of the suspicious data to the security equipment. The flow information may include at least one of a source address, a destination address, and a port number of the suspicious data.

If a predetermined rule exists in the network device in operation 740, the network device may defend against the attack according to the predetermined rule in operation 745. That is, the network device may control traffic using a predetermined rule.

In operation 750, when the analysis result is received from the security device while performing operation 745, in operation 755, the network device determines whether the predetermined rule and the information on the defensive operation included in the analysis result are the same.

If the same, the network device maintains step 745.

If not the same, the network device performs step 765, which will be described later.

In operation 760, the network device may receive an analysis result from the security device and register the attack pattern included in the analysis result in the network device.

In operation 765, the network device may defend against an attack by traffic using a defense action included in the analysis result, and register the defense action in the network device.

In operation 710, if the identified occurrence pattern is not registered in the attack pattern register, the network device performs operation 810.

Referring to FIG. 8, in step 810, the network device transmits input data to a security device.

In operation 820, the network device receives a result of analyzing the data from the security device.

In operation 830, if the inputted data is allowed data as a result of confirming the analysis result, in operation 840, the network device may register the permission pattern included in the analysis result in the network device.

In operation 850, the network device continuously transmits the input data to the security device.

In contrast, if the inputted data is not the allowable data as a result of confirming the analysis result, the network device may register the attack pattern included in the analysis result in the network device in step 860.

In operation 870, the network device may defend against an attack by traffic using a defense operation included in the analysis result, and register the defense operation in the network device.

9 is a flowchart illustrating a collaborative defense method for a distributed denial of service attack performed by a security device according to an embodiment of the present invention.

The method of FIG. 9 may be performed by the security equipment 300 described with reference to FIG. 1 or 5.

In operation 910, the security device receives data from a network device that monitors traffic forwarded to the service server.

In operation 920, the security device may check whether the received data is suspect data suspected of a DDoS attack. In detail, the security device may determine whether the data is suspicious data based on the flow information of the data received in operation 910 or the marking information displayed on the data.

In operation 930, if the data is suspected of being a DDoS attack, that is, the data is confirmed as suspicious data, the security device may precisely analyze the data to determine whether it is a DDoS attack. The result of the detailed analysis of the data may include information about an attack pattern on the data and information about defense actions to be performed by the network device.

In operation 940, when the suspicious data is identified as the data having the attack pattern in operation 930, the security device transmits an analysis result including the attack pattern and the defensive operation to the network device in operation 950.

On the contrary, if the suspicious data is confirmed as the data having the attack pattern in step 930, in step 960, the security device transmits the analysis result including the allowance pattern to the network device.

On the other hand, if it is determined in step 920 that the suspect data is not, in step 970, the data is analyzed to confirm whether the data has an attack pattern.

According to the analysis result, the security device performs steps 940 to 960.

The methods according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

200: network device 210: first communication unit
220: attack pattern register 230: defense operation register
240: data monitoring unit 250: identification display unit
260: first control unit

Claims (19)

