KR20140050450A - Apparatus and method for detecting distributed denial of service attack - Google Patents

Abstract

The present invention relates to a device for detecting a distributed service denial attack on a protection target server. The device for detecting a distributed service denial attack includes a packet for collection unit collecting a network packet related to the connection and completion of a network coming into or out from the protection target server between the protection target server and a network device and a detection unit which monitors the state of a network connection resource of the protection target server based on the network packet and detects an attack of the network connection resource based on the state of the network connection resource. [Reference numerals] (10) Attack client; (100) Detection unit; (200) Protection target server; (300) Network device

Description

[0001] APPARATUS AND METHOD FOR DETECTING DISTRIBUTED DENIAL OF SERVICE ATTACK [0002]

The present invention relates to a distributed denial of service attack detection method and apparatus.

Since 2009, government and private sectors have spent tens of billions of won in budget for DDoS defense system. As a result, dedicated equipment has been installed in most government and private sectors to respond to DDoS. However, there are many cases in which such equipment does not successfully defend against an attack on well-equipped organs. This is because the current attack defense is centered on the defense function of the equipment, and it does not respond appropriately to evolving attacks such as attack using a new technique or simple modification to an existing attack. Also, This is because there is a large deviation.

As the detection and response system of large packet transmissions in Internet packet relay area is strengthened, it evolves into a form of denial of service of attack target web server without detecting / blocking attack activity in relay interval. In other words, in Network Bandwidth Consumption attack method that infringes on the physical availability of the network, it becomes a host / application resource consumption attack in order to directly hit the availability of the web server at the target point while causing relatively low traffic in the relay interval .

The host / application resource consumption attack attacks the logical resource of the attack target to exceed the limit capacity of the computational resource located at the end of the communication interval. The traditional denial-of-service attack classification method derives the characteristics of the attack itself, such as the automation state of the attack method, the falsification of the address used in the attack, the change of the attack amount, the kind of the attack target resource, Although it provides a classification method for attacks, it is not suitable to be used as a guideline for attack defense in an attack site. Also, when a new attack occurs, there is a problem that the existing classification system needs to be updated. Defense methods based on these classification methods are also not suitable for real defense because there is no quantitative measurement method of attack type and attack type.

A problem to be solved by the present invention is to set a detection index for detecting a distributed denial of service attack and to monitor the resource status of a protected server based on a detection index to classify types of distributed denial of service attacks, And to provide a method and apparatus for detecting a distributed denial of service attack.

A detection device for detecting a distributed denial of service attack on a protected server according to an exemplary embodiment of the present invention is a detection device for collecting network packets related to network connection and termination between a protected server and a network device And a detection unit for monitoring a state of network connection resources of the protected server based on the network packet and detecting an attack of the network connection resource based on the state of the network connection resource.

The network packet may include at least one of a connection request attempt (SYN) packet, a connection request response (SYN_ACK) packet, a final acknowledgment (ACK) packet, and a connection end FIN / RST .

The detection unit monitors the state of the network connection resource including a backlog queue and a TCP control block (TCB) based on the network packet, and based on the state of the network connection resource, And a TCP control block (TCB) attack.

The detection unit calculates at least one detection index based on the network packet and monitors the status of the network connection resource based on at least one detection index. The detection index indicates a connection request attempt (SYN) An attack IP distribution, a number of TCP sessions, and a TCP session duration, which is a ratio of a connection request response (SYN_ACK) packet to a packet.

The detection unit may detect the backlog queue attack by determining whether the backlog queue is in a service denial state based on at least one of the connection request response rate, the attack IP distribution, and the number of TCP sessions.

The detection unit may detect the TCP control block attack by determining whether the TCP control block is in a denial-of-service state based on the number of TCP sessions and the connection request response rate.

The detection unit can classify the TCP control block attack into a fast TCP control block attack and a slow TCP control block attack based on the TCP session duration of the TCP control block.

