KR20160112661A - Method and apparatus for protecting network from distributed denial of service attack - Google Patents

Abstract

The present invention provides a method and an apparatus for protecting a network from distributed denial of service attack. The method for protecting a network from distributed denial of service attack in a network management server according to an embodiment of the present invention may include a step of receiving traffic pattern information from a client terminal, a step of generating a packet control rule based on the traffic pattern information, and a step of transmitting the packet control rule to network equipment corresponding to the client terminal. Therefore, the distributed denial of service attack can be more adaptively defended by interlinking with the network management server and the client terminal.

Description

 [0001] The present invention relates to a distributed denial of service attack method and apparatus,

The present invention relates to a defense against distributed denial of service attacks on a network, and more particularly to a network distributed denial of service attack defense method capable of adaptively preventing a distributed denial of service attack through interworking with a client terminal, and an apparatus therefor will be.

In general, a distributed denial of service (DDoS) attack causes an attack that interferes with the normal operation of the server or causes the server to shut down by causing multiple computers connected to the network to operate simultaneously, It says.

To attack a specific server or web site, a hacker can install a program for DDoS attacks on multiple computers, and then the program on that computer simultaneously creates a huge amount of packets that can not be processed by the attacked server or website To the attack target server. As a result, a DDoS attack causes excessive packet reception at the attack target server, thereby causing an overload.

For example, a DDoS-attacked web site can not be accessed normally, and in severe cases, the hardware of a network device or a server may be damaged.

In addition, computer systems with DDoS attack tools installed on any path can be used as a DDoS attack system without their knowledge. One of the most widely known DDoS attack tools in the past is Trinoo, Tribal Flood Network (TFN), and Stacheldraht. In recent years, NetBot, a botnet, , And Black Energy (BlackEnergy).

The DDoS attack tool penetrates the computer system of the general public through various paths such as worms and viruses.

Conventional DDoS attack detection and blocking technologies have been used to detect and block DDoS-specific attack patterns or to protect servers and network equipment by limiting traffic at the network or server side. In this paper, we propose a new attack pattern, which is to generate a modulated packet in a specific form for each DDoS to load the server. Typical examples are TCP SYN Flood, TCP Flag Flood, HTTP Flood, UDP Flood, ICMP Flood .

Most conventional DDoS attack detection technology is a method of judging DDoS attack when the traffic on the network suddenly increases suddenly in a normal situation. In other words, the conventional attack criterion simply compares how much traffic has suddenly increased compared to the past.

This type of attack detection scheme is very inadequate to detect DDoS attacks in the application layer. The reason for this is that it is very difficult to detect attacks based on the amount of traffic, because the recent amount of DDoS attacks on the application layer is not large enough to exceed the normal range of traffic.

Particularly, not only are the types of services provided for each client terminal vary, but packet types and sizes to be transmitted / received for each service type may be different. In addition, the service type provided by the time zone server may be different.

Accordingly, in the related art, a DDoS attack is not detected and a blocking method is not provided for each client terminal.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a network distributed denial of service attack prevention method and apparatus.

It is another object of the present invention to provide a network distributed denial of service attack defense method capable of protecting a distributed denial of service attack by receiving real-time traffic pattern information from a client terminal in a network management server and controlling the network equipment adaptively.

Yet another object of the present invention is to provide a network distributed denial of service attack defense method and an apparatus therefor, which adaptively adapt to a distributed denial of service attack by adaptively changing a traffic pattern when a DDoS attack is detected.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, unless further departing from the spirit and scope of the invention as defined by the appended claims. It will be possible.

The present invention provides a network distributed denial of service attack defense method and apparatus therefor.

A method of protecting a distributed denial of service attack in a network management server according to an embodiment of the present invention includes receiving traffic pattern information from a client terminal, generating a packet control rule based on the traffic pattern information, And sending the packet control rules to the corresponding network equipment.

Here, the traffic pattern information may be generated by the client terminal based on a service currently provided by the client terminal.

In addition, the network management server may generate the packet control rule based on a plurality of the traffic pattern information received from the different client terminals.

The method may further include receiving modified traffic pattern information from the client terminal. When the changed traffic pattern information is received, the packet control rule may be updated based on the changed traffic pattern information and then transmitted to the network equipment have.

