KR20190041324A - Apparatus and method for blocking ddos attack - Google Patents

Abstract

The present invention relates to a method and apparatus for blocking distributed denial of service (DDoS) attack based on a user datagram protocol (UDP). To this end, a DDoS attack blocking apparatus in the present invention comprises the steps of: receiving a first query packet in UDP and checking if the IP address of a client that transmitted the first query packet is present in a ticket list; determining whether the client is a new session when the IP address of the client is not present in the ticket list; dropping the first query packet when the client is a new session; and determining whether the client is normal by analyzing a second query packet when the second query packet is received from the client, and issuing, cwhen the client is determined as a normal client, a ticket to the IP address of the client and sending a second query packet to the server.

Description

[0001] APPARATUS AND METHOD FOR BLOCKING DDOS ATTACK [0002]

The present invention relates to a DDoS attack prevention device and method, and more particularly, to a DDoS attack prevention method and a DDoS attack prevention method in a DDOS attack based on UDP (User Datagram Protocol) And more particularly, to a device and method for preventing DDOS attacks.

There are various attacks on the network that threaten the network. Therefore, security equipment is installed in the internal system in order to block such attacks and construct a good network. Among the types of attacks coming from the outside to the internal system are DOS (Denial of Service), DDOS (Distributed Denial of Service) and flooding attacks which threaten network bandwidth, and various other hacking and virus attacks .

Here, a DOS attack refers to an attack method in which a service function of a network is temporarily or completely stopped by introducing harmful traffic to a destination network / server. DDOS attack, a type of DOS attack, is an attack that concentrates traffic on a destination network / server in the form of a plurality of distributed attack programs integrated with each other. It is harder to detect than a general DOS attack and is much more destructive Lt; / RTI > DDOS attacks are dealing with a large amount of harmful traffic while depleting the resources of the entire network.

DDOS attacks are classified into network-based attacks and application-based attacks. Here, UDP-based DDOS attacks occur most commonly in network-based attacks because UDP can increase the packet size by adding datagrams, which can easily cause bandwidth depletion to the attacked network to be. And UDP has a problem that it is easy to modulate IP due to its characteristics.

Due to the above-described features of UDP, the UDP DDOS attack may perform a large-scale attack on a plurality of clients as shown in FIG. 1A, or a small number of clients may attack a plurality of random IPs Forged IPs and falsified random IPs. At this time, the attacked server 40 causes a problem that arbitrary data traffic is caused. In addition, unlike the normal UDP service, the Domain Name System (DNS) service among the UDP service generates a load on the server (or system) in the response to the request. That is, when the DNS server receives the DNS request packet, it searches the destination IP address corresponding to the DNS request and loads the retrieved IP address into the response packet again. Therefore, the DNS server is more likely to overload The server may be down.

Also, in the case of a DDOS attack to the DNS server, as shown in FIG. 1C, there is a method in which a plurality of domain names are randomly generated in the attacker's IP and attacked using the generated domain name. Here, the domain names generated in the attacker IP can be transmitted to the DNS server 40 regardless of whether the domain names are actually existent. In the DNS server 40, an overload occurs due to the process of checking randomly generated domains in the attacker IP . Here, if a randomly generated domain is a real domain, a response may be made in the midst of search, but if it is a domain that is not actually present, the load will be higher because all information stored in the database must be searched.

In this connection, there is a normal client recognition method using a truncated bit of UDP DNS. Specifically, this method is performed through the flow shown in FIG. 2A.

First, the client 10 transmits a UDP DNS request packet. At this time, the security device 2 transmits a DNS response packet to the client 10, sets the committed bit in the DNS response packet, and transmits the DNS response packet in which the traced bit is set to the client 10 . Here, if the client 10 transmits a TCP DNS request packet according to a request of the security device 2, it determines that the client is a normal client, and transmits another packet (for example, a UDP DNS request packet or another kind of packet) The client is judged to be an abnormal client. That is, the normal client recognition technique using the trained bits is performed by checking whether the client 10 transmits the correct packet in response to the request of the security device 2. However, this method has the following problems.

First, in the case of using the trained bit, the client 10 must use TCP instead of UDP to obtain the IP address for the desired domain. Unlike UDP, TCP emphasizes reliability between a client and a server. Therefore, a 3-way handshake process for a communication connection must be performed. Therefore, there is a problem in terms of speed and complexity as compared with UDP.

Second, there is a problem that the service bandwidth is wasted in the method using the trained bits. That is, in order to check whether the client 1 is normal, a method using a trained bit must transmit a response packet for a response and a material, so that a service bandwidth will be amplified twice. In addition, the above method is applicable only to the request signal to the DNS server, and it is difficult to determine whether the request is normal for other general requests.

Third, in the method using the committed bit, the security device 2 is highly likely to be used as an attack server of a redirection attack. For example, assume that the first client 11 tricks its own IP into the second client 12 and sends a DNS request packet to the security device 2, as shown in FIG. 2B. At this time, since the IP of the received DNS request packet is for the second client 12, not the first client 11, the security device 2 transmits the committed bit to the second client 12. This example is a flow when there is one attacker, and when there are a large number of attackers, or when one attacker attacks multiple IP addresses, the security device (2) Generated bits and send all of them to the second client 12. In this case, communication and system load between the security device 2 and the second client 12 may be increased, resulting in a failure, and the security device 2 may unintentionally become an attacker.

Therefore, a new technique that can block the attack in case of DDOS attack based on UDP and can separate the attacked IP and the normal client faster is required.

Korea Patent No. 0481614

An object of the present invention is to provide a DDOS attack blocking device and method capable of quickly determining whether a client is normal using only an incoming UDP packet when a UDP-based DDOS attack occurs.

In order to solve the above problems, the DDOS attack blocking device of the present invention is connected to a server to block a UDP-based DDOS attack to a server, and the device stores a temporary ticket and a ticket list in which an IP address on which a ticket is issued is stored A ticket list database including; A ticket confirmation unit for receiving the first query packet in UDP and for confirming whether the IP address of the client that transmitted the first query packet exists in the ticket list; A new session determination unit determining whether the client is a new session when the IP address of the client is not present in the ticket list; A new session processing unit for dropping the first query packet if the client is a new session; And when the second query packet is received from the client, determining whether the client is normal by analyzing the second query packet, issuing a ticket to the client's IP address when the client is determined to be a normal client, And a request processing unit of a material to be transmitted to the server.

