KR102401661B1 - SYSTEM OF DETECTION AND DEFENSING AGAINST DDoS ATTACK AND METHOD THEREOF - Google Patents

Abstract

According to the present invention, a DDoS attack detection and defense system comprises: a service server; a login server for confirming a service user as a registered user as a member; and a firewall server for monitoring a packet of a user transmitted to a service server to block a DDoS attack of the service server. The login server extracts a source IP address from at least a part of the packets of the user transmitted to the login server to transmit the same to the firewall server. Also, the firewall server extracts the source IP address from the packet of the user transmitted to the service server to determine traffic of the user transmitted to the service server as abnormal traffic when the extracted source IP address is not in a list of the source IP address transmitted from the login server. Therefore, a DDoS symptom can be more accurately and quickly recognized and responded.

Description

DDoS attack detection and defense system and method {SYSTEM OF DETECTION AND DEFENSING AGAINST DDoS ATTACK AND METHOD THEREOF}

The present invention relates to a system and method for detecting and defending a distributed denial of service (DDoS) attack, and more specifically, to more accurately and quickly identifying DDoS symptoms based on the login data of a user using a predetermined service. It relates to a DDoS attack detection and defense system that can respond and a method therefor.

Due to the increase of distributed systems and the spread of the Internet, the possibility of attacks through networks is increasing. In order to protect the system from the threat of potential attacks, security systems such as a firewall are installed. However, the existing security devices are unable to detect beyond the local network boundary, and effective and active response at the network level is impossible.

Although security technologies such as firewalls are gradually developing to prevent many types of attacks occurring on the Internet, the threat of DDoS attacks is greatly increasing despite the advancement of these technologies. One of the biggest reasons is that the DDoS attack deviates from the method in which a single PC modifies multiple IP addresses to attack a specific host, and the attacker creates numerous attack agents (zombie PCs) below to attack a specific host at the same time. This is because it is evolving into a method that makes the service unavailable by sending packets. In such a DDoS attack method, it is difficult to detect a DDoS attack based on whether the IP address is tampered with, because a corresponding IP address is used for each zombie PC rather than a plurality of IP addresses being tampered with in one PC. is analyzed to detect whether a DDoS attack exists. For example, if the number of traffic per hour exceeds the threshold, it may be determined as malicious traffic of a DDoS attack.

However, the DDoS attack detection method according to such traffic analysis has limitations in its detection in that a DDoS attacker can skillfully change the traffic generation pattern, such as reducing the number of traffic per hour, and it is necessary to analyze a large amount of traffic, It takes a long time to detect, and accordingly, there is a problem in that it is difficult to quickly respond to a DDoS attack.

Patent application number: 10-2010-0121547

An object of the present invention is to provide a DDoS attack detection and defense system and method capable of detecting and responding to DDoS symptoms more accurately and quickly based on login data of a predetermined service user to solve this problem.

In addition, the present invention provides a DDoS attack detection and defense system and method that allow an administrator to detect a DDoS attack from various angles depending on the situation by enabling the selection of criteria for determining malicious traffic of a DDoS attack according to a login attempt pattern. aim to do

In addition, the present invention allows the administrator to flexibly respond to DDoS attacks depending on the situation by allowing the selection of a malicious traffic standard for detecting a DDoS attack and a malicious traffic standard to which a blocking policy is applied according to a login attempt pattern. An object of the present invention is to provide a DDoS attack detection and defense system and method therefor.

According to an embodiment of the present invention, it is a DDoS attack detection and defense system, a service server, a login server that checks whether a user has registered as a member, and monitors a user's packet sent to the service server, and sends it to the service server. It may include a firewall server to block DDoS attacks from The login server extracts a source IP address from at least some of the user's packets sent to the login server and transmits it to the firewall server, and the firewall server extracts the source IP address from the user's packet sent to the service server. Thus, if the extracted source IP address is not in the list of source IP addresses transmitted from the login server, it is possible to determine the user's traffic sent to the service server as abnormal traffic.

Also, if the extracted source IP address is in the list of source IP addresses transmitted from the login server, the firewall server may determine that the user's traffic sent to the service server is normal traffic.

In addition, the source IP address transmitted to the firewall server may be the source IP address of a packet on which TCP 3-way hand shaking is performed by accessing the login server.

