KR20230017590A - Method for blocking DDoS traffic for subscriber network - Google Patents

Abstract

The present invention relates to a method for blocking distributed denial of service (DDoS) traffic in a subscriber network, which can automatically detect a DDoS attack in the subscriber network and transmit a notification to an operator. According to one embodiment of the present invention, the method for blocking DDoS traffic in a subscriber network comprises the steps of: analyzing traffic flowing into the subscriber network to determine whether there is a DDoS attack; if it is determined that there is a DDoS attack is, sending an alert message to an operator; and upon receiving instructions from the operator to apply a blocking policy for the DDoS attack, generating the blocking policy and applying the same to an R2 router in the subscriber network. In the method, the blocking policy may involve specifying a target IP addresses to be blocked which transmits the DDoS traffic, and notifying a backbone network connected to the subscriber network of the target IP address to be blocked by using a border gateway protocol (BGP).

Description

Method for blocking DDoS traffic for subscriber network}

The present invention relates to a method for blocking DDoS traffic in a subscriber network capable of stably providing Internet services by effectively bypassing and isolating DDoS traffic caused by zombie PCs.

Recently, transmission routes of malicious software through the Internet have been diversified, and the degree of damage caused by them is increasing every year. Malicious code refers to software intentionally designed to perform malicious activities, such as destroying a system or leaking information, against the user's will and interests. The types of malicious code include viruses, worms, trojans, backdoors, logic bombs, trap doors, hacking tools, and malicious spyware ( spyware, ad-ware, etc. They are equipped with self-replicating or automatic breeding functions, leaking personal information such as user ID and password, controlling the target system, deleting/changing files/destroying the system, denying application/system service, leaking core data, installing other hacking programs, etc. cause problems, and the damage is very diverse and serious.

Due to damage caused by such malicious software or malicious code, damage caused by DDoS (Distributed Denial of Service) has recently emerged as a serious problem. This is one of the hacking methods, and refers to making the system no longer able to provide normal services by distributing and arranging several attackers to simultaneously perform a denial of service attack (DoS).

Conventionally, when a DDoS attack occurs, the operator of the subscriber network directly checks the DDoS traffic information, creates a blocking policy, and directly applies it to the router so that the DDoS traffic is filtered in the backbone network connected to the subscriber network. However, in this case, there is a problem in that it is cumbersome and difficult for the operator of the subscriber network to analyze the traffic and extract aggressive traffic information, and there is also difficulty in that the operator directly accesses equipment such as a router and inputs setting information.

Registered Patent Publication No. 10-0973076

The present invention is to provide a method for blocking DDoS traffic in a subscriber network, which can automatically detect a DDoS attack occurring in a subscriber network and send an alarm message to an operator.

The present invention is to provide a method for blocking DDoS traffic in a subscriber network capable of automatically blocking DDoS traffic using information of zombie PCs collected from a backbone network.

A method for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention relates to a method for blocking DDoS traffic in a subscriber network using an analysis server, which analyzes traffic flowing into the subscriber network to determine whether a DDoS attack has occurred. step; If it is determined that the DDoS attack, sending an alarm message to the operator; and generating a blocking policy and applying the blocking policy to the R2 router of the subscriber network when receiving an instruction from the operator to apply the blocking policy to the DDoS attack. Here, the blocking policy may be to specify an IP to be blocked that transmits DDoS traffic, and to advertise the IP to be blocked to a backbone network connected to the subscriber network using a BGP protocol.

Here, in the step of determining whether the DDoS attack has occurred, if the share of uplink incoming traffic of the R2 router is greater than a threshold value and the share of a specific destination among the share of traffic by destination is greater than or equal to a set value, it is determined that the DDoS attack has occurred. can be identified.

Here, the alarm message may include a destination IP to which the DDoS traffic due to the DDoS attack flows, and respective meta information about the destination IP.

Here, the step of determining whether the DDoS attack has occurred includes: receiving an IP list of zombie PCs used in the DDoS attack in real time or periodically from a traffic analyzer of a backbone network connected to the subscriber network; Learning a discrimination model with learning data generated by using the IP list of the zombie PC; and determining whether a DDoS attack has occurred by applying traffic flowing into the subscriber network to the determination model.