In addition, when the client is a new session, the new session processing unit can issue a temporary ticket to the IP address of the client and update the ticket list.

Also, the second query packet may be a query packet sent from the client to which the temporary ticket was issued.

In addition, if the client is a new session and the first query packet is a DNS request packet, the new session processing unit may store the first DNS request information included in the first query packet, and then drop the first query packet.

In addition, when the second query packet is a DNS request packet, the material request processing unit extracts second DNS request information included in the second query packet, compares the first DNS request information with the second DNS request information, 1 and the second DNS request information are the same, the client can be determined as a normal client.

In addition, when the second query packet is a DNS request packet, the material request processing unit extracts second DNS request information included in the second query packet, compares the first DNS request information with the second DNS request information, When the first and second DNS request information are different, the second query packet is dropped, and the IP address of the client that transmitted the second query packet can be added to the black list.

In addition, the material request processing unit may determine that the client is a normal client when the first and second query packets are request packets other than the DNS request packet.

The DDOS attack blocking apparatus according to an embodiment of the present invention may further include a session tolerance value determiner for comparing the number of query sessions received from the plurality of clients with the session tolerance value when the IP address of the client is not present in the ticket list .

Further, the session tolerance determining unit may drop the first query packet when the number of query sessions exceeds the session tolerance value, and the new session determiner may operate when the number of query sessions is less than or equal to the session tolerance value.

The new session processing unit sets a blocking control time for the IP address of the client. The material request processing unit drops the second query packet when the second query packet is transmitted within the blocking control time, and transmits the second query packet You can blacklist one client's IP address.

In addition, if the IP address of the client is included in the ticket list, the ticket checking unit can transmit the first query packet received from the client to the server.

Also, in the DDOS attack blocking apparatus according to an embodiment of the present invention, when the IP address of the client exists in the ticket list, whether the IP address of the client is overflowed or the IP address of the client is attacked And may further include a threshold value and an attack checking unit for dropping the first query packet when the IP address of the client is determined to be abnormal and adding the IP address of the client to the black list.

In order to solve the above problems, a DDOS attack blocking method of the present invention is performed by a DDOS attack blocking apparatus connected to a server, and a ticket inquiry unit receives a first query packet through UDP, Confirming whether the IP address of the transmitted client is present in a ticket list in which the temporary ticket and the IP address to which the ticket is issued are stored; Determining, by the new session determination unit, whether the client is a new session when the IP address of the client is not present in the ticket list; Dropping a first query packet by the new session processing unit if the client is a new session; Determining whether the client is normal by analyzing a second query packet when a second query packet is received from the client by the material request processing unit; And issuing a ticket to the IP address of the client and transmitting the second query packet to the server when the client is determined to be a normal client by the material request processing unit.

In the DDOS attack blocking method according to an embodiment of the present invention, when the client is a new session, the new session processor issues a temporary ticket to the IP address of the client before dropping the first query packet, And updating the ticket list.

The step of dropping the first query packet may be performed after storing the first DNS request information included in the first query packet when the client is a new session and the first query packet is a DNS request packet.

The determining whether the client is normal may include extracting second DNS request information included in a second query packet when the second query packet is a DNS request packet; Comparing the first DNS request information with the second DNS request information; And determining that the client is a normal client when the first and second DNS request information are the same.

The step of determining whether the client is normal may include extracting second DNS request information included in a second query packet when the second query packet is a DNS request packet; Comparing the first DNS request information with the second DNS request information; And determining that the client is an attacker client when the first DNS request information and the second DNS request information are different, dropping a second query packet when the client is determined to be an attacker client, To the black list, the IP address of the client that transmitted the IP address of the client.

In the DDOS attack blocking method according to an embodiment of the present invention, the step of determining whether the client is normal may include determining that the client is a normal client when the first and second query packets are request packets other than the DNS request packet Step < / RTI >

A DDOS attack blocking method according to an embodiment of the present invention includes comparing the number of query sessions received from a plurality of clients with a session tolerance value when the IP address of the client is not present in the ticket list, As shown in FIG.

The DDOS attack prevention method according to an embodiment of the present invention further includes a step of dropping a first query packet when the number of query sessions exceeds a session tolerance value by a session tolerance value determination unit, Can be done when the number of query sessions is below the session tolerance.

The DDOS attack blocking method according to an embodiment of the present invention may further comprise setting a blocking control time for the IP address of the client by the new session processing unit, Dropping the second query packet when the second query packet is transmitted within the block control time, and adding the IP address of the client that transmitted the second query packet to the blacklist.

In the DDOS attack blocking method according to an embodiment of the present invention, when the IP address of the client is included in the ticket list by the ticket checking unit, the step of transmitting the first query packet received from the client to the server .

According to the DDOS attack blocking device and method of the present invention, when a DDOS attack based on UDP occurs, a behavior pattern between an attacker and a normal client is classified and authenticated. Thus, various attack methods can be protected. There is an advantage that no packet modulation is required.

In addition, according to the DDOS attack blocking device and method of the present invention, the process of generating a response packet when a query packet is received is omitted, thereby reducing the load on the device. Furthermore, the possibility that the device can be used as an attack server of a redirect attack Can be excluded.

1A, 1B, and 1C are conceptual diagrams illustrating a UDP DDOS attack method.
2A is a flowchart of a normal client recognition method using a traced bit.
2B is a conceptual diagram for explaining a redirection attack.
3 is a block diagram of a DDOS attack blocking apparatus according to an embodiment of the present invention.
4 is a graph illustrating a session tolerance according to an embodiment of the present invention.
5A to 5C are flowcharts illustrating an operation of a DDOS attack blocking apparatus according to an embodiment of the present invention.
6 is a flowchart illustrating a DDOS attack blocking method according to an exemplary embodiment of the present invention.
7 is a flow diagram of processing a request for a material in accordance with an embodiment of the present invention.
8 is a flow diagram of a process for processing a new session in accordance with an embodiment of the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, a DDOS attack blocking apparatus 100 according to an embodiment of the present invention will be described.

The DDOS attack blocking apparatus 100 according to an embodiment of the present invention is intended to effectively block a UDP-based DDOS attack when a UDP-based DDOS attack occurs. To this end, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention considers the characteristics of a UDP-based DDOS attack. As mentioned above, the UDP-based DDOS attack is mainly used for the following reasons: 1) a method of transmitting a large-sized packet through addition of a datagram, and 2) The IP address is randomly generated from the attacker IP, and the IP address is repeatedly requested for the plurality of randomly generated domain names. . The DDOS attack blocking apparatus 100 according to an embodiment of the present invention has the following features in order to prepare for the above attack types.

First, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention drops a query packet when transmitting a query packet to a UDP from a new session (i.e., a client that first made a request packet to a server). As described above, an attacker may have a pattern of sending a query packet (or a request packet) to one IP, then modulating it to another IP other than the same IP, and transmitting the query packet (or a request packet) again. There is also a pattern in which an attacker repeatedly transmits different query packets. That is, if the same packet as the first query packet is not sent after a certain time since the first query packet is transmitted from one IP, it is highly probable that the attacker is an IP. Accordingly, when the DDOS attack blocking apparatus 100 according to the embodiment of the present invention receives a query packet (hereinafter referred to as a first query packet) in a new session, the DDOS attack blocking apparatus 100 drops the packet, Packet), it is judged to be a normal client.

Second, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention determines whether a query packet is a DNS request packet, and if the query packet is a DNS request packet, the DDOS attack blocking apparatus 100 determines request information included in the first and second query packets When the request information is different, the IP address of the query packet is determined as the attacker IP. This is to prepare multiple domain names randomly from the attacker IP described above, and to prepare for the attack using them. If it is determined that the request information included in the first and second query packets is different, it is determined that the attacker client is not the normal client but drops the packet (i.e., the second query packet) in the same session.

Third, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention judges that the IP is an attacker IP when receiving a query packet continuously in one IP (i.e., when a second packet is received within a specific period) do. In general, only one packet limits the size that can be delivered. Accordingly, if it is desired to send relatively large data that can not be loaded in one packet in the attacker's IP, the corresponding data will be divided into a plurality of subdata, and one subdata will be continuously transmitted in one packet. However, since the size required for a query or a request is usually small, the DDOS attack blocking apparatus according to an embodiment of the present invention determines that the time difference between the received packets is small as an attacker IP and drops the received packet.

Fourth, when a DDOS attack occurs, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention judges whether or not the session is normal only for a whole new session, Drop it. This is to prevent a situation in which the DDOS attack blocking device 100 fails to function due to a load occurring in the normal determination process. Therefore, even if a DDOS attack occurs, normally authenticated clients can forward their packets to the server without any problem, and most query packets transmitted from attacker IPs are dropped, thereby blocking an attack to the server. In addition, it is possible to induce a query packet of a normal client, which is not an attacker, to be transmitted to the server by performing a normal determination as to some of new sessions.

The DDOS attack blocking apparatus 100 according to an embodiment of the present invention can effectively block the UDP-based attack characteristics in consideration of the UDP-based attack even if a UDP-based attack occurs, It has the advantage of distinguishing normal IP and attacker IP.

3 is a block diagram of a DDOS attack blocking apparatus 100 according to an embodiment of the present invention. The UDP DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention includes a black list checking unit 110, a ticket checking unit 120, a limit value and attack checking unit 130, A new session determination unit 150, a new session processing unit 160, a material request processing unit 170, and an unauthenticated IP processing unit 180. In order to facilitate understanding of the present invention, each of the above-described configurations is divided into functional units. Actually, the present invention can be implemented through a single processing unit such as a CPU, MPU, or GPU.

The blacklist checking unit 110 functions to check whether the client 10 that transmitted the query packet corresponds to a black list. To this end, the blacklist checking unit 110 first receives the query packet transmitted from the client 10, and extracts the IP address of the client 10 based on the received packet. The blacklist checking unit 110 checks whether the extracted IP address of the client 10 corresponds to the black list in cooperation with the black list database DB1. Here, the black list database DB1 represents a database managed to be registered in the black list table and blocked for a predetermined time when it is judged to be harmful traffic through the IPS (Intrusion Prevention Systems) engine and the IDS (Intrusion Detection Systems) engine .

If the client 10 corresponds to the black list as a result of the check through the black list checking unit 110, the black list checking unit 110 performs a process of dropping the query packet of the client 10. Otherwise, whether to confirm the authentication IP described below is performed.

The ticket checking unit 120 checks whether the client 10 is an authenticated client by interlocking with the ticket list database DB2. Specifically, the ticket checking unit 120 checks whether the client 10 is an authenticated client by checking whether the IP address of the client 10 exists in the ticket list. As a result, if the client is an authenticated client, the ticket confirmation unit 120 can update the ticket time issued to the client.

Here, the ticket list database DB2 represents a repository for storing a ticket list for allowing an IP address of a certain client 10 to be determined as a normal session. That is, the ticket list is a list storing details of issuance of a traffic ticket so as to determine whether it is a normal session with respect to an IP address or the like of the connecting client 10. The ticket list may also include the issuance of a temporary ticket as described below. For example, the ticket list database (DB2) can store the IP addresses of clients, and whether temporary tickets and tickets are issued, in the form of a table, and the ticket list is generated based on whether temporary tickets and tickets are issued in the stored tables . Due to this characteristic, the ticket confirmation unit 120 can determine whether or not the ticket of the session is issued through the search, and the session in which the ticket exists can be checked after the verification process through the limit value and the attack checking unit 130 To the server (40).

The limit value and attack detection unit 130 are configured to perform additional verification of the client 10 after a ticket is issued to the client 10 through the ticket verification unit 120. The limit value and the attack detection unit 130 may be configured such that the IP address of the client 10 is over Flow, or other attack methods, attack, hack, and virus (or abnormal attack method). If it is determined that the IP address of the client 10 is overflow or abnormal, the IP address of the client 10 is added to the black list database DB1. In addition, since there are various methods for the inspection method through the limit value and attack inspection unit 130, the present invention does not limit it to a specific method.

The session tolerance determining unit 140 is configured to operate when the IP address of the client 10 does not exist in the ticket list, and compares the number of query sessions received from the clients with the session tolerance value. Here, the session tolerance value is a value set to judge whether or not it is normal for only some of the clients that do not have a ticket or temporary ticket. If it is determined that all clients are normal without a session tolerance value, the security device (i.e., the DDOS attack blocking device 100) is more likely to overload or cause system down in the DDOS attack situation. In this case, a situation may occur in which the server 40 is directly exposed to the DDOS attack or all of the query packets to the server 40 can not be delivered.

Accordingly, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention determines whether only some of the clients that do not have a ticket or temporary ticket with a session tolerance are normal. That is, as shown in FIG. 4, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention performs a determination of a new session and a nonauthentication IP process for clients belonging to a session within the session tolerance value s_a , And the DDOS attack blocking device 100 is secured by dropping the query packet transmitted from clients (da) in the area (da). The session tolerance may be, for example, 100 CPS (Connection Per Second), which can be changed to various values depending on the situation.