The client terminal may change a current traffic pattern and transmit the changed traffic pattern information to the network management server when a distributed denial of service attack is detected.

Also, the network device may include at least one of a router, a server accommodating device, and a client terminal network device.

Here, the router may include at least one of a backbone router, an edge router, and an access router.

In addition, the traffic pattern information may include at least one of packet size information, protocol information used for packet transmission, and packet fragmentation information.

The packet control rule may include rules for discarding packets having a specific traffic pattern, rules for filtering packets having a specific traffic pattern to be routed to corresponding client terminals, rules for routing packets having a specific traffic pattern to a predetermined device, And a rule for controlling the amount of packets transmitted to the client terminal.

According to another embodiment of the present invention, a computer-readable recording medium having recorded thereon a program for executing any one of the distributed denial of service attack defense methods can be provided.

A network management server for defending a distributed denial of service attack on a network according to another exemplary embodiment of the present invention includes a communication unit for receiving traffic pattern information from a client terminal on the network, a traffic classifying unit for classifying the traffic pattern information into network equipment units A packet control rule generation unit for generating a packet control rule for each network device based on the classified traffic pattern information and a control unit for transmitting the generated packet control rule to the corresponding network equipment through the communication unit can do.

Here, the traffic pattern information may be generated by the client terminal based on a service currently provided by the client terminal.

When the changed traffic pattern information is received from the client terminal, the packet control rule generator updates the packet control rule based on the changed traffic pattern information, and the controller transmits the updated packet control rule to the corresponding network equipment Lt; / RTI >

The client terminal may change a current traffic pattern to a different traffic pattern and transmit information on the changed traffic pattern to the network management server when a distributed denial of service attack is detected.

Also, the network device may include at least one of a router, a server accommodating device, and a client terminal network device.

Here, the router may include at least one of a backbone router, an edge router, and an access router.

In addition, the traffic pattern information may include at least one of packet size information, protocol information used for packet transmission, and packet fragmentation information.

The packet control rule may include rules for discarding packets having a specific traffic pattern, rules for filtering packets having a specific traffic pattern to be routed to corresponding client terminals, rules for routing packets having a specific traffic pattern to a predetermined device, And a rule for controlling the amount of packets transmitted to the client terminal.

The attacker may further include an attack characteristic analysis unit for analyzing an attack characteristic based on a packet received from the network device, and may transmit information on the analyzed attack characteristic to the client terminal.

The network device may further include a routing table for identifying a connection relationship between the client terminal and the network device. The traffic pattern information collector may classify the traffic pattern information for each network device by referring to the routing table.

A client terminal that defends a distributed denial of service attack in cooperation with a network management server according to another embodiment of the present invention includes a traffic pattern extracting unit for extracting a traffic pattern corresponding to a currently provided service, And a traffic pattern changing unit for changing the traffic pattern when the distributed denial of service attack is detected, and a traffic pattern change unit for changing the traffic pattern when the distributed denial of service attack is detected, .

It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. And can be understood and understood.

Effects of the method and apparatus according to the present invention will be described as follows.

First, the present invention is advantageous in that it provides a method and an apparatus for defending a network distributed denial-of-service attack based on a server.

Second, the present invention has an advantage of providing a distributed denial-of-service attack defense method capable of detecting a distributed denial-of-service attack in units of client terminals through an interoperation with a client terminal and adaptively blocking the denial-of-service denial attack.

Third, the present invention provides an advantage of adaptively adapting to various DDoS attacks by providing a network management server that controls packet processing operations on network devices adaptively based on real-time traffic pattern information received from a client terminal .

Fourth, the present invention provides a client terminal capable of changing a traffic pattern and transmitting changed traffic pattern information to a network management server when a DDoS attack is detected, thereby being capable of responding to a distributed denial of service attack quickly.

Fifth, according to the present invention, when a DDoS attack is detected, the network management server analyzes attack patterns on a server basis, statistically processes the statistics, and provides a statistical processing result to client terminals, thereby enabling a client terminal to select a traffic pattern that can avoid a DDoS attack There are advantages.