Also, the source IP address transmitted to the firewall server may be the source IP address of a packet that has logged in to the login server.

In addition, the source IP address transmitted to the firewall server may be a source IP address of a packet in which data corresponding to an ID and password are a combination of at least two of text, numbers, and symbols in the user's packet sent to the login server.

In addition, the source IP address transmitted to the firewall server may be a source IP address of a packet that conforms to a communication protocol for communication to the login server for the user's packet sent to the login server.

In addition, the source IP address transmitted to the firewall server is (1) a packet with TCP 3-way hand shaking connected to the login server, (2) a packet after logging in to the login server, and (3) sent to the login server A packet in which the data corresponding to the ID and password is a combination of at least two of text, numbers, and symbols in the user's packet, (4) The user's packet sent to the login server follows the communication protocol for communication to the login server It may be a source IP address of a packet that satisfies at least one of

In addition, the login server transmits login attempt pattern information together with the source IP address to the firewall server, and the login attempt pattern information includes the source IP address transmitted to the firewall server, (1) accessing the login server and connecting TCP 3- In the packet with way hand shaking, (2) logging in to the login server, and (3) in the user's packet sent to the login server, the data corresponding to the ID and password is a combination of at least two of text, numbers, and symbols. Packet, (4) The user's packet sent to the login server may include information on which packet is the source IP address of the packet that conforms to the communication protocol for communication to the login server.

Also, the list of source IP addresses transmitted from the login server may be a list of source IP addresses corresponding to the login attempt pattern selected by the administrator.

In addition, whether or not a DDoS attack may be determined based on at least the amount of abnormal traffic.

In addition, when the amount of abnormal traffic per hour exceeds a predetermined threshold, it may be determined as a DDoS attack.

Further, according to another embodiment of the present invention, there is provided a DDoS attack detection and blocking method, comprising the steps of extracting a source IP address from at least some of the packets of a user sent to a login server and transmitting the source IP address to a firewall server; extracting a source IP address from the user's packet sent to the service server, and if the source IP address extracted from the user's packet sent to the service server is not in the list of source IP addresses transmitted to the firewall server, the The method may include determining that the user's traffic sent to the service server is abnormal traffic, and determining whether a DDoS attack occurs based on at least the amount of abnormal traffic.

The method may further include determining that the user's traffic sent to the service server is normal traffic when the extracted source IP address is in the list of source IP addresses transmitted to the firewall server.

In addition, the source IP address transmitted to the firewall server may be the source IP address of a packet on which TCP 3-way hand shaking is performed by accessing the login server.

In addition, the source IP address transmitted to the firewall server is (1) a packet that has been connected to the login server and undergoes TCP 3-way hand shaking, and (2) a user packet sent to the login server is used for communication with the login server. A packet that conforms to the communication protocol, (3) a packet in which the data corresponding to the ID and password in the user's packet sent to the login server is a combination of at least two of text, numbers, and symbols, (4) a packet that completes the login to the login server It may be a source IP address of a packet that satisfies at least one of

In addition, the login server transmits login attempt pattern information together with the source IP address to the firewall server, and the login attempt pattern information includes the source IP address transmitted to the firewall server, (1) accessing the login server and connecting TCP 3- A packet with way hand shaking, (2) a packet sent to the login server by a user that follows the communication protocol for communication to the login server, (3) a packet that corresponds to an ID and password in a user packet sent to the login server The data may include information on the source IP address of a packet that satisfies which packet among packets in which data is a combination of at least two of text, numbers, and symbols, and (4) packets in which log-in to the log-in server is completed.

Also, the list of source IP addresses transmitted from the login server may be a list of source IP addresses corresponding to the login attempt pattern selected by the administrator.

In addition, when the amount of abnormal traffic per hour exceeds a predetermined threshold, it may be determined as a DDoS attack.

According to an embodiment of the present invention, it is possible to more accurately and quickly detect and respond to a DDoS attack based on login data of a predetermined service user.

In addition, according to an embodiment of the present invention, it is possible for an administrator to detect a DDoS attack from various angles depending on the situation by enabling the selection of criteria for determining malicious traffic of a DDoS attack according to a login attempt pattern.