The new session determiner 150 operates when the IP address of the client 10 is not present in the ticket list and when the number of query sessions is less than or equal to the session tolerance value and determines whether the client is a new session. For example, the new session determination unit 150 can check whether a client that has transmitted a query packet has a past request by searching a database (for example, DB1, DB2, or another database). The new session determination unit 150 may determine that the client 10 is a new session if the IP address of the corresponding client 10 does not exist in the database and conversely if the IP address exists, . Of course, a variety of methods other than the above-described method may be applied to the method of determining whether a new session is established.

When the client 10 is a new session, the new session processing unit 160 issues a temporary ticket to the IP address of the client 10 and updates the ticket list. That is, the new session processing unit 160 issues a temporary ticket to the IP address of the client 10 that has newly transmitted the query packet (hereafter referred to as the first query packet), and stores the IP address of the client in the ticket list database DB2 , And updates the ticket list by adding information indicating that a temporary ticket has been issued.

As described above, among the various UDP-based services, the DNS service has a process of searching for a destination IP address corresponding to a DNS request in response to a request, The server is likely to be overloaded. DDOS attacks on DNS servers also have a pattern in which an attacker attacks multiple random IPs, or an attacker randomly creates multiple domains and sends query packets to randomly generated domains.

In consideration of this characteristic, the new session processing unit 160, when receiving the first query packet from the client 10, determines whether the first query packet is a DNS request. If the first query packet is a DNS request, the new session processing unit 160 transmits DNS request information (hereinafter referred to as first DNS request information) included in the first query packet to the temporary database DB3). Thereafter, the new session processing unit 160 issues a temporary ticket to the IP address of the client 10 and updates the ticket list. Of course, when the first query packet is a request other than the DNS request, the first query packet is immediately dropped without a separate storage process, and the above-described ticket list update process is performed.

In addition, the new session processing unit 160 may set a blocking control time for the client to which the temporary ticket is issued. Here, the blocking control time can be used to identify the time interval of the query packets transmitted from the client, and to determine whether the client is the attacker IP based on the time interval. As described above, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention adopts a method of dropping the first query packet unconditionally upon receiving a query packet transmitted from a plurality of clients. If it is a normal client, it will retransmit the query packet to query the same contents to get the desired information. However, since it takes a certain time to send one query packet from the corresponding client and send the same query packet again, it is possible to determine whether the client is normal by using the blocking control time.

Conversely, assuming that the attacker IP transmits large data, this data will not be contained in one packet and will be divided into a plurality of packets. For example, if the data to be sent from the attacker's IP is 10000 bytes, and only one packet can contain 1024 bytes, the attacker IP divides the data into 10 subdata, and one packet It will transmit 10 packets continuously with sub data. That is, from the viewpoint of the DDOS attack blocking apparatus 100, one packet will be received and another packet transmitted in the same IP shortly after receiving the packet. If the DDOS attack blocking apparatus 100 receives the second query packet within a short time after the drop of the first query packet in consideration of this characteristic (i.e., within the blocking control time), the DDOS attack blocking apparatus 100 transmits the corresponding IP As an attacker's IP. The cutoff control time is set to judge this situation.

Now, it is assumed that the client 10 having issued the temporary ticket has transmitted the second query packet. The blacklist checking unit 110 determines whether the client 10 is blacklisted or not, and transfers the control to the ticket checking unit 120. The ticket checking unit 120 checks whether the IP address of the client 10 exists in the ticket list. In the case of this example, since it is assumed that a temporary ticket is issued to the client 10 through the new session processing unit 160, the ticket check unit 120 searches the ticket list for the temporary ticket It is determined that the client is an issued client. Thereafter, a process is performed in which the query packet transmitted from the client 10 to which the temporary ticket is issued is regarded as the second query packet.

Here, the second query packet indicates a query packet transmitted from the client 10 to which the temporary ticket has been issued in the DDOS attack protection apparatus 100. (For example, 1) the number of query sessions exceeds the session tolerance value, or 2) the DDOS attack prevention device has not been issued a temporary ticket to the client 10, Even if the client 10 resends the same packet in the case where the first query packet is not normally determined as a result of the determination in the attack blocking apparatus 100) It is regarded as the first query packet. When the packet transmitted from the client 10 is regarded as the second query packet (that is, when the query packet is transmitted from the client to which the temporary ticket is issued), the ticket confirmation unit 120 transmits control to the request processing unit 170, .

The material request processing unit 170 analyzes the second query packet when the second query packet is transmitted from the client 10 to which the temporary ticket has been issued so that the issuance of the ticket to the IP address of the client 10 to which the temporary ticket is issued . In order to determine whether to issue a ticket, the material request processing unit 170 may make the following judgments.

First, the material request processing unit 170 determines whether the second query packet has been received (or transmitted) within the block control time. As described above, when a large amount of data is to be transmitted from the attacker's IP, the corresponding data is not transmitted as one packet but is divided into a plurality of subdata and transmitted as a plurality of packets. Accordingly, since these packets are continuously transmitted, when the packet is continuously transmitted from one IP to the DDOS attack blocking device 100, the IP can be determined as the attacker IP. If it is determined that the client is an attacker, the material request processing unit 170 drops the second query packet, removes the temporary ticket issued to the client 10, and adds the address of the client 10 to the black list Can be performed.

In contrast, if the client 10 is a normal client, since the first query packet transmitted from the client 10 is dropped by the new session processing unit 160, the client 10 waits for a predetermined time, (I.e., a second query packet). Here, since it takes a certain time to transmit the second query packet after transmitting the first query packet (i.e., the second query packet is transmitted beyond the block control time), the second query The packet is not dropped.

Then, the material request processing unit 170 determines whether the second query packet is a DNS request packet. As described above, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention determines whether the client is normal in a different manner depending on whether the query packet is a DNS request packet or not. Accordingly, the material request processing unit 170 first determines whether the second query packet is a DNS request packet before deciding whether to issue a ticket to the IP address of the client.