In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
The analysis result of the detected data includes the information on the attack pattern of the detected data and the information on the defense operation to be performed by the network device collaborative defense method for a denial of service attack. In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
Wherein the detecting comprises:
Confirming a generation pattern of the input data based on flow information of the input data;
Judging whether the occurrence pattern of the input data corresponds to an attack pattern registered in the network device; And
And determining the input data as data suspected of the distributed service denial attack if the occurrence pattern of the input data corresponds to an attack pattern registered in the network device.
Collaborative defense against distributed service denial attacks. 3. The method of claim 2,
The occurrence pattern of the input data is,
It is determined based on at least one of the amount of data input per unit time, whether the data having the same size is repeated, whether the data for a specific function is repeated,
Collaborative defense against distributed service denial attacks. In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
Informing the above step,
Indicating that the detected data is abnormal symptom data in a manner promised between the network device and a security device; And
Forwarding the data indicated by the abnormal symptom data to the security equipment,
Collaborative defense against distributed service denial attacks. In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
Informing the above step,
Providing the security equipment with flow information of the detected data, the flow information comprising at least one of a source address, a destination address, and a port number; And
Delivering the detected data to the security equipment;
Collaborative defense against distributed service denial attacks. delete The method of claim 1,
The information on the defensive operation includes at least one of a bandwidth limit for the traffic, a complete dropping of the traffic, and a dropping probability for the traffic.
Collaborative defense against distributed service denial attacks. In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
The first operation is,
Registering an attack pattern included in the analysis result when the analysis result is an attack pattern of the distributed service denial attack; And
Blocking the distributed service denial attack of the traffic according to the defense against the traffic included in the analysis result;
Collaborative defense against distributed service denial attacks. 9. The method of claim 8,
Blocking the distributed service denial attack of the traffic,
Registering a defense action for the traffic included in the analysis result; And
Transmitting information on the defensive operation to a network control system so as to block a distributed service denial attack of the traffic at a network incoming end device;
Collaborative defense against distributed service denial attacks. In the collaborative defense method against Distributed Denial of Service attack performed by a network device,
Detecting data suspected of the distributed denial of service attack by monitoring traffic forwarded to a service server;
Notifying the security device that the detected data is data suspected of the distributed service denial of attack;
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Performing at least one of 'second operation'
Lt; / RTI >
The preset rule is
At least one of a bandwidth rate limit for the traffic, a complete dropping of the traffic, a dropping probability for the traffic,
Collaborative defense against distributed service denial attacks. In a collaborative defense method against distributed denial of service attacks performed by security equipment,
Receiving data from a network device that monitors traffic forwarded to the service server;
Checking whether the data is data suspected of the distributed service denial attack based on the flow information of the data provided from the network device or the marking information displayed on the data;
If the data is suspected of being a distributed service denial attack, precisely analyzing the data to determine whether the distributed service denial attack is performed; And
Transmitting the detailed analysis result of the data to the network device.
Collaborative defense against distributed service denial attacks. 12. The method of claim 11,
Precision analysis of the data,
Including information on the attack pattern for the data and the defense action to be performed by the network device,
Collaborative defense against distributed service denial attacks. A data monitoring unit which detects data suspected of a distributed service denial attack by monitoring traffic forwarded to the service server;
A communication unit for notifying a security device that the detected data is data suspected of a distributed service denial attack; And
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Control unit performing at least one of the 'second operation'
Lt; / RTI >
The analysis result of the detected data includes the information on the attack pattern of the detected data and information on the defense operation to be performed by the network device for a collaborative defense against a Distributed Denial of Service attack Network devices. A data monitoring unit which detects data suspected of a distributed service denial attack by monitoring traffic forwarded to the service server;
A communication unit for notifying a security device that the detected data is data suspected of a distributed service denial attack; And
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Control unit performing at least one of the 'second operation'
Lt; / RTI >
The data monitoring unit,
A pattern determination unit which checks a generation pattern of the input data based on flow information of the input data, and determines whether the identified occurrence pattern corresponds to an attack pattern registered in a network device; And
A suspicious data determination unit that determines the input data as data suspected of a distributed service denial attack when the occurrence pattern of the input data corresponds to an attack pattern registered in a network device;
A network device for collaborative defense against distributed service denial attacks, including. A data monitoring unit which detects data suspected of a distributed service denial attack by monitoring traffic forwarded to the service server;
A communication unit for notifying a security device that the detected data is data suspected of a distributed service denial attack; And
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Control unit performing at least one of the 'second operation'
Lt; / RTI >
An identification display unit for indicating that the detected data is abnormal symptom data in a manner promised between a network device and a security device;
Further comprising:
The communication unit forwards the data indicated by the abnormal symptom data to a security device.
Network device for collaborative defense against distributed service denial attacks. A data monitoring unit which detects data suspected of a distributed service denial attack by monitoring traffic forwarded to the service server;
A communication unit for notifying a security device that the detected data is data suspected of a distributed service denial attack; And
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Control unit performing at least one of the 'second operation'
Lt; / RTI >
The communication unit, the flow information of the detected data, the flow information includes at least one of a source address, a destination address, a port number, and delivers the detected data to the security equipment,
Network device for collaborative defense against distributed service denial attacks. A data monitoring unit which detects data suspected of a distributed service denial attack by monitoring traffic forwarded to the service server;
A communication unit for notifying a security device that the detected data is data suspected of a distributed service denial attack; And
'First operation of receiving the analysis result of the detected data from the security equipment and controlling the traffic according to the analysis result', or 'controlling the traffic according to a predetermined rule before performing the first operation' Control unit performing at least one of the 'second operation'
Lt; / RTI >
Wherein,
If the analysis result is an attack pattern of a distributed service rejection attack, the attack pattern included in the analysis result is registered, and the distributed service rejection attack of the traffic is blocked according to the defense against the traffic included in the analysis result, Performing the first operation,
Network device for collaborative defense against distributed service denial attacks. 18. The method of claim 17,
Defense action register for registering the defense action for the traffic included in the analysis result
≪ / RTI >
Network device for collaborative defense against distributed service denial attacks. 18. The method of claim 17,
Wherein,
Transmitting information on the defensive operation to a network control system so as to block a distributed service denial attack of the traffic at a network incoming end device;
Network device for collaborative defense against distributed service denial attacks.

Images