The effects obtained by the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description will be.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention. It is to be understood, however, that the technical features of the present invention are not limited to the specific drawings, and the features disclosed in the drawings may be combined with each other to constitute a new embodiment.
1 is a block diagram illustrating a system configuration according to an embodiment of the present invention.
2 is a flowchart illustrating a network distributed denial of service attack defense procedure according to an embodiment of the present invention.
3 is a flowchart illustrating a network distributed denial of service attack defense procedure according to another embodiment of the present invention.
4 is a block diagram illustrating a configuration of a customer server according to an embodiment of the present invention.
5 is a block diagram illustrating a configuration of a network management server according to an embodiment of the present invention.
6 is a view for explaining traffic pattern information transmitted by a customer server according to an embodiment of the present invention.
7 to 9 are views for explaining traffic pattern information transmitted by a customer server according to another embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an apparatus and various methods to which embodiments of the present invention are applied will be described in detail with reference to the drawings. The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiments, it is to be understood that the invention is not limited to the disclosed embodiments. That is, within the scope of the present invention, all of the components may be selectively coupled to one or more of them. In addition, although all of the components may be implemented as one independent hardware, some or all of the components may be selectively combined to perform a part or all of the functions in one or a plurality of hardware. As shown in FIG. The codes and code segments constituting the computer program may be easily deduced by those skilled in the art. Such a computer program can be stored in a computer-readable storage medium, readable and executed by a computer, thereby realizing an embodiment of the present invention. As the storage medium of the computer program, a magnetic recording medium, an optical recording medium, a carrier wave medium, or the like may be included.

It is also to be understood that the terms such as " comprises, "" comprising," or "having ", as used herein, mean that a component can be implanted unless specifically stated to the contrary. But should be construed as including other elements. All terms, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used terms, such as predefined terms, should be interpreted to be consistent with the contextual meanings of the related art, and are not to be construed as ideal or overly formal, unless expressly defined to the contrary.

In describing the components of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are intended to distinguish the constituent elements from other constituent elements, and the terms do not limit the nature, order or order of the constituent elements. When a component is described as being "connected", "coupled", or "connected" to another component, the component may be directly connected to or connected to the other component, It should be understood that an element may be "connected," "coupled," or "connected."

1 is a block diagram illustrating a system configuration according to an embodiment of the present invention.

1, a system according to the present invention includes a network management server 10, a customer server 20, a customer server network equipment 30, an edge router 40, a backbone router 50, An Internet data center (IDC) 60, an international gateway 70, an external Internet service provider 80, and the like.

The client server 20 is an example of a client terminal according to the present invention. The client server 20 includes a web server for providing various web services, a game server for providing a game service, a financial server for providing financial services, an advertisement server for providing an advertisement service, . ≪ / RTI > Another example of the client terminal may include a personal terminal such as a smart phone, a notebook, and a wearable device as well as a fixed terminal such as a tablet PC.

It should be noted that the above-described system configuration is not necessarily essential, and some configurations may be added or deleted depending on the operator's network design.

The network management server 10 may perform a series of control procedures for protecting a DDoS attack generated in the network based on the traffic pattern information received from the client terminal. Hereinafter, a case where the client terminal is a customer server 20 such as a web server, a game server, or the like will be described as an example. 1, the customer server includes a customer server 20 connected to the customer server network equipment 30 and first to nth customer servers 63 connected to the server accommodation equipment 61 .

For example, the network management server 10 can collect, in real time, information on a traffic pattern currently being generated from the customer server from the customer server. Thereafter, the network management server 10 may generate a packet processing rule for each network device based on the collected traffic pattern information, and may transmit the generated packet processing rule to the corresponding network device. Subsequently, the network device can process the packet according to the received packet processing rule.

Here, the packet processing rule may include at least one of information on the packet size, information on the packet fragmentation rule, information on the packet protocol, information on the IP packet version, and IP packet identifier information .

In addition, the network device may include at least one of a router constituting the network, where the router may be a subscriber-only access router (not shown), an edge router 40 and a backbone router 50, Here, the customer server network equipment 30 may include an access router that provides a hub function of the home network, a server accommodation equipment 61, and the like.

Therefore, different packet processing rules can be generated depending on the type of the client server connected to the network device and the network connection structure of the network device.

For example, referring to FIG. 1, a packet processing rule corresponding to a server accommodating equipment 610 to which a customer server network equipment 30 to which one customer server 20 is connected and first to nth customer servers 63 are connected, May be different from each other.