If it is determined that the second query packet is a DNS request packet, the material request processing unit 170 extracts the second DNS request information included in the second query packet, and transmits the first DNS request information stored in the temporary database DB3 . Thereafter, the material request processing unit 170 checks whether the first DNS request information and the second DNS request information are identical. As described above, among the attack types for the DNS server, there is a method in which an attacker randomly creates a plurality of domains and performs a request for those domains (see FIG. 1C). In this case, since the contents of the first query packet and the contents of the second query packet (i.e., DNS request information) are different from each other, the material request processing unit 170 compares the first and second DNS request information, It is possible to judge whether or not the image forming apparatus 10 is normal. As a result of the determination, when the first and second DNS request information are identical, the material request processing unit 170 can determine that the client 10 is a normal client, and then issues a ticket to the IP address of the client 10 Update the ticket list, and forward the second query packet to the server 40. In contrast, when the first and second DNS request information are different, the material request processing unit 170 can determine the client 10 as an attacker client, drop the second query packet, and update the black list.

If the second query packet is a packet other than a DNS request packet, the material request processing unit 170 determines that the client is a normal client, issues a ticket to the IP address of the client 10, And may forward the second query packet to the server 40. [

In the above description, it has been described that the material request processing unit 170 operates regardless of the session tolerance value. However, this is an example only and a method of operating in consideration of the session tolerance value can be considered as in the case of the new session processing unit 160. [

The unauthenticated IP processing unit 180 is operated when the session is a session in which a ticket is not issued and is not a new session. Specifically, the non-authenticated IP processing unit 180 is operated when a client is not a new session and a packet is not issued, and performs processing of a packet transmitted from the client. The unauthenticated IP processing unit 180 is a configuration for processing a client that is not, for example, a malicious client but is not satisfied with the conditions described above due to a communication error. To this end, the unauthorized IP processing unit 180 performs an authentication process for the corresponding client according to whether the number of sessions for which the packet is transmitted to the security device exceeds the unauthorized IP allowable value, with the unauthorized IP allowable value different from the session tolerance value Or drop the packet. Authentication processing performed through the unauthenticated IP processing unit 180 is not limited to a specific method.

In addition, the DDOS attack blocking apparatus 100 according to an embodiment of the present invention may further include a knowledge database and a learning unit (not shown). Here, the learning database is a database that classifies and stores the ticket list. Here, the classifying method is a management method of a ticket list. When a certain band of IP addresses among IP addresses is registered in a ticket list for a certain amount or more, it is considered that the IP address of a certain band is likely to be an IP address band normally desired to communicate . That is, the classifying method classifies a ticket list into a certain class unit (a unit for specifying a range of IP address allocation according to scale to avoid network collision), re-issues the ticket list, stores it in the learning database, Even though an IP address not registered in the ticket list is accessed, the IP address is transmitted to the next state in which the IP address having the normal ticket is transmitted as it is registered in the ticket list.

When the ticket list of the IP address reaches a predetermined value, the learning unit classifies the ticket list into a learning database or checks whether the IP address checked by the ticket checking unit 120 is included in the learning database.

Through the above-described configurations, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention can effectively block various UDP-based attacks, thereby assuring the stability of the server 40. [ Also, the DDOS attack blocking device 100 can manage the load of the device through the concept of the session tolerance value, thereby enabling stable and efficient DDOS management.

In addition, the DDOS attack blocking apparatus 100 according to the embodiment of the present invention does not send a response to the first query packet in the new session processing unit 160, but drops it after a specific process. Accordingly, the DDOS attack blocking apparatus 100 according to an exemplary embodiment of the present invention has an advantage of being able to prevent a situation of becoming a redirection attacker, unlike the prior art using a committed bit for generating a response packet.

5A to 5C are flowcharts illustrating an operation of a DDOS attack blocking apparatus according to an embodiment of the present invention. Specifically, FIG. 5A illustrates a case where a ticket-issuing client transmits a first query packet, FIGS. 5B and 5C show a DDOS attack blocking of the present invention when a ticket is not issued but a new session transmits a first query packet. Fig. 8 is a flowchart for explaining the operation of the apparatus. Fig.

First, the operation flow of the DDOS attack blocking apparatus of the present invention when a ticket-issued client transmits a first query packet will be described (see FIG. 5A).

The client 10 transmits the first query packet. At this time, the DDOS attack blocking apparatus 100 performs a blacklist check on the IP address of the client 10 and a ticket list check process. If the IP address of the client 10 does not correspond to the black list and the ticket is confirmed as the issued IP, the DDOS attack blocking device 100 determines whether the IP address of the client 10 is an overflow or an attack method Attack, hack, and virus (or abnormal attack method).

If it is determined that the IP address of the client 10 is an overflow or a different attack method, the DDOS attack blocking apparatus 100 drops the first query packet and transmits the ticket issued to the IP address of the client 10 And adds the IP address to the blacklist. On the other hand, when the IP address is confirmed as normal, the DDOS attack blocking device 100 forwards the first query packet to the server 40. Thereafter, the server 40 transmits a response according to the first query packet to the client 10 so that normal communication is performed.

Now, the operation flow of a DDOS attack blocking apparatus according to an embodiment of the present invention will be described when a new session to which a ticket is not issued transmits a first query packet (see FIGS. 5B and 5C).

First, the client 10 transmits a first query packet. At this time, the DDOS attack blocking apparatus 100 performs a blacklist check on the IP address of the client 10 and a ticket list check process. If it is determined that the IP address of the client 10 does not correspond to the black list and the ticket is not issued, the DDOS attack blocking apparatus 100 confirms the number of query sessions received from the DDOS attack blocking apparatus 100 do.

Thereafter, the DDOS attack blocking apparatus 100 performs a process of comparing the number of query sessions with the session tolerance value. As described above, when the number of query sessions exceeds the session tolerance value, the DDOS attack protection device 100 drops the first query packet. Here, the situation where the number of query sessions exceeds the session tolerance value means that a DDOS situation has occurred and the DDOS attack interception apparatus 100 has already performed a normal decision process for other clients, thereby indicating a situation where the load is already high. As described above, in the UDP-based DDOS attack method, there is a technique in which one attacker continuously transmits a packet while modulating its own IP. With respect to this attack technique, when the number of query sessions exceeds the session tolerance value, the DDOS attack prevention device 100 of the present invention drops the corresponding packet without any confirmation process, thereby blocking the DDOS attack without generating additional load . In addition, if the client 10 is a normal client, no response will be received, and the first query packet will be retransmitted again, so that no problem will occur.