Here, in the DDoS traffic blocking method of the subscriber network according to an embodiment of the present invention, if there is no response to the alarm message within the set time or an automatic setting is received from the operator, the IP where the DDoS attack occurred is the IP to be blocked. , and generating a blocking policy for the IPs to be blocked and applying the blocking policy to the R2 router of the subscriber network.

In addition, the solution to the above problem does not enumerate all the features of the present invention. Various features of the present invention and the advantages and effects thereof will be understood in more detail with reference to specific embodiments below.

According to the method for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention, a DDoS attack occurring in a subscriber network can be automatically detected, and an alarm message can be transmitted to an operator when a DDoS attack occurs. That is, the operator can conveniently manage the subscriber network and respond to DDos through the alarm message.

According to the method for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention, it is possible to automatically block DDoS traffic using information on zombie PCs collected from a backbone network. That is, the backbone network can collect information about zombie PCs through various connected networks, and by sharing this information with each subscriber network, the subscriber network can easily block DDoS traffic automatically when a DDoS attack occurs. .

1 is a schematic diagram showing a system for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention.
2 is a flowchart illustrating a method of blocking DDoS traffic in a subscriber network according to an embodiment of the present invention.
3 is a schematic diagram showing a system for blocking DDoS traffic in a subscriber network according to another embodiment of the present invention.
4 is a flowchart illustrating a method of blocking DDoS traffic in a subscriber network according to another embodiment of the present invention.
5 is an exemplary view showing learning data for learning a discrimination module according to an embodiment of the present invention.

Hereinafter, preferred embodiments will be described in detail so that those skilled in the art can easily practice the present invention with reference to the accompanying drawings. However, in describing a preferred embodiment of the present invention in detail, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the same reference numerals are used throughout the drawings for parts having similar functions and actions.

In addition, throughout the specification, when a part is said to be 'connected' to another part, this is not only the case where it is 'directly connected', but also the case where it is 'indirectly connected' with another element in between. include In addition, 'including' a certain component means that other components may be further included, rather than excluding other components unless otherwise stated. In addition, terms such as “~unit” and “module” described in the specification refer to a unit that processes at least one function or operation, and may be implemented as hardware or software or a combination of hardware and software.

1 is a schematic diagram showing a system for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention.

Referring to FIG. 1 , the system for blocking DDoS traffic according to an embodiment of the present invention may include a backbone network N1, a subscriber network N2, and an analysis server 100.

Hereinafter, a system for blocking DDoS traffic in a subscriber network according to an embodiment of the present invention will be described with reference to FIG. 1 .

The backbone network N1 may be connected to a plurality of subscriber networks N2, and may provide Internet service and the like to each subscriber network N2. The subscriber network N2 may be built in a company, public institution, school, etc., and the subscriber network N2 may be connected to the backbone network N1 through the R2 router R2.

Here, DDoS traffic (A) heading from the backbone network (N1) to the inside of the subscriber network (N2) may occur. In this case, the R1 router (R1) of the backbone network (N1) traffic is dropped due to bandwidth exceeding It can be. At this time, since traffic of general users and DDoS traffic are non-selectively lost, a phenomenon such as paralysis of a server inside the subscriber network N2 occurs.

To solve this problem, CB (Customer Blackhole) can be used when DDoS occurs. That is, the operator 1 of the subscriber network N2 checks the flow information of the DDoS traffic, then creates a blocking policy for the corresponding DDoS traffic and directly applies it to the R2 router R2. In this case, the R1 router R1 of the backbone network N1 may filter the DDoS traffic A to flow the DDoS traffic A into a preset sinkhole router (not shown).

For example, if a DDoS attack is initiated from an unspecified number of hosts to a specific server within the subscriber network N2, the operator 1 sets the IP address of the attack target server within the subscriber network N2 (eg, 1.1 .1.1/32) and attach a specific tag (eg 12345) to the IP. Thereafter, a policy may be set so that IPs including a specific tag are set as a specific community (eg, community 6789:12345) and advertised to the backbone network N1 using BGP (Border Gateway Protocol). In this case, the backbone network N1 may change the next-hop to a sinkhole router for a specific community received through BGP. That is, the backbone network N1 can allow all packets for ip 1.1.1.1/32 of the subscriber network N2 to flow into the sinkhole.

However, in order to apply CB, the operator (1) of the subscriber network (N2) must directly analyze the traffic, extract information about DDoS traffic, access the R2 router (R2) and enter the setting information, but this process This is cumbersome and difficult.