1 does not show a direct communication line between the backbone router 50 and the network management server 10 but this is only one embodiment and another embodiment of the present invention is a network management server 10 ) May be connected directly to the backbone router 50 between the lines.

The Internet data center 60 is installed when the customer server needs to be collected and concentrated and may be constituted by first to nth customer servers 63 connected to the server accommodating equipment 61 and the server accommodating equipment 61 have. For example, the Internet data center 60 may be used for the integrated management of a plurality of servers that process a large amount of real-time data such as an online game.

A plurality of edge routers 40 and a plurality of Internet data centers 60 may be connected to the backbone router 50. Also, the backbone router 50 may be connected to an external Internet service server 80 connected to another network and an international gateway 70 providing a connection to an overseas network.

2 is a flowchart illustrating a network distributed denial of service attack defense procedure according to an embodiment of the present invention.

Referring to FIG. 2, the customer server 20 can transmit the detected traffic pattern information to the network management server 10 (S201 to S203) when the traffic pattern currently processed by the customer server 20 is recognized. Generally, traffic types may be different depending on the types of services provided by the customer server 20, and traffic patterns may be different therefrom.

For example, the traffic pattern information may include packet size information, protocol information used for packet transmission, information about packet division transmission, and the like.

The network management server 10 generates a packet control rule corresponding to the received traffic pattern information and transmits a packet control request message including the generated packet control rule to the edge router 40 (S204 to S205).

The edge router 40 may perform packet filtering and routing according to the received packet control rules (S207).

When the DDoS attack is detected, the customer server 20 can change the traffic pattern and transmit the changed traffic pattern information to the network management server 10 (S209 to S213). Here, the customer server 20 judges that a DDoS attack has occurred when a packet of an undesired size, an undesired protocol type, or an undesired segment type is received or the amount of received traffic is equal to or more than a reference value can do.

The network management server 10 updates the packet control rule based on the changed traffic pattern information and transmits a packet control request message including the updated packet control rule to the edge router 40 (S215 to S217).

Thereafter, the edge router 40 can filter and route the received packet according to the updated packet control rule.

A packet control rule according to an exemplary embodiment of the present invention includes rules for discarding a packet having a specific traffic pattern, rules for filtering only packets having a specific traffic pattern, routing the packet to a corresponding customer server, Here, the apparatus may include a rule for routing to the network management server 10 or a separate traffic analysis server (not shown), a rule for controlling the amount of packets transmitted to a specific client server, and the like.

When a packet is received from the edge router 40, the network management server 10 can analyze the received packet to analyze the DDoS attack pattern and transmit the analysis result to the corresponding client server. In this case, the customer server can prevent a possible DDoS attack by changing the traffic pattern according to the received analysis result.

3 is a flowchart illustrating a network distributed denial of service attack defense procedure according to another embodiment of the present invention.

Referring to FIG. 3, the first to nth customer servers 63 included in the IDS 60 may transmit the detected traffic pattern information to the network management server 10 when a traffic pattern is recognized (S301 to S303 ).

The network management server 10 identifies the server accommodating equipment 61 corresponding to the received first to nth traffic pattern information and identifies the first to nth traffic patterns collected from the first to nth customer servers 63, The packet processing rule corresponding to the server accommodation equipment 61 identified based on the information can be generated (S305).

The network management server 10 may transmit the packet control request message including the generated packet processing rule to the identified server accommodating equipment 61 (S307).

The server accommodating device 61 may perform filtering and routing on the received packet based on the received packet processing rule (S309).

The customer server detecting the DDoS attack among the first to nth customer servers 63 may change the traffic pattern and transmit the changed traffic pattern information to the network management server 10 (S311 to S315).

The network management server 10 updates the packet control rule corresponding to the server accommodating equipment 61 based on the changed traffic pattern information and transmits a packet control request message including the updated packet control rule to the corresponding server accommodating equipment 61 (S317 to S319).

Thereafter, the server accommodating device 61 can filter the received packet and route the packet according to the updated packet control rule.

2 to 3, the network management server 10 transmits a packet control rule to the server accommodating device 61 or the edge router 40 based on the traffic pattern information received from the customer server. However, The network management server 10 according to another embodiment of the present invention can also protect the DDoS attack by transmitting a packet control rule to the backbone router 50 and the customer server network equipment 30. [ .

4 is a block diagram illustrating a configuration of a customer server according to an embodiment of the present invention.