If the comparison result indicates that the number of query sessions is equal to or less than the session tolerance value, the DDOS attack intercepting apparatus 100 performs a process of verifying that the first query packet is a new session. If it is determined that the first query packet is a new session, a temporary ticket is issued to the IP address of the client 10, a blocking control time is set, a ticket list is updated, and the first query packet is dropped. As mentioned above, when the first query packet is a DNS request packet, the first DNS request information included in the first query packet can be stored in the database. That is, since the DDOS attack blocking apparatus 100 always drops the first query packet, the client 10 does not transmit any response. Accordingly, the DDOS attack intercepting apparatus 100 can effectively prevent a DDOS attack in which one attacker transmits packets continuously while modulating his / her IP without causing a redirection attack. In addition, since it is a method of dropping a response to a first query packet rather than a response, it does not cause a redirection attack. This feature can also contribute to determining whether an attacker IP using the blocking control time described below is used.

Now, it is assumed that the client 10 has transmitted the second query packet. The second query packet indicates a query packet transmitted from the client to which the temporary ticket was issued. Even if the client 10 transmits the same packet to the server 40 over a specific period of time, it is determined that the DDOS attack blocking device 100 does not determine whether the packet is normal or is not a normal packet, 10), it will be considered as the first query packet.

When the client 10 transmits a query packet, the DDOS attack blocking device 100 confirms whether the IP address of the corresponding client 10 is blacklisted or not. In this case, the DDOS attack blocking apparatus 100 can regard the query packet transmitted by the client 10 as a second query packet since it is assumed that a temporary ticket is issued to the client 10.

Thereafter, the DDOS attack blocking device 100 confirms the blocking control time of the client 10 that has transmitted the second query packet. If it is determined that the second query packet transmission time of the client 10 is within the blocking control time, the DDOS attack blocking apparatus 100 determines that the client 10 is an abnormal client (or an attacker client) And drops the second query packet as shown. Thereafter, the DDOS attack blocking apparatus 100 removes the ticket list issued to the client 10, and adds the IP address of the client 10 to the black list. As described above, the blocking control time is utilized to cope with an attack technique for attacking the server 40 with large-sized data in the attacker's IP. The concept of the cut-off control time is described in detail with reference to FIG. 3, and thus redundant description will be omitted.

When the second query packet transmission time exceeds the blocking control time, the DDOS attack blocking device 100 checks whether the second query packet is a DNS request packet. Here, if the second query packet is not a DNS request packet, the DDOS attack blocking apparatus 100 determines that the client is a normal client.

If the second query packet is a DNS request packet, the DDOS attack protection device 100 extracts the second DNS request information from the DNS request packet included in the second query packet. Thereafter, the DDOS attack blocking device 100 compares the first and second DNS request information, and when the information is the same, the client 10 as a normal client, and when the information is different, .

If the client 10 determines that the client 10 is a normal client through the above-described determination techniques, the DDOS attack blocking device 100 issues a ticket to the IP address of the client 10 and delivers the second query packet to the server 40 (See FIG. 5B). Of course, before the DDOS attack blocking device 100 transmits the second query packet to the server 40, it is determined whether the IP address of the client 10 is an overflow or an attack method, an attack, a hacking and a virus (or an abnormal attack method ), As shown in FIG. When it is determined that the IP address of the client 10 is normal, the DDOS attack blocking device 100 delivers the second query packet to the server 40, and the server 40 transmits a request according to the second query packet And transmits the response packet to the client 10 again.

Conversely, if the client 10 is determined to be an attacker client, the DDOS attack blocking device 100 drops the second query packet as shown in FIG. 5C. Thereafter, the DDOS attack blocking apparatus 100 removes the ticket list issued to the client 10, and adds the IP address of the client 10 to the black list.

6 is a flowchart illustrating a DDOS attack blocking method according to an exemplary embodiment of the present invention. As described above, the DDOS attack blocking method according to an embodiment of the present invention not only can block a DDOS attack based on UDP, but can also determine whether a corresponding client is normal using only UDP packets received from a client. A DDOS attack blocking method according to an embodiment of the present invention will now be described with reference to FIG. In the following, the items overlapping with the above-mentioned portions are omitted.

Step S101 is a step of collecting the query packet transmitted from the client by the packet collecting unit. As described above, a client can send a query packet to UDP. Here, the query packet may include DNS request information or other request information.

Step S102 is a step of checking, by the blacklist checking unit, whether the client that has transmitted the query packet corresponds to the black list. As described above, the step S102 may be performed in cooperation with the black list database by checking whether the IP address of the client that has transmitted the query packet corresponds to the black list. If it is determined that the IP address of the client corresponds to the black list, step S102 drops the corresponding packet. Conversely, if the IP address of the client does not correspond to the black list, step S102 transfers control to step S103.

Step S103 is a step of confirming whether the client identified as not corresponding to the black list through the step S102 is the client holding the ticket by the ticket checking unit. Specifically, step S103 may be performed by searching the ticket list database to see if the IP address of the corresponding client exists in the ticket list. If it is confirmed that the IP address of the client is present in the ticket list, control is passed to step S104. Otherwise, control is passed to step S107.

Step S104 is a step of confirming whether the ticket held by the client (i.e., issued to the client's IP address) is a ticket or a temporary ticket by the ticket checking unit. As described above, the DDOS attack blocking method according to an embodiment of the present invention provides a concept of a ticket having a concept of a traffic ticket and a temporary ticket used in verification for issuing a ticket. Here, the temporary ticket is issued to a new session to be determined as a normal state, and the DDOS attack blocking method according to an embodiment of the present invention analyzes the query packet transmitted from the client to which the temporary ticket is issued, do. As a result of the determination in step S104, when a ticket is issued to the client, control is passed to step S105. Otherwise, control is passed to step S106.

Step S105 is a step of checking whether the IP address of the client is an overflow or an attack method, a hacking and a virus (or an abnormal attack method), which is another attack method, through the limit value and the attack inspection part. The description of whether or not the IP address is overflowed and whether or not the IP address is overflowed is described in detail with reference to FIG. 3, so that redundant description will be omitted. As a result of the determination in step S105, if it is determined that the client is a normal client, a process of updating the ticket issued to the IP address of the client and transmitting the first query packet to the server is performed. Control is then passed to the return block.

Step S106 is a step of performing processing on a request for a material transmitted from a client (i.e., a second query packet) by a material request processing unit. To do so, the step S106 is to check whether the client is an attacker by comparing the blocking control time with the time when the second query packet has been transmitted (or received the second query packet). If the second query packet is a DNS request packet And determining whether the client is an attacker in consideration of whether or not the second query packet is a DNS request packet.