The detection device sets at least one response policy for defending against a denial of service attack of each network connection resource. When the detection module detects an attack of a network connection resource, the detection device sets a corresponding policy set in the detected network connection resource And a defensive unit applied to the protected server.

The defending unit may change the corresponding policy while monitoring the state of the detected network connection resource.

When a plurality of protected servers are connected to the network device, the packet collector may collect network packets for each protected server and manage the virtual packets according to a virtual connection information table.

The detection unit monitors the status of network connection resources of each protected server based on the virtual connection information table and detects a distributed denial of service attack directed to the protected server based on the virtual connection information table.

A method for detecting a distributed denial of service attack on a protected server according to another embodiment of the present invention includes collecting network packets related to network connection and termination of the protected server, (TCP) control block (TCB) on the basis of at least one detection index among the plurality of detection indices, Determining a state of the connection resource, and detecting at least one of a backlog queue attack and a TCP control block attack based on the state of the network connection resource.

The collecting of the network packets may collect the network packets between the protected server and the network device.

Wherein the step of calculating the plurality of detection indices includes at least one of a connection request attempt (SYN) packet, a connection request response (SYN_ACK) packet, a final acknowledgment (ACK) packet, and a connection end FIN / RST And calculate the plurality of detection indices based on the network packet including one of the plurality of detection indices.

Wherein the step of calculating the plurality of detection indices includes calculating a ratio of the connection request response (SYN_ACK) packet to the connection request attempt (SYN) packet, the connection request response rate, the attack IP distribution, the number of TCP sessions, A detection index including one can be calculated.

The step of determining the state of the network connection resource may determine whether the backlog queue is in a denial state based on at least one of the connection request response rate, the attack IP distribution, and the number of TCP sessions.

The step of determining the state of the network connection resource may determine whether the TCP control block is in a denial-of-service state based on the number of TCP sessions and the connection request response rate.

The step of detecting at least one of the backlog queue attack and the TCP control block (TCB) attack may include a TCP control block attack based on the TCP session duration of the TCP control block, TCP control block attacks.

A method of detecting a distributed denial of service attack on a protected server according to another embodiment of the present invention includes collecting network packets related to network connection and termination of the protected server, Determining whether a backlog queue of the protected server is in a saturation state based on a network packet when the backlog queue is in a saturation state and transmitting a TCP control block of the protected server based on the network packet, Detecting a backlog queue attack for the backlog queue if the TCP control block is not in a saturation state; and if the TCP control block is in a saturation state, And detecting a TCP control block attack on the block.

The step of detecting the TCP control block attack may classify the TCP control block attack as a fast TCP control block attack and a slow TCP control block attack based on the TCP session duration of the TCP control block.

Wherein the network packet includes a connection request attempt (SYN) packet and a connection request response (SYN_ACK) packet related to TCP connection and termination, and the step of determining whether the backlog queue is in a saturation state comprises: If the ratio of the connection request response (SYN_ACK) packet to the backlog queue is lower than the reference value, it can be determined that the backlog queue is saturated.

Wherein the step of determining whether the TCP control block is in a saturation state determines that the TCP control block is in a saturation state when the number of TCP sessions of the TCP control block is constant and rejects a new connection request, Can be computed based on a final acknowledgment (ACK) packet and a connection termination (FIN / RST) packet.

According to the embodiment of the present invention, when a denial of service attack occurs, a zone in which a bottleneck occurs first is identified and the resource status of the protected server is monitored to detect and respond to an attack before reaching a denial of service. According to the embodiment of the present invention, since the type of denial-of-service attack is determined based on the resource status of the protected server, even if the attacker tries to deny the denial of service attack, it can perform consistent defense according to the type of attack. In addition, according to the embodiment of the present invention, it is possible to effectively cope with a recent attack type that is evolving more and more like a normal request.