4, the customer server 20 may include a communication unit 410, a traffic pattern extracting unit 420, an attack detecting unit 430, a traffic pattern changing unit 440, and a controller 450 have.

The communication unit 410 can perform packet communication with the adjacent device. For example, the communication unit 410 may transmit the traffic pattern information received from the controller 450 to the network management server 10. The communication unit 410 may transmit the packet generated by the customer server 20 to the external network equipment or may process the packet received from the external network equipment and transmit the processed packet to the control unit 450.

The traffic pattern extracting unit 420 can extract a traffic pattern corresponding to a service provided by the customer server 20. The extracted traffic pattern may be transmitted to the controller 450.

The attack detecting unit 430 may analyze the received packet to determine whether or not the packet is a DDoS attack. When the DDoS attack is detected, the attack detection unit 430 may transmit a predetermined event signal to the controller 450. [ At this time, the controller 450 may request the traffic pattern changing unit 440 to update the traffic pattern.

The attack detection unit 430 according to another embodiment of the present invention analyzes the DDoS attack pattern and may transmit the analyzed DDoS attack pattern to the controller 450. [ In this case, the traffic pattern changing unit 440 may change the traffic pattern based on the DDoS attack pattern transmitted from the control unit 450. [

The control unit 450 can control the overall operation of the customer server 20. [

5 is a block diagram illustrating a configuration of a network management server according to an embodiment of the present invention.

5, the network management server 10 includes a communication unit 510, a traffic pattern information collection unit 520, a packet control rule generation unit 530, an attack characteristic analysis unit 540, a routing table 550, And a control unit 560. [0053]

The communication unit 510 may perform packet communication with a neighboring device and transmission / reception of a control message. For example, the communication unit 510 receives traffic pattern information from the customer server and transmits the received traffic pattern information to the control unit 560 or transmits the packet control request message received from the control unit 560 to the corresponding network equipment, , A backbone router 40, a server accommodation equipment 61, a customer server network equipment 30, and the like.

The traffic pattern information collecting unit 520 may collect traffic pattern information on a network device basis. For example, the traffic pattern information collecting unit 520 may group the traffic pattern information received from the first to nth customer servers 63 connected to the server accommodating equipment 61.

The packet control rule generation unit 530 may generate a packet control rule based on the traffic pattern information collected for each network device.

The attack characteristic analyzing unit 540 may analyze the packets routed by the network equipment and extract the DDOS attack characteristics for each client. The extracted DDoS attack characteristic can be transmitted to the corresponding client server. In this case, the customer server can change the traffic pattern by referring to the received DDoS attack characteristic.

In the routing table 550, information for identifying connection relationships of all the nodes constituting the network may be maintained. For example, the traffic pattern information collecting unit 520 may refer to the routing table 550 to identify a customer server connected to a specific network equipment.

The control unit 560 can control the overall operation of the network management server 10.

6 is an IPv4 header structure for explaining traffic pattern information transmitted by a customer server according to an embodiment of the present invention.

6, the IPv4 header 600 includes a Version 601 field, an IP Header Length field 602, a Type of Service field 603, a Total Length field 604, Field 609, a field 606, a field 609, a fragment offset 607, a time to live 608 field, a protocol 609 field, A Header Checksum field 610, a Source Address field 611, and a Destination Address field 612.

The version 601 is information for identifying whether the corresponding IP packet is an IPv4 packet or an IPv6 packet.

The IP header length 602 is information for indicating the total length of the corresponding IP header in units of 32 bits, and the service type 603 is information for identifying the priority of the corresponding IP packet. In general, the priority order can be defined as Voice> Video> Text.

The total length 604 represents the value of the length of the IP header plus the length of the data in bytes. Therefore, the value obtained by subtracting the IP header length 602 from the total length 640 is the data length.

The identifier 605 is a number for identifying each IP packet, and can be used for reassembling the packet.

The flag 606 is information for identifying whether or not the packet is fragmented, and consists of three bits. The first bit (X) is a reserved bit that is not currently used and is always set to zero. The second bit (D) is a bit for identifying whether or not the packet is divided. If it is 1, it means that the packet is not divided. If it is 0, it means that it is divided. The third bit (M) is used as a bit for identifying whether the corresponding IP packet is the last divided packet. For example, if the value of M is 1, it means that the packet is not the last packet to be divided, and if it is 0, it means that it is the last packet to be divided.