In addition, according to an embodiment of the present invention, it is possible to select a malicious traffic criterion for detecting a DDoS attack and a malicious traffic criterion to which a blocking policy is applied according to a login attempt pattern, so that an administrator can respond to a DDoS attack according to the situation. It is possible to respond flexibly to

1 illustrates a DDoS attack detection and defense system according to an embodiment of the present invention.
2 is a block diagram of a firewall server according to an embodiment of the present invention.
3 is a flowchart illustrating a DDoS attack detection and defense method according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, the present invention will be described in detail so that those of ordinary skill in the art can easily carry out the present invention. However, the present invention may be embodied in several different forms and is not limited to the embodiments described herein.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase.

As used herein, “comprises”, “comprising” refers to the presence or absence of one or more other components, steps, operations and/or elements mentioned addition is not excluded.

In addition, terms including ordinal numbers such as first, second, etc. used in the present invention may be used to describe the components, but the components should not be limited by the terms. These terms are used only for the purpose of distinguishing one component from another. In addition, in the description of the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Hereinafter, an embodiment according to the present invention will be described in detail with reference to the accompanying drawings. The configuration of the present invention and its effects will be clearly understood through the following detailed description.

1 illustrates a DDoS attack detection and defense system according to an embodiment of the present invention. Referring to FIG. 1 , the DDoS attack detection and defense system according to an embodiment of the present invention includes a login server 130 , a firewall server 140 , and a service server 150 .

When providing a plurality of services to users like a portal service provider, it is common to provide a common login server 130 for a plurality of service servers rather than a login server 130 for each service server 150 . (here, the common login server means having a functionally common login server for a plurality of service servers, not physically providing a single server). The login server 130 checks whether the user has registered as a member. The service server 150 may be provided for each service. For example, a messenger service server, a voice/video call service server, and a community service server (such as a blog or a cafe) may correspond to the service server 150 .

Typically, DDoS attacks target the service server 150 . That is, when the zombie PC 120 accesses the service server, as described above, the zombie PC 120 does not falsify the source IP address, so TCP 3-way hand shaking is normally performed, and the SYN Cookie firewall It is difficult to detect a DDoS attack by a zombie PC with this method, and it is possible to detect a DDoS attack by analyzing the network traffic (eg, the amount of traffic generated per hour), which has limitations in early detection of a DDoS attack.

The present invention detects the presence of a DDoS attack early by using the login data of the service user.

In the present invention, traffic that accesses the service server 150 with the source IP address of a packet that normally attempts to log in to the log-in server 130 rather than a DDoS attack is determined as normal traffic, not a DDoS attack.

Here, among the packets connected to the login server 130 , a criterion for determining which packet is not a DDoS attack but a normal login attempt may be as follows.

For example, according to the first criterion of the present invention, in general, the zombie PC 120 attempts a DDoS attack on the service server, does not perform a DDoS attack on the login server 130 , and the normal PC 110 performs a DDoS attack on the service server 150 . ) In consideration of the fact that there is a log-in server connection history before the connection, it is possible to determine that a packet in which TCP 3-way hand shaking is performed by accessing the log-in server 130 is a packet in which a login attempt was made normally. In this case, if the login server 130 is accessed and the service server 150 is also accessed with the source IP address of the packet subjected to TCP 3-way hand shaking, this traffic may be determined as normal traffic, not a DDoS attack.

In addition, according to the second criterion of the present invention, the zombie PC 120 first accesses the login server 130 and then attempts a DDoS attack on the service server 150. If the user's packet sent to the server 130 conforms to the communication protocol for communication to the login server 130 , it can be determined that this packet is a packet that is normally attempted to log in to the login server 130 . In general, in the service user terminal, an app (eg, a messenger app) for communicating with a service server such as a messenger server and an audio/video call server is installed. After installing the app, communication (specifically, packets) between the app and the service server 150 follows a predetermined communication protocol provided by the service server. In the case of the zombie PC 120, although it accesses the service server 150 with an unaltered source IP address, the zombie PC 120 takes over a predetermined app of the service user terminal and follows a predetermined communication protocol through this app. It may be practically difficult to transmit to the service server 150 . Therefore, if the user's packet sent to the login server 130 is analyzed and the packet follows the communication protocol for communication to the login server 130, this packet is sent to the login server 130 for a normal login attempt. can be judged as

In addition, according to the third criterion of the present invention, if the data corresponding to the ID and password in the user's packet sent to the log-in server 130 is a combination of at least two of text, numbers, and symbols, such a packet is normally used to prevent a login attempt. It can be determined as one packet. According to the above criteria, although the user did not correctly input the password or ID, at least a packet in which the password or ID was attempted may be included in the packet in which a normal login attempt is made to the login server.