1A and 1B are diagrams schematically illustrating a network related to a distributed denial of service attack according to an embodiment of the present invention.
2 is a diagram illustrating a TCP connection according to an embodiment of the present invention.
3 is a block diagram of a detection apparatus according to an embodiment of the present invention.
4 is a flowchart of a distributed denial of service attack detection method according to an embodiment of the present invention.
5 is a flowchart of a distributed denial of service attack detection method according to another embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

A distributed denial of service attack detection method and apparatus according to an embodiment of the present invention will now be described with reference to the drawings.

1A and 1B are diagrams schematically illustrating a network related to a distributed denial of service attack according to an embodiment of the present invention.

Referring to FIG. 1A, a plurality of attack clients 10 attack attacks consuming host / application resources of the protected server 200 instead of attacking exhausting network bandwidth by transmitting a large amount of traffic. A host / application resource consumption attack is an attack that attacks a service exceeding the limit capacity of a resource located at the end of a communication section to deny service.

A distributed denial-of-service attack detecting apparatus 100 (hereinafter referred to as a "detecting apparatus") detects whether a protected server 200 receives a distributed denial of service (DDoS) attack from an attacking client 10.

The detection apparatus 100 sets an observation interval between the protection target server 200 and the network apparatus 300. The detection apparatus 100 collects network packets in an observation period. The network device 300 may be, for example, a gateway router as a gateway through which packets of the protected server 200 are input and output. A network packet is a packet related to network connection and termination, and may be a packet related to Transmission Control Protocol (TCP) connection and termination.

The detection apparatus 100 calculates a plurality of detection indications based on the packets related to the network connection and termination of the protection target server 200. The detection apparatus 100 determines the state of the network connection resource related to the protection target server 200 based on at least one detection index. Here, the network connection resource is a resource required by the host where the HTTP server is installed to process the TCP connection used in the HTTP request, for example, a backlog queue and a TCP control block (TCB) . The backlog queue is a resource related to the TCP initial connection, and the TCP control block is the resource that handles the TCP connection.

The detection apparatus 100 classifies the attacks received by the protection target server 200 as a backlog queue attack, a fast TCB attack, and a slow TCB attack based on the state of network connection resources.

The detection apparatus 100 monitors the logical bottleneck interval that is the fastest resource consumption when the attack of the attack client 10 occurs and hinders the user's use of the normal service in the entire interval. Here, the logical bottleneck section is an interval in which resources for network connection of the protected server 200 are installed, and may be an external section connected to the server application such as a system kernel, an HTTP server application, and a web server database. Thus, the detection device 100 can immediately detect an attack.

In addition, since the detection apparatus 100 can observe between the protection target server 200 and the network apparatus 300, even during a denial of service attack, a service denial attack Can be detected. The detection apparatus 100 detects a denial of service attack in the same manner as any of the protected servers 200 without being affected by the configuration of the application level additional equipment such as the operating system of the protected server 200 and the switch of the web cache L7 .

The detection device 100 may be installed at various positions where packets between the protected server 200 and the network device 300 can be observed. For example, the detection device 100 may be implemented in the network device 300.

1B, it is assumed that the detection apparatus 100 is a system connected to the network apparatus 300. FIG.

The detection apparatus 100 observes, in a passive environment, traffic directed to a plurality of protected servers 200a-200n in the network route. The detection apparatus 100 can generate a virtual connection table through network packet monitoring. The connection information table includes various network traffic statistics information and flow information for deriving a backlog queue attack, a fast TCB attack, a detection index of a slow TCB attack, and the like. For example, the connection information table may include the number of sessions per server, session duration, and the like.

Accordingly, the detection apparatus 100 can monitor the network packets related to the protection target server regardless of the number of the protection target servers located on the same network based on the connection information table. Then, the detection apparatus 100 can track the state of an attacking server, the type of an attack, the number of attackers and the like based on the connection information table, and can perform policy-based defense based on this.