The division offset 607 is a value for identifying the order of the divided packets in the packet reassembly and the relative position information of the divided packets in the entire data in units of bytes.

 The TTL 608 indicates the maximum number of hops that the corresponding IP packet can pass through. Each time an IP packet passes through the router, the TTL 608 value is decremented by one and discarded when the TTL 608 value reaches zero.

The protocol 609 means an upper layer protocol stored in the body of the IP diagram. As an example, the upper layer protocol may include ICMP, TCP, UDP, and the like.

The header check sum 610 is an error check code for confirming whether or not the IP header is erroneous at the receiving end.

The source address 611 is a 64-bit IP address for identifying the first transmission node of the IP packet, and the destination address 611 is a 64-bit IP address for identifying a final destination node of the IP packet.

The traffic pattern information according to an embodiment of the present invention may include at least one field included in the IPv4 header 600. In one example, the traffic pattern information may comprise information such as version 601, total length 604, flag 606, protocol 609, and the like.

7 to 9 are views for explaining traffic pattern information transmitted by a customer server according to another embodiment of the present invention.

Figure 7 shows the packet header format of IPv6. 7, the IPv6 header 700 includes a version 701 field, a traffic class 702 field, a flow label 703 field, a payload length field 704, A Next Header field 705, a Hop Limit field 706, a Source Address field 707, and a Destination Address field 708.

The version 701 is set to a constant 6 (Bit Sequence 0110) corresponding to IPv6.

The traffic class 702 consists of information for identifying a service corresponding to a corresponding packet of 6 bits of MSB (Most Significant Bits) and information for identifying a priority of a corresponding packet of 2 bits in length .

The flow label 703 is information for providing a real-time application special service having a length of 20 bits. The flow label 703 maintains the same path so that the packets are not reordered to a router or a switch having multiple outbound paths Quot ;. < / RTI >

The payload length 704 is information having a 16-bit length indicating the payload length in bytes.

The next header 705 is information having an 8-bit length for identifying the type of the next header, and can be used as information for identifying the transport layer protocol used by the payload of the packet. An Extension header field corresponding to the value of the nested header 705 may be added after the next header 705. [ The mapping relationship between the value of the nested header 705 and the extended header is defined as the extended header mapping table 800 of FIG.

The hop limit 706 may correspond to the TTL 608 of the IPv4 header 600 of FIG. That is, it means the maximum number of hops that the corresponding IP packet can pass through. Each time the IP packet passes through the router, the hop limit 706 value is decremented by 1, and when the hop limit 706 value reaches 0, the corresponding IP packet is discarded.

The source address 707 and the destination address 708 each have a length of 128 bits and indicate the IPv6 address of the transmitting node and the receiving node, respectively.

The traffic pattern information according to an embodiment of the present invention may include at least one field included in the IPv6 header 700. In one example, the traffic pattern information includes at least one of the version 701, the traffic class 702, the payload length 704, the nest header 705 and extended header information corresponding to the corresponding nest header 705, And may be configured to include one.

Reference numeral 900 in FIG. 9 is a diagram for explaining the format of a fragmented extension header 900 to be inserted when the value of the next header 705 is 44, that is, when the extension header type is a fragment.

9, the fragmentation extension header 900 includes a nest header 705 field, an 8-bit length reserved field 902, a 13-bit fragment offset 903, a 2-bit length reserved Field 904, a 1-bit M flag (M Flag, 905) field, and a 32-bit identifier (Identification) field 906.

The fragmentation offset 903 is a value for identifying the relative position information of packets divided in the entire data in 8-byte units.

The M flag 905 is used as a bit for identifying whether the corresponding IP packet is the last divided packet. For example, if the value of the M flag 905 is 1, it means that the packet is not the last packet to be divided, and if it is 0, it means that it is the last packet to be divided.

The identifier 906 is a packet identifier generated by the source node, and may be used to recombine the original packet at the receiving node.

It will be apparent to those skilled in the art that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof.

Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

10: Network Management Server
20: Customer server
30: Customer server network equipment
40: edge router
50: backbone router
60: Internet Data Center
61: Server accommodation equipment
420: traffic pattern extracting unit
440: traffic pattern changing section
520: Traffic pattern information collecting unit
530: Packet control rule generation unit

Claims (21)

In a distributed denial of service attack method in a network management server
Receiving traffic pattern information from a client terminal;
Generating a packet control rule based on the traffic pattern information; And
Transmitting the packet control rule to the network equipment corresponding to the client terminal
And a distributed denial of service attack defense method. The method according to claim 1,
Wherein the traffic pattern information is generated by the client terminal based on a service currently provided by the client terminal. 3. The method of claim 2,
And generates the packet control rule based on a plurality of the traffic pattern information received from the different client terminals. 3. The method of claim 2,
Further comprising the step of receiving the changed traffic pattern information from the client terminal, wherein when the changed traffic pattern information is received, the packet control rule is updated based on the changed traffic pattern information and then transmitted to the network equipment. How to defend against denial of service attacks. 5. The method of claim 4,
Wherein the client terminal changes the current traffic pattern and transmits the changed traffic pattern information to the network management server when a distributed denial of service attack is detected. The method according to claim 1,
Wherein the network equipment comprises at least one of a router, a server accommodating equipment, and a customer server network equipment. The method according to claim 6,
Wherein the router comprises at least one of a backbone router, an edge router and an access router. The method according to claim 1,
Wherein the traffic pattern information includes at least one of packet size information, protocol information used for packet transmission, and packet fragmentation information. The method according to claim 1,
The packet control rule includes a rule for discarding a packet having a specific traffic pattern, a rule for filtering only packets having a specific traffic pattern to route to a corresponding client terminal, a rule for routing a packet having a specific traffic pattern to a predetermined device, And a rule for controlling the amount of packets to be transmitted to the mobile station. A computer-readable recording medium on which a program for executing the method according to any one of claims 1 to 9 is recorded. A network management server for defending a distributed denial of service attack on a network,
A communication unit for receiving traffic pattern information from a client terminal on the network;
A traffic pattern information collecting unit for classifying the traffic pattern information into network equipment units;
A packet control rule generator for generating a packet control rule for each network device based on the classified traffic pattern information; And
A control unit for transmitting the generated packet control rule to the corresponding network equipment through the communication unit,
And a network management server. 12. The method of claim 11,
Wherein the traffic pattern information is generated by the client terminal based on a service currently provided by the client terminal. 13. The method of claim 12,
When the changed traffic pattern information is received from the client terminal, the packet control rule generator updates the packet control rule based on the changed traffic pattern information, and the controller transmits the updated packet control rule to the corresponding network device , Network management server. 14. The method of claim 13,
Wherein the client terminal changes a current traffic pattern to a different traffic pattern and transmits information on the changed traffic pattern to the network management server when a distributed denial of service attack is detected. 12. The method of claim 11,
Wherein the network equipment comprises at least one of a router, a server accommodating equipment, and a customer server network equipment. 16. The method of claim 15,
Wherein the router comprises at least one of a backbone router, an edge router, and an access router. 12. The method of claim 11,
Wherein the traffic pattern information includes at least one of packet size information, protocol information used for packet transmission, and packet fragmentation information. 12. The method of claim 11,
The packet control rule includes a rule for discarding a packet having a specific traffic pattern, a rule for filtering only packets having a specific traffic pattern to route to a corresponding client terminal, a rule for routing a packet having a specific traffic pattern to a predetermined device, And a rule for controlling the amount of packets transmitted to the network management server. 12. The method of claim 11,
Further comprising an attack characteristic analysis unit for analyzing an attack characteristic based on a packet received from the network equipment, wherein the network management server transmits information on the analyzed attack characteristic to the client terminal. 12. The method of claim 11,
Further comprising a routing table for identifying a connection relationship between the client terminal and the network device, wherein the traffic pattern information collection unit classifies the traffic pattern information for each network device by referring to the routing table. A client terminal for preventing a distributed denial of service attack in cooperation with a network management server,
A traffic pattern extracting unit for extracting a traffic pattern corresponding to a currently provided service;
A communication unit for transmitting the extracted traffic pattern information to the network management server;
An attack detection unit for analyzing packets received from the network equipment and detecting whether a distributed denial of service attack occurs or not; And
A traffic pattern changing unit for changing the traffic pattern when the distributed denial-
And a client terminal.

Images