In addition, according to the fourth criterion of the present invention, after access to the login server 130 , a packet including the correct ID and password is transmitted to the login server 130 , and the packet when the login is completed is determined as a packet that successfully attempted login can do. In this case, if the service server 150 is also accessed with the IP address of the source of the logged-in packet, this traffic may be determined as normal traffic, not a DDoS attack.

The login server 130 transmits the source IP address of the packet that has made a normal login attempt to the login server 130 to the firewall server 140 in real time. For example, if the login server 130 complies with the first criterion, it connects to the login server 130 and transmits the source IP address of the packet on which TCP 3-way hand shaking is performed to the firewall server 140 .

The login server 130 may be implemented by transmitting a source IP address to the firewall server 140 for a packet according to any one of the first to fourth criteria, but any one of the first to fourth criteria may be implemented. It may be implemented that the source IP address is transmitted to the firewall server 140 for a satisfied packet. In this case, the login server 130 may transmit the login attempt pattern information together with the extracted source IP address to the firewall server 140 . For example, the login attempt pattern information field of the transport packet may be described according to the following criteria.

1) A packet with TCP 3-way hand shaking connected to the login server: 1

2) The packet sent by the user to the login server conforms to the communication protocol (eg HTTP, SSL, own protocol, etc.) for communication to the login server: 2

3) In the user's packet sent to the login server, the data corresponding to the ID and password is a combination of at least two of text, number, and symbol: 3

4) Packet that completed login to login server: 4

For example, if the corresponding packet satisfies 1) and 2), the login attempt pattern information may be recorded as “12”. If the corresponding packet satisfies only 1), the login attempt pattern information may be recorded as “1”. can be recorded.

2 is a block diagram of a firewall server 140 according to an embodiment of the present invention. Referring to FIG. 2 , the firewall server 140 may include, as a database, a source IP address list 141 , a normal IP address list 142 , and an abnormal IP address list 143 , and is functionally a packet mirror. It may include a unit 144 , a packet analysis unit 145 , a DDoS attack detection unit 146 , and a traffic control unit 147 .

The firewall server 140 stores the source IP address received from the login server 130 in the source IP address list 141 in real time. When the source IP address is transmitted to the firewall server 140 for a packet that satisfies any one of the first to fourth criteria, that is, when login attempt pattern information is transmitted to the firewall server 140 together with the source IP address In , login attempt pattern information is also stored in the source IP address list 141 together with the source IP address.

In addition, the packet mirror unit 144 of the firewall server 140 mirrors packets of user traffic connecting to the service server 150 in order to monitor user traffic connecting to the service server 150 .

The packet analyzer 145 analyzes the mirrored packet, determines whether the traffic of the packet is traffic that has undergone a normal login attempt or has not undergone a normal login attempt, and the source IP address of the traffic that has undergone a normal login attempt. is stored in the normal IP address list 142 , and the source IP address of traffic that has not undergone a normal login attempt is stored in the abnormal IP address list 143 .

As an embodiment of the present invention, whether the traffic of the corresponding packet is traffic that has undergone a normal login attempt is determined whether the source IP address of the packet is an IP address stored in the source IP address list generated as the source IP address received from the login server. It can be judged whether

For example, the login server 130 is set to transmit the source IP address of the packet according to the first criterion (that is, a packet that has been connected to the login server and subjected to TCP 3-way hand shaking) to the firewall server 140 . In this case, the source IP address of the packet is stored in the source IP address list 141 , and the packet analyzer 145 is configured to determine if the source IP address of the packet connected to the service server 150 is in the source IP address list 141 . , it is determined that the traffic of the corresponding packet is traffic that has undergone a normal login attempt, and if the source IP address of the packet connected to the service server 150 is not in the source IP address list 141, the traffic of the packet is not passed through a normal login attempt. It is judged as non-traffic.