In the past, a denial of service attack was detected based on the network status measured at each protected server. However, measuring the network status on the protected server can cause the load or performance degradation of the server, and it may be difficult to measure the accurate server status due to an overload caused by an attack. In order to solve this problem, instead of measuring the network status at the protection target server, the detection apparatus 100 monitors packets entering and leaving the protected server 200, and based on the monitored packets, Attack, and slow TCB attack.

2 is a diagram illustrating a TCP connection according to an embodiment of the present invention.

Referring to FIG. 2, TCP is connected through a three-way handshake. That is, when the client sends a SYN packet to the server, the server sends a SYN_ACK packet to the client, and the client sends a final ACK packet to establish a TCP connection. The resources for this network connection are the backlog queue 230 and the TCP control block 250.

The protected server 200 receives a SYN packet from a client. Then, the protected server 200 allocates resources of the backlog queue 230 for initial TCP connection. The connection information is accumulated in the backlog queue 230, and the backlog queue 230 is kept in the Half Open state for a predetermined time to maintain the TCP connection.

When the backlog queue 230 is saturated during the period of maintaining the connection state, the protected server 200 can no longer accept the TCP connection none. Therefore, the protected server 200 can not transmit the SYN_ACK packet to the SYN packet exceeding the limit capacity. Accordingly, the attacking client 10 may perform a SYN flooding attack on the forged IP to saturate the backlog queue 230 of the protected server 200. The exhaustion of this backlog queue 230 is selectively applied to a specific port using an HTTP TCP connection, generally only to port 80. Therefore, the protected server 200 can deny the service because it can not process the traffic transmitted to the HTTP port although the CPU and the memory value do not affect a large load.

When receiving the ACK packet, the protected server 200 allocates resources of the TCP control block 250 for TCP connection. At this time, if all of the TCP control blocks 250 are allocated, the TCP control block 250 becomes a TCP connection saturation state. Therefore, the attacking client 10 can saturate the TCP control block 250 of the protected server 200 while establishing a normal TCP connection with the non-falsified IP.

The attacking client 10 may saturate the TCP control block of the protected server 200 by performing an early TCB attack or a slow TCB attack. Here, an early TCB attack is an attack that generates a large number of HTTP GET requests over a TCP connection with a normal connection. A slow TCB attack is an attack that maintains a persistent connection for a relatively long time after establishing a normal TCP connection.

Fast TCB attacks are attacked by botnets made up of many zombie computers. In view of the limited capacity of the protected server 200, if the connection request rate per unit time after the TCP control block 250 is saturated is earlier than the termination rate that is terminated through the TCP connection timeout, 200) is no longer able to establish a connection.

A slow TCB attack attacks the TCP control block 250, which is a bottleneck network connection resource, such as a fast TCB attack. However, a slow TCB attack exhausts the TCP control block 250 in a manner that maintains a relatively persistent connection using a relatively small number of attack resources, unlike a fast TCB attack. Therefore, the attacking client 10 can achieve the same effect while generating significantly lower attack noise than the fast TCB attack. The fast TCB attack is an attack that probabilistically lowers the accessibility of the normal user according to the difference in the number of connection attempts between the normal user and the attacker. A slow TCB attack can preempt all TCP control blocks (250) and completely block the access of the normal user except the attacker while maintaining it, so that a higher attack effect can be obtained.

In this manner, the network connection resources of the protected server 200 are saturated according to various attack types of the attack client 10, and the service denial state can be reached.

In the following, a detailed description will be given of a method for the detection apparatus 100 to grasp the state of network connection resources based on packets related to network connection and termination and to classify attacks.

3 is a block diagram of a detection apparatus according to an embodiment of the present invention.

3, the detection apparatus 100 includes a packet collection unit 110, a detection unit 130, and a defensive unit 150. [

The packet collection unit 110 collects packets related to TCP connection and termination of the protection target server 200 in the observation period. Packets related to TCP connection and termination include SYN packet, SYN_ACK packet, ACK packet, and connection termination packet. The connection termination packet includes a packet for finishing the session (finish, FIN) and a packet for resetting the session (reset, RST).