If it is determined that the client is the attacker, that is, if the IP of the client is determined to be the attacker's IP, step S106 includes dropping the second query packet, removing the temporary ticket, . On the contrary, if the client determines that the client is the normal client, that is, if the IP of the client is the IP of the normal client, step S106 is a step of issuing a ticket to the client's IP address and updating the ticket list do. Then, in step S106, the second query packet is transmitted to the server.

In step S106, control is passed to step S105 before the second query packet is transmitted to the server, and it is determined whether the IP address of the client is an overflow or an attack, a hacking and a virus (or abnormal attack method) It is possible to further perform the process of confirming whether or not it is possible. The step S106 includes transmitting the second query packet to the server when the IP address of the client is confirmed to be a normal IP even in the confirmation through step S105; otherwise, the second query packet is dropped, the ticket is removed, The process of adding the client's IP to the blacklist can be performed.

Step S107 is a step performed when the IP address of the client that transmitted the first query packet is not present in the ticket list, and the step of comparing the number of query sessions received from the clients with the session tolerance value by the session tolerance value determination unit . The session tolerance value is set to determine whether or not it is normal for only some of these clients (that is, the range that the DDOS attack protection device can accommodate), not all clients without tickets or ad hoc tickets. If it is determined in step S107 that the number of query sessions exceeds the session tolerance, control is passed to step S108 to drop the first query packet. Otherwise, control is passed to step S109.

In step S109, the new session determination unit determines whether the client that transmitted the first query packet is a new session. As described above, the step S109 may be performed by retrieving the IP address of the client from the database. For example, in step S109, it is determined whether there is a history of transmitting a packet from the IP address of the client to the DDOS attack blocking device. If there is no history, the client can be determined as a new session. If it is determined that the client that transmitted the first query packet is a new session, control is passed to step S111. Otherwise, control is passed to step S110.

In step S110, the unauthenticated IP processing unit performs the unauthenticated IP processing. As described above, the step S110 is performed when a client is not a new session but a ticket is not issued, and a non-authentication IP process for the client is performed when the packet is transmitted. Specifically, the step S110 may include comparing the number of query sessions with the unauthorized IP allowable value, dropping the packet transmitted from the client when the number of query sessions exceeds the unauthorized IP allowable value, . Here, the unauthorized IP allowable value is set to be lower than the session allowable value. In addition, various methods may be adopted for the authentication method performed through step S110, and the method is not limited to a specific method.

In step S111, the new session processing unit performs processing for the new session. In step S111, a temporary ticket is issued to the IP address of the client, the ticket list is updated by adding the IP address of the client and the information indicating that the temporary ticket has been issued to the ticket list database, and the blocking control time is set . In addition, considering the specificity with respect to the operation of the DNS server, step S111 may further include determining whether the first query packet is a DNS request packet, and if the first query packet is a DNS request packet, And storing the first DNS request information included in the first DNS request information in the database (temporary database in FIG. 3). After performing the above steps, the step of dropping the first query packet is performed in step S111.

And in the above description, step S106 has been described as being performed regardless of the session tolerance value. However, it is also possible to consider a method in which step S106 is operated after step S107.

7 is a flow diagram of processing a request for a material in accordance with an embodiment of the present invention. As described above, the step of processing a request for a material according to an embodiment of the present invention regards the query packet as a second query packet and performs processing when a query packet is transmitted from the client to which the temporary ticket is issued.

In step S201, it is determined whether the time when the second query packet is transmitted (or the second query packet is received) is within the block control time. As a result of the determination, if the time is within the block control time, the IP of the client that transmitted the second query packet is determined to be the attacker IP and the process of dropping the packet is performed. In step S202, a process of removing the temporary ticket issued to the IP of the client and a process of adding the IP of the client to the blacklist may be performed. On the other hand, if it is determined in step S201 that the time when the second query packet is transmitted (or the second query packet is received) exceeds the block control time, the control is transferred to step S203.

Step S203 is a step of determining whether the second query packet is a DNS request packet. If it is determined that the second query packet is a DNS request packet, control is passed to step S204. Otherwise, if the first and second query packets are not DNS request packets, control passes to step S205 and a ticket is issued to the IP of the corresponding client.

In step S204, the second DNS request information included in the second query packet is extracted, the first DNS request information stored in the database is called, and the first and second DNS request information are compared to determine whether the request information is identical . As a result of the determination, if it is determined that these pieces of information are the same, control is passed to step S205 and a ticket is issued to the IP of the client. Otherwise, the control is transferred to step S206 to drop the packet, a process of removing the temporary ticket issued to the IP of the client, and a process of adding the IP of the client to the blacklist.

8 is a flow diagram of a process for processing a new session in accordance with an embodiment of the present invention. As described above, the processing of the new session is performed when the first query packet is transmitted from the client whose ticket or temporary ticket has not been issued, the number of query sessions does not exceed the session tolerance, and the client is determined as a new session .

In step S301, it is determined whether the first query packet transmitted by the client is a DNS request packet. If it is determined that the packet is a DNS request packet, control is passed to step S302. Otherwise, control is passed to step S303.

In step S302, the DNS request information (i.e., the first DNS request information) stored in the first query packet is stored in the database. Thereafter, control is passed to step S303.

In step S303, a temporary ticket is issued to the IP of the client that has transmitted the first query packet. In step S304, a blocking control time is set. In step S305, the first query packet is dropped. The description of the steps S303 to S305 is made in detail with reference to FIG. 3, so that redundant description will be omitted.

The teachings of the principles of the present invention may be implemented as a combination of hardware and software. In addition, the software can be implemented as an application program that is actually implemented on the program storage unit. The application program can be uploaded to and executed by a machine that includes any suitable architecture. Advantageously, the machine may be implemented on a computer platform having hardware such as one or more central processing units (CPUs), a computer processor, a random access memory (RAM), and input / output (I / . In addition, the computer platform may include an operating system and microinstruction code. The various processes and functions described herein may be part of microcommand codes or a portion of an application program, or any combination thereof, and they may be executed by various processing devices including a CPU. In addition, various other peripheral devices such as additional data storage and printers may be connected to the computer platform.

It is to be understood that the actual connections between system components or process functional blocks may vary depending on how the principles of the present invention are programmed, as some of the constituent system components and methods illustrated in the accompanying drawings are preferably implemented in software It should be further understood. Given the teachings herein, those skilled in the relevant art (s) will be able to contemplate these and similar implementations or configurations of the principles of the invention.