In addition, when the login server 130 is set to transmit the source IP address together with the login attempt pattern to the firewall server 140, the source IP address list 141 stores the login attempt pattern information together with the source IP address. . The administrator can select whether to view the packet traffic according to which login attempt pattern as traffic that has undergone a normal login attempt. For example, if the traffic of the packet according to the second criterion (that is, the user's packet sent to the login server conforms to the communication protocol for communication to the login server) is selected as traffic that has undergone a normal login attempt, the packet analysis unit ( If the source IP address of the packet connected to the service server 140 is in the list of source IP addresses including at least “2” in the login attempt pattern information, the packet traffic is determined as traffic that has undergone a normal login attempt. do. As described above, since the zombie PC 120 typically attempts a DDoS attack on the service server 150 and does not perform a DDoS attack on the login server 130, it accesses the login server 130 and accesses the TCP 3-way It may be valid to determine a packet with hand shaking as a packet with a normal login attempt (ie, the first criterion). However, since the DDoS attack behavior continuously evolves and can be varied according to the development of the defense method, the second to fourth criteria may be more effective in detecting the DDoS attack in some cases. Therefore, by allowing the administrator to select the criteria for determining the malicious traffic of a DDoS attack according to the login attempt pattern as described above, it becomes possible for the administrator to detect the DDoS attack from various angles depending on the situation, thereby allowing the DDoS attack to be detected earlier and more accurately. have. Also, the packet analyzer 145 may generate and store the normal IP address list 142 and the abnormal IP address list 143 for the allow/block policy. When the login server 130 is set to transmit the source IP address to the firewall server 140 together with the login attempt pattern, the packet analyzer 145 performs the normal IP address list 142 and the abnormal IP address for each login attempt pattern. It may be implemented by creating a list 143 . That is, as the normal IP address list 142 , the first normal IP address list (source IP address list of traffic in the source IP address list in which the source IP address satisfies the first criterion as user traffic accessing the service server) , 2nd normal IP address list (source IP address list of user traffic connecting to the service server and the source IP address list for which the source IP address satisfies the second criterion), 3rd normal IP address list (to the service server) The source IP address list of traffic in the source IP address list where the source IP address satisfies the third criterion as accessing user traffic), the 4th normal IP address list (user traffic connecting to the service server, where the source IP address is the fourth source IP address list of traffic in the source IP address list that satisfies the criteria) is generated.

In addition, as the abnormal IP address list 143, the first abnormal IP address list (source IP address list of traffic that is not in the source IP address list that satisfies the first criterion as user traffic accessing the service server); 2nd abnormal IP address list (source IP address list of user traffic accessing to the service server and the source IP address is not in the source IP address list that satisfies the second criterion), 3rd abnormal IP address list (access to the service server) source IP address list of traffic whose source IP address is not in the source IP address list that satisfies the third criterion as user traffic that source IP address list of traffic that is not in the source IP address list that satisfies .

The DDoS attack detection unit 146 detects a DDoS attack by analyzing the traffic flowing into the service server 150 . For example, the DDoS attack detection unit 146 may determine whether or not a DDoS attack occurs based on the amount of traffic that has not undergone a normal login attempt per hour. In addition, the DDoS attack detection unit 146 may determine whether a DDoS attack exists by combining it with a part of the existing DDoS attack detection step.

For example, the DDoS attack detection unit 146 may analyze the mirrored packet and determine that traffic for which TCP 3-way hand shaking is not normally performed is malicious traffic of the DDoS attack. Through this, traffic attempting to access the service server 150 with the forged source IP address may be primarily filtered as malicious traffic of a DDoS attack.

Next, the DDoS attack detection unit 146 may determine that it is a DDoS attack when the amount of traffic that has not undergone a normal login attempt per hour exceeds a predetermined threshold with respect to traffic for which TCP 3-way hand shaking has been normally performed. In the related art, when accessing the service server 150 and analyzing all traffic normally performed by TCP 3-way handshaking, there is a limit to the detection of a DDoS attack and it takes a long time to detect a DDoS attack. As described above, the DDoS attack detection unit according to an embodiment of the present invention detects a DDoS attack based on whether the amount of traffic that has not undergone a normal login attempt per hour exceeds a predetermined threshold using the user's login data. It can detect DDoS attacks early and accurately. In addition, traffic that does not pass through a normal login attempt per hour (as described above) may be selected differently depending on which criterion an administrator selects. For example, the administrator determines that <traffic that is not in the source IP address list that satisfies the first criterion as user traffic accessing the service server as user traffic connecting to the service server> per hour from the first abnormal IP address list is traffic that does not undergo normal login attempts per hour can do.