The packet collecting unit 110 may collect network packets of a plurality of protected servers 200a-200n.

The detection unit 130 detects an attacked resource among the network connection resources of the protection target server 200 based on the packets related to TCP connection and termination. That is, the detection unit 130 determines whether it is a backlog queue attack attacking the backlog queue of the protected server 200 or a TCP control block attack.

In order to detect an attacked resource, the detection unit 130 calculates a detection index based on a packet related to the TCP connection and termination. Detection indexes include connection request response rate, Half-Open rate, attack IP distribution, number of TCP sessions, and TCP session duration. The connection request response rate may be a ratio of SYN_ACK packets to SYN packets. The Half-Open ratio can be calculated based on the SYN_ACK packet and the ACK packet. The attack IP distribution is extracted from the SYN packet. The number of TCP sessions can be calculated based on the ACK packet and the FIN / RST packet, which is the number of sessions connected with the TCP connection established. The TCP session duration may be the average connection time of the TCP sessions.

The detection unit 130 detects backlog cue attacks based on at least one detection index. The detection unit 130 determines that the backlog queue is saturated when the connection request response rate is smaller than a reference value, for example, 1. At this time, the number of SYN_ACK packets that the protected server 200 responds to may be the limit capacity of the backlog queue. The detection unit 130 can determine the available resources of the backlog queue in consideration of the half-open ratio of the backlog queue.

The detection unit 130 can more accurately detect backlog cue attacks considering the attack IP distribution. Because the attacking client 10 mostly attacks via an unspecified number of forged IP addresses. Accordingly, the detection unit 130 can determine that the attack is aimed at consumption of the backlog queue resource based on the distribution of the abnormal IP.

The detection unit 130 can more accurately detect the backlog queue attack considering the TCP session number or the ratio of the ACK packet to the SYN_ACK packet. If the number of TCP sessions connected to the TCP control block at the time of saturation of the backlog queue is significantly lower than that of the SYN packet, the detection unit 130 can determine that the attack is a backlog attack using an abnormal IP address. Because the attacking client 10 has transmitted the SYN packet through the abnormal IP address, the protected server 200 does not receive the ACK packet even if it sends the SYN_ACK. Therefore, since most of the TCP sessions are not normally connected, the number of sessions connected to the TCP control block is not large.

The detection unit 130 detects a TCB attack based on at least one detection index. The detection unit 130 can detect a TCB attack based on the number of TCP sessions and the connection request response rate. The detection unit 130 determines that the TCP control block is in a saturated state when the number of TCP sessions is maintained and a new connection request is rejected. The detection unit 130 may determine whether the connection request is rejected when the connection request response rate is lower than the reference value.

Alternatively, the detection unit 130 may determine that the TCP control block is a TCB attack when the number of SYN packets is greater than the number of FIN / RST packets in a saturated state.

The detection unit 130 can classify the TCB attack into a fast TCB attack and a slow TCB attack in consideration of the TCP session duration. A slow TCB attack is similar to a fast TCB attack, but it is characterized by very slow connection attempts, very few connection attempts, and a certain number of connections that last for a long time. Accordingly, the detection unit 130 detects a slow TCB attack when the TCP session duration per IP is longer than the reference value.

The detection unit 130 can manage the virtual connection information table based on the network packet for each protection target server. That is, the detection unit 130 may store various information for detecting the backlog queue attack, the fast TCB attack, and the slow TCB attack in the virtual connection information table, and manage the states of the plurality of protection target servers.