While the exemplary embodiments have been described herein with reference to the accompanying drawings, it is to be understood that the principles of the invention are not limited to these precise embodiments, and that various changes and modifications may be effected within the spirit and scope of the invention It is to be understood that the invention may be practiced by those skilled in the art. All such modifications and variations are intended to be included within the scope of the inventive principles as set forth in the appended claims.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will appreciate that various modifications and equivalent embodiments are possible without departing from the scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: DDOS attack blocking device 110: Blacklist checker
120: ticket confirmation unit 130: limit value and attack inspection unit
140: Session tolerance judging unit 150: New session judging unit
160: New session processing unit 170: Material request processing unit
180: Unauthorized IP processing unit

Claims (22)

A DDOS attack blocking device connected to a server to block a DDoS (Distributed Denial of Service) attack based on UDP (User Datagram Protocol)
A ticket list database including a temporary ticket and a ticket list in which an IP address on which a ticket is issued is stored;
A ticket confirmation unit for receiving a first query packet in UDP and confirming whether an IP address of a client transmitting the first query packet exists in the ticket list;
A new session determination unit determining whether the client is a new session when the IP address of the client is not present in the ticket list;
A new session processing unit for dropping the first query packet if the client is a new session; And
Determining whether the client is normal by analyzing the second query packet when a second query packet is received from the client, issuing a ticket to the IP address of the client when the client is determined to be a normal client, And a request processing unit for transmitting the second query packet to the server. The method according to claim 1,
Wherein the new session processing unit issues a temporary ticket to the IP address of the client and updates the ticket list when the client is a new session. 3. The method of claim 2,
And the second query packet is a query packet transmitted from the client to which the temporary ticket was issued. The method according to claim 1,
The new session processing unit may store the first DNS request information included in the first query packet and drop the first query packet if the client is a new session and the first query packet is a DNS request packet Features a DDOS attack blocking device. 5. The method of claim 4,
If the second query packet is a DNS request packet, the material request processing unit extracts second DNS request information included in the second query packet, compares the first DNS request information and the second DNS request information And determines that the client is a normal client when the first and second DNS request information are the same. 5. The method of claim 4,
The material request processing unit extracts second DNS request information included in the second query packet when the second query packet is a DNS request packet and compares the first DNS request information and the second DNS request information And drops the second query packet when the first and second DNS request information are different from each other and adds the IP address of the client that transmitted the second query packet to the black list. Device. The method according to claim 1,
Wherein the material request processing unit determines that the client is a normal client when the first and second query packets are different request packets than the DNS request packet. The method according to claim 1,
Further comprising a session tolerance value determiner for comparing the number of query sessions received from the plurality of clients with the session tolerance value when the IP address of the client is not present in the ticket list. 9. The method of claim 8,
Wherein the session tolerance determining unit drops the first query packet when the number of query sessions exceeds the session tolerance value, and the new session determiner is operated when the number of query sessions is less than or equal to the session tolerance value. The method according to claim 1,
The new session processing unit sets a blocking control time for the IP address of the client,
Wherein the material request processing unit drops the second query packet when the second query packet is transmitted in the blocking control time and adds the IP address of the client that transmitted the second query packet to the black list DDOS attack blocking device. The method according to claim 1,
Wherein the ticket checking unit transmits the first query packet received from the client to the server when the IP address of the client is included in the ticket list. 12. The method of claim 11,
If the IP address of the client is present in the ticket list, checking whether at least one of an overflow of the client IP address and an attack of the IP address of the client is detected, Further comprising a threshold value and an attack checking unit for dropping the first query packet when an abnormality is determined and adding the IP address of the client to the black list. A DDOS attack blocking method performed by a DDOS attack blocking device connected to a server and blocking a UDP-based DDOS attack to the server,
Receiving a first query packet in UDP by the ticket checking unit and checking whether the IP address of the client that transmitted the first query packet exists in the ticket list in which the temporary ticket and the IP address on which the ticket is issued are stored ;
Determining whether the client is a new session when the IP address of the client is not present in the ticket list by the new session determination unit;
Dropping the first query packet by the new session processing unit if the client is a new session;
Determining whether the client is normal by analyzing the second query packet when a second query packet is received from the client by the request processing unit of the material; And
Issuing a ticket to the IP address of the client and transmitting the second query packet to the server when the client is determined to be a normal client by the material request processing unit . 14. The method of claim 13, wherein prior to dropping the first query packet,
Further comprising: issuing a temporary ticket to the IP address of the client and updating the ticket list by the new session processing unit when the client is a new session. 14. The method of claim 13,
Wherein dropping the first query packet comprises:
When the client is a new session and the first query packet is a DNS request packet, storing the first DNS request information included in the first query packet. 16. The method of claim 15,
Wherein the step of determining whether the client is normal includes:
If the second query packet is a DNS request packet, extracting second DNS request information included in the second query packet;
Comparing the first DNS request information with the second DNS request information; And
And determining that the client is a normal client when the first and second DNS request information are the same. 16. The method of claim 15,
Wherein the step of determining whether the client is normal includes:
If the second query packet is a DNS request packet, extracting second DNS request information included in the second query packet;
Comparing the first DNS request information with the second DNS request information; And
Determining that the client is an attacker client when the first DNS request information and the second DNS request information are different,
Further comprising dropping the second query packet when the client is determined to be an attacker client and adding the IP address of the client that transmitted the second query packet to the black list . 14. The method of claim 13,
Wherein the step of determining whether the client is normal may further include determining that the client is a normal client when the first and second query packets are request packets other than the DNS request packet . 14. The method of claim 13,
And comparing the session tolerance value with the number of query sessions received from the plurality of clients when the IP address of the client is not present in the ticket list, by the session tolerance determining unit. 20. The method of claim 19,
Further comprising dropping the first query packet by the session tolerance value determination unit when the number of query sessions exceeds the session tolerance value,
Wherein the step of determining whether the client is a new session is performed when the number of query sessions is less than or equal to the session tolerance value. 14. The method of claim 13,
Further comprising setting, by the new session processing unit, a blocking control time for the IP address of the client,
Wherein the step of determining whether the client is normal includes:
Dropping the second query packet when the second query packet is transmitted within the block control time and adding the IP address of the client that transmitted the second query packet to the blacklist. How to block attacks. 14. The method of claim 13,
Further comprising the step of transmitting the first query packet received from the client to the server when the IP address of the client is included in the ticket list by the ticket checking unit .

Images