When the DDoS attack detection unit 146 determines that it is a DDoS attack, it notifies the traffic control unit 147 of this. When it is determined as a DDoS attack, the traffic controller blocks access to the service server 140 for traffic that has not undergone a normal login attempt. In this case, it is preferable that the administrator be able to select one of a plurality of blocking policies according to the traffic situation flowing into the service server 140 . For example, the blocked traffic may be traffic connected to the source IP address of the abnormal IP address list 143 .

In addition, traffic determined as traffic that has not undergone a normal login attempt for DDoS attack detection may be different from traffic to which a blocking policy is applied.

For example, when a DDoS attack is detected, as user traffic accessing the service server 140 , the source IP address is not in the list of source IP addresses including at least “1” or “2” in the login attempt pattern information for normal login. Even if it is determined that the traffic is not attempted, the blocking policy may be applied only to traffic having the source IP address of the first abnormal IP address list. Alternatively, sequentially, the blocking policy is first applied to the traffic having the source IP address of the first abnormal IP address list, and, depending on the traffic situation, the blocking policy is additionally applied to the traffic having the source IP address of the second abnormal IP address list can be applied In this way, by allowing the selection of a malicious traffic criterion for detecting a DDoS attack and a malicious traffic criterion to which a blocking policy is applied according to the login attempt pattern, it becomes possible for the administrator to flexibly respond to the DDoS attack according to the situation. .

As an example, the blocking policy may be applied in the order of the first criterion, the second criterion, the third criterion, and the fourth criterion. If the blocking policy is applied to the list of the first abnormal IP addresses (according to the first criterion), it is the most loose response to the DDoS attack, and if the blocking policy is applied to the list of the fourth abnormal IP addresses (according to the fourth criterion) , it may be the most reliable response to DDoS attacks.

It is impossible to completely defend against DDOS attacks, and it is desirable to recover the out of service state by mitigating the attack amount. If the blocking policy is applied to the list of the first abnormal IP address, the mitigation of the DDoS attack amount may be low, but there is an advantage in that the probability of false positives blocking normal users is low. Therefore, it is possible to check the reduction in the amount of attack by applying the blocking policy sequentially from the list of the first abnormal IP address to the list of the fourth abnormal IP address.

3 is a flowchart illustrating a DDoS attack detection and defense method according to an embodiment of the present invention.

Referring to FIG. 3 , the login server 130 extracts a source IP address from the user packet sent to the login server 130 ( S110 ). The login server 130 transmits the extracted source IP address to the firewall server 140 (S120). In this case, the login server 130 may transmit the login attempt pattern information together with the extracted source IP address to the firewall server 140 .

The firewall server 140 stores the source IP address received from the login server 130 in the source IP address list 141 (S130). When the login attempt pattern information is also transmitted, this information is also stored in the source IP address list 141 .

In the next step, the firewall server 140 extracts the source IP address from the user's packet flowing into the service server 150 (S140). The firewall server 140, if the extracted source IP address is not in the source IP address list 141, determines the corresponding traffic as abnormal traffic (S150). In this case, when the administrator selects a login attempt pattern, the source IP address is a list of source IP addresses corresponding to the login attempt pattern selected by the administrator.

The firewall server 140 determines whether a DDoS attack occurs based on the amount of abnormal traffic per hour (S160), and applies a blocking policy to the abnormal traffic when it is determined to be a DDoS attack (S170).