The defensive unit 150 establishes a response policy for backlog cue attack, fast TCB attack, and slow TCB attack, respectively. Then, the defending unit 150 applies the corresponding policy according to the type of attack detected by the detecting unit 130. In particular, the defending unit 150 measures the progress of the attack based on the state of the network connection resources derived from the packet collecting unit 110 and the detecting unit 130. Then, the defending unit 150 selectively applies the type and application strength of the defense technique based on the progress of the attack. Also, the defensive unit 150 monitors the state change of the network connection resource after one defense policy is applied, and measures the application effect.

When a backlog-queuing attack is detected, the defensive unit 150 establishes a cache server arrangement in which a SYN cookie (COOKIE) or the like is set or an inline device use of the FIRST-SYN-DROP scheme as a corresponding policy. For example, if a backlog queue attack is detected, the defensive unit 150 sets a first response policy to cope with a cost-effective FIRST-SYN-DROP method. The defensive unit 150 maintains the first response policy when the saturation degree of the backlog queue is restored by the FIRST-SYN-DROP method. If no effect is generated by the FIRST-SYN-DROP scheme, the defensive unit 150 sets a second response policy to arrange a cache server to which the SYN COOKIE function is applied.

When the fast TCB attack is detected, the defensive unit 150 establishes a method of blocking the number of accesses per unit time as a first corresponding policy. If the first response policy is not effective, the defensive unit 150 establishes a second response policy that blocks an attack agent that does not operate at the browser level through HTTP Redirection. If the attacking agent operates at the browser level, the defending unit 150 should establish a policy to detect whether the subject attempting to make a TCP connection is a human or a browser-capable bot.

If a slow TCB attack is detected, the defensive unit 150 records the average session duration and regards it as a slow TCB attack if the average session duration exceeds 10 times the average session duration, for example, .

4 is a flowchart of a distributed denial of service attack detection method according to an embodiment of the present invention.

Referring to FIG. 4, the detection apparatus 100 collects packets related to network connection and termination of the protection target server 200 (S410). The detection device 100 collects packets related to network connection and termination between the protection target server 200 and the network device 300. Packets related to network connection and termination include SYN packet, SYN_ACK packet, ACK packet, and connection termination (FIN / RST) packet.

The detection apparatus 100 calculates a plurality of detection indices based on the packets related to the network connection and termination (S420). Detection indexes include connection request response rate, Half-Open rate, attack IP distribution, number of TCP sessions, and TCP session duration.

The detection apparatus 100 determines the state of the network connection resource of the protection target server 200 based on at least one detection index (S430). The detection apparatus 100 may determine whether the backlog queue is saturated based on the connection request response rate which is the ratio of the SYN_ACK packet to the SYN packet. The detection apparatus 100 can determine whether the TCP control block is saturated based on the number of TCP sessions and the connection request response rate.

The detection apparatus 100 detects an attack received by the protection target server 200 based on the detection index and the state of the network connection resource (S440). Detector 100 classifies as backlog queue attack, fast TCB attack, and slow TCB attack.

The detection apparatus 100 can detect a backlog queue attack when a plurality of SYN packets are transmitted in an abnormal IP based on the backlog queue saturation and attack IP distribution. Or the detection apparatus 100 can detect a backlog queue attack when the backlog queue is saturated and the number of TCP sessions connected to the TCP control block is smaller than the number of SYN packets.

Detector 100 may detect a TCB attack if the TCP control block is saturated and the number of SYN packets is greater than the number of FIN / RST packets. The detection apparatus 100 can distinguish the TCB attack from the fast TCB attack and the slow TCB attack based on the TCP session duration.

5 is a flowchart of a distributed denial of service attack detection method according to another embodiment of the present invention.

Referring to FIG. 5, the detection apparatus 100 collects packets related to network connection and termination of the protection target server 200 (S510).

The detection apparatus 100 analyzes packets related to network connection and termination and determines whether the backlog queue of the protection target server 200 is saturated (S520). The detection apparatus 100 may determine that the backlog queue is saturated if the ratio of the SYN_ACK packet to the SYN packet is lower than the reference value.