130: login server
140: firewall server
150: service server
141: source IP address list
142: list of normal IP addresses
143: Abnormal IP address list
144: packet mirror unit
145: packet analysis unit
146: DDoS attack detection unit
147: traffic control

Claims (18)

It is a DDoS attack detection and defense system,
service server;
A login server that checks whether the user is a member,
and a firewall server that monitors a user's packet sent to the service server and blocks a DDoS attack on the service server,
The login server extracts a source IP address from at least some of the packets of the user sent to the login server and transmits it to the firewall server,
The firewall server extracts a source IP address from the user's packet sent to the service server, and if the extracted source IP address is not in the list of source IP addresses transmitted from the login server, the user's traffic sent to the service server It is judged as abnormal traffic,
The source IP address transmitted to the firewall server is,
(1) packets with TCP 3-way hand shaking connected to the login server;
(2) The user's packet sent to the login server follows the communication protocol for communication to the login server;
(3) In the user's packet sent to the login server, the data corresponding to the ID and password is a combination of at least two of text, number, and symbol;
(4) The source IP address of the packet that satisfies at least one of the packets that log in to the login server,
DDoS attack detection and defense system. The method of claim 1, wherein the firewall server determines that the user's traffic sent to the service server is normal traffic if the extracted source IP address is in the list of source IP addresses transmitted from the login server.
DDoS attack detection and defense system. delete delete delete delete delete According to claim 1,
The login server transmits login attempt pattern information along with the source IP address to the firewall server,
The login attempt pattern information includes a source IP address transmitted to the firewall server,
(i) packets with TCP 3-way hand shaking connected to the login server;
(ii) the user's packet sent to the login server follows the communication protocol for communication to the login server;
(iii) a packet in which the data corresponding to the ID and password in the user's packet sent to the login server is a combination of at least two of text, number, and symbol;
(iv) including information on the source IP address of a packet that satisfies which packet among the packets that log in to the login server is completed;
DDoS attack detection and defense system. 9. The method of claim 8,
The list of source IP addresses transmitted from the login server is a list of source IP addresses corresponding to the login attempt pattern selected by the administrator,
DDoS attack detection and defense system. According to claim 1,
Determining whether or not a DDoS attack is based on at least the amount of abnormal traffic,
DDoS attack detection and defense system. 11. The method of claim 10,
If the amount of abnormal traffic per hour exceeds a predetermined threshold, it is determined as a DDoS attack.
DDoS attack detection and defense system. DDoS attack detection and defense method,
extracting the source IP address from at least some of the user's packets sent to the login server and sending it to the firewall server;
In the firewall server, extracting the source IP address from the packet sent to the service server;
If the source IP address extracted from the user's packet sent to the service server is not in the list of source IP addresses transmitted to the firewall server, determining that the user's traffic sent to the service server is abnormal traffic;
Determining whether a DDoS attack is based on at least the amount of abnormal traffic,
The source IP address transmitted to the firewall server is,
(1) packets with TCP 3-way hand shaking connected to the login server;
(2) A packet that has completed logging in to the login server;
(3) In the user's packet sent to the login server, the data corresponding to the ID and password is a combination of at least two of text, number, and symbol;
(4) the source IP address of the packet that the user's packet sent to the login server satisfies at least one of the packets conforming to the communication protocol for communication to the login server;
How to detect and defend against DDoS attacks. 13. The method of claim 12, further comprising: if the extracted source IP address is in the list of source IP addresses transmitted to the firewall server, determining that the user's traffic sent to the service server is normal traffic,
How to detect and defend against DDoS attacks. delete delete 13. The method of claim 12,
The login server transmits login attempt pattern information along with the source IP address to the firewall server,
The login attempt pattern information includes a source IP address transmitted to the firewall server,
(i) packets with TCP 3-way hand shaking connected to the login server;
(ii) the user's packet sent to the login server follows the communication protocol for communication to the login server;
(iii) a packet in which the data corresponding to the ID and password in the user's packet sent to the login server is a combination of at least two of text, number, and symbol;
(iv) including information on the source IP address of a packet that satisfies which packet among the packets that log in to the login server is completed;
How to detect and defend against DDoS attacks. 17. The method of claim 16,
The list of source IP addresses transmitted from the login server is a list of source IP addresses corresponding to the login attempt pattern selected by the administrator,
How to detect and defend against DDoS attacks. 13. The method of claim 12,
If the amount of abnormal traffic per hour exceeds a predetermined threshold, it is determined as a DDoS attack.
How to detect and defend against DDoS attacks.

Images