If the backlog queue is saturated, the detection apparatus 100 determines whether the TCP control block of the protection target server 200 is saturated (S530). If the number of TCP sessions is constant and the new connection request is rejected, the detection apparatus 100 may determine that the TCP control block is in a saturated state. The number of TCP sessions can be calculated based on the ACK packet and the FIN / RST packet.

If the TCP control block is not in the saturation state, the detection apparatus 100 detects that the protection target server 200 is being attacked by the backlog queue (S540).

If the TCP control block is in the saturation state, the detection apparatus 100 determines whether the TCP session lasts longer than the reference time (S550). The TCP session duration may be the average connection time of the TCP sessions.

 If the TCP session is shorter than the reference time, the detection apparatus 100 detects that the protected server 200 is being subjected to a quick TCB attack (S560).

If the TCP session is longer than the reference time, the detection apparatus 100 detects that the protected server 200 is under a slow TCB attack (S570).

Until now, distributed denial-of-service attacks have been classified as attacks of attack client 10, such as SYN flooding or Get Attack. However, even if the protected servers receive the same attack, the resource affected by SYN flooding or Get Attack changes depending on the capacity of network resources of each protected server. The attack of the attack client 10 is evolving into various forms. Nevertheless, since defenders do not know which network resources are saturated and reach a denial of service, if a denial-of-service attack occurs, they block the network at all, there was.

However, the detection apparatus 100 detects and responds to an attack based on the status of the network connection resources of the protection target server 200. Therefore, the detection apparatus 100 can know the resource that has reached the denial of service even if the attacking client attacks in various forms. Accordingly, the detection apparatus 100 can respond quickly because it has only to respond to the saturation state of the resource.

In particular, a slow TCB attack exploits a vulnerability in the server program itself or a structural vulnerability in HTTP protocol handling methods such as R.U.D.Y. Therefore, if you want to detect an attack through a specific signature that is found when you use a known attack tool, modify the existing attack tool, or if there are other attack methods that attack the same host resource, analyze the attack, It is not possible to respond effectively to such threats until the work of applying techniques is completed.

However, the detection device 100 can detect a slow TCB attack based on TCP session duration, regardless of the type of local signature the attack tool has.

The embodiments of the present invention described above are not implemented only by the apparatus and method, but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (22)

A detection device for detecting a distributed denial of service attack on a protected server,
A packet collector for collecting network packets related to network connection and termination between the protected server and the network device,
Monitoring a state of a network connection resource of the protected server based on the network packet and detecting an attack of the network connection resource based on the state of the network connection resource;
. The method of claim 1,
The network packet
A connection request (SYN) packet, a connection request response (SYN_ACK) packet, a final acknowledgment (ACK) packet, and a connection termination (FIN / RST) packet related to TCP connection and termination. The method of claim 1,
The detection unit
Monitoring a state of the network connection resource including a backlog queue and a TCP control block (TCB) on the basis of the network packet, and based on the state of the network connection resource, Block (TCP Control Block, TCB) attack. 4. The method of claim 3,
The detection unit calculates at least one detection index based on the network packet, monitors the status of the network connection resource based on the at least one detection index,
Wherein the detection indicator includes at least one of a connection request response rate, an attack IP distribution, a number of TCP sessions, and a TCP session duration, which are ratios of connection request response (SYN_ACK) packets for a connection request attempt (SYN) Detector. 5. The method of claim 4,
The detection unit
Detecting a backlog queue attack based on at least one of a connection request response rate, an attack IP distribution, and the number of TCP sessions. 5. The method of claim 4,
The detection unit
And detecting whether the TCP control block is in a denial-of-service state based on the number of TCP sessions and the connection request response rate. 5. The method of claim 4,
The detection unit
And classifying the TCP control block attack into a fast TCP control block attack and a slow TCP control block attack based on a TCP session duration of the TCP control block. The method of claim 1,
The method of claim 1, further comprising: setting at least one response policy for defending against a denial of service attack of each network connection resource; when detecting an attack of a network connection resource by the detection unit, A defensive portion
Further comprising: 9. The method of claim 8,
The defensive portion
And changes the corresponding policy while monitoring the status of the detected network connection resource. The method of claim 1,
The packet collecting unit
And collecting network packets for each protection target server and managing the collected network packets in a virtual connection information table when a plurality of protection target servers are connected to the network device. 11. The method of claim 10,
The detection unit
Monitors the status of network connection resources of each protected server based on the virtual connection information table, and detects a distributed denial of service attack directed to a protected server based on the virtual connection information table. A method for a distributed denial of service attack detection device to detect a distributed denial of service attack on a protected server,
Collecting network packets related to network connection and termination of the protected server,
Calculating a plurality of detection indices based on the network packet,
Determining a state of a network connection resource including a backlog queue and a TCP control block (TCB) of the protected server based on at least one detection index among the plurality of detection indices; and
Detecting at least one of a backlog queue attack and a TCP control block attack based on the state of the network connection resource
And a distributed denial of service attack detection method. The method of claim 12,
The step of collecting the network packet
And collecting the network packets between the protected server and the network device to and from the protected server. The method of claim 12,
The step of calculating the plurality of detection indices
Based on the network packet including at least one of a connection request attempt (SYN) packet, a connection request response (SYN_ACK) packet, a final acknowledgment (ACK) packet, and a connection termination (FIN / RST) packet related to TCP connection and termination And calculating the plurality of detection indices. The method of claim 14,
The step of calculating the plurality of detection indices
A distribution for calculating a detection index including at least one of a connection request response rate, an attack IP distribution, a number of TCP sessions, and a TCP session duration, which is a ratio of the connection request response (SYN_ACK) packet to the connection request attempt (SYN) How to detect denial of service attacks. 16. The method of claim 15,
The step of determining the status of the network connection resource
And determining whether the backlog queue is in a denial-of-service state based on at least one of the connection request response rate, the attack IP distribution, and the number of TCP sessions. 16. The method of claim 15,
The step of determining the status of the network connection resource
And determining whether the TCP control block is in a denial-of-service state based on the number of TCP sessions and the connection request response rate. The method of claim 12,
The step of detecting at least one of the backlog queue attack and the TCP control block (TCB) attack
And classifying the TCP control block attack as a fast TCP control block attack and a slow TCP control block attack based on a TCP session duration of the TCP control block. A method for a distributed denial of service attack detection device to detect a distributed denial of service attack on a protected server,
Collecting network packets related to network connection and termination of the protected server,
Determining whether a backlog queue of the protection target server is saturated based on the network packet,
Determining whether a TCP control block (TCB) of the protected server is saturated based on the network packet when the backlog queue is in a saturated state,
Detecting a backlog queue attack on the backlog queue if the TCP control block is not saturated; and
Detecting a TCP control block attack on the TCP control block when the TCP control block is in a saturation state;
And a distributed denial of service attack detection method. 20. The method of claim 19,
The step of detecting the TCP control block attack
And classifying the TCP control block attack as a fast TCP control block attack and a slow TCP control block attack based on a TCP session duration of the TCP control block. 20. The method of claim 19,
The network packet includes a connection request challenge (SYN) packet and a connection request response (SYN_ACK) packet related to TCP connection and termination,
The step of determining whether the backlog queue is saturated
And determining that the backlog queue is in a saturation state when the ratio of the connection request response (SYN_ACK) packet to the connection request attempt (SYN) packet is lower than a reference value. 20. The method of claim 19,
The step of determining whether the TCP control block is saturated
When the number of TCP sessions in the TCP control block is constant and the new connection request is rejected, the TCP control block is judged to be in a saturated state,
Wherein the number of TCP sessions is calculated based on a final acknowledgment (ACK) packet and a connection end (FIN / RST) packet among the network packets.

Images