Here, the DDoS traffic blocking system according to an embodiment of the present invention may be implemented so that the analysis server 100 is provided in the subscriber network N2 and CB is applied in the analysis server 100. That is, the analysis server 100 recognizes whether a DDoS attack has occurred, and if a DDoS attack has occurred, it can notify the operator 1 by sending an alarm message, and then respond to the DDoS attack according to the instructions of the operator 1. Blocking policy can be set.

2 is a flowchart illustrating a method of blocking DDoS traffic in a subscriber network using the analysis server 100.

The analysis server 100 may determine whether a DDoS attack has occurred by analyzing traffic flowing into the subscriber network N2 (S110). The analysis server 100 may receive traffic header information for each traffic from the R2 router R2 using sflow or netflow. Then, it is possible to determine whether a DDoS attack has occurred by dividing and analyzing the traffic header information by a certain time unit.

Here, the analysis server 100 may sort the traffic header information for unit time based on the destination IP, and through this, the occupancy rate of each destination IP may be calculated. In addition, the analysis server 100 may receive information about the occupancy rate of uplink incoming traffic of the R2 router R2 from the R2 router R2. Here, the analysis server 100 may determine that a DDoS attack has occurred if the share of uplink incoming traffic of the R2 router is greater than or equal to the threshold and the share of a specific destination IP among the shares of all traffics by destination IP is greater than or equal to a set value. . In other words, if an excessively large amount of uplink inbound traffic flows into the R2 router (R2) and the share of traffic for a specific destination IP among the total traffic is excessively greater than usual, a DDoS attack on the specific destination IP occurs. can be seen as

Depending on the embodiment, it is possible to determine whether it is a DDoS attack by additionally checking whether traffic entering the R2 router R2 shows a specific pattern. That is, in the case of traffic corresponding to a DDoS attack, the traffic is concentrated to a specific destination IP, the source IP is distributed, the TCP/UDP ports of each traffic are often fixed rather than varied, and the packet length is not varied and It is divided into several specific sizes. Accordingly, the analysis server 100 may further consider the pattern of incoming traffic to determine whether it corresponds to a DDoS attack.

When determined as a DDoS attack, the analysis server 100 may transmit an alarm message to the operator 1 (S120). That is, the analysis server 100 may inform the operator 1 that a DDoS attack has occurred in the subscriber network N2 through an alarm message. Here, the analysis server 100 may transmit an alarm message in the form of a text message or instant message to a pre-registered terminal such as a mobile communication terminal, a laptop computer, or a computer of the operator 1.

Depending on the embodiment, the destination IP to which the DDoS traffic flows and meta information on each destination IP may be matched and included in the alarm message. That is, in order to provide information for the operator to determine whether to block traffic for the corresponding destination IP, meta information describing the corresponding destination IP may be matched and provided. In this case, the operator 1 may consider the importance of the service of the target of attack using meta information matched to the destination IP, and accordingly, the operator 1 may determine whether to block traffic for the corresponding service.

In response to the alarm message, when the application of the blocking policy for the DDoS attack is instructed by the operator 1, the analysis server 100 can create a blocking policy and apply it to the R2 router R2 of the subscriber network N2. (S130). Here, the blocking policy specifies the blocking target IP that transmits the DDoS traffic (A), and makes the R2 router (R2) advertise the blocking target IP to the backbone network (N1) connected to the subscriber network (N2) using the BGP protocol. it may be In this case, the R1 router (R1) can specify the DDoS traffic (A) and filter the corresponding DDoS traffic (A) to block the DDoS traffic (A) from flowing into the subscriber network (N2).

3 is a schematic diagram showing a system for blocking DDoS traffic in a subscriber network according to another embodiment of the present invention.

Referring to FIG. 3 , a traffic analyzer 200 may be included in the backbone network N1. The traffic analyzer 200 may collect netflow information in real time from routers located at the network boundary of the backbone network N1, and may calculate traffic volume for each subscriber network. Here, since netflow can be used to search packet header information distributed in real time, it is possible to detect DDoS attacks using this.

DDoS traffic (A) is traffic generated by zombie PCs, and DDoS traffic (A) has a specific pattern form concentrated from numerous source IPs corresponding to each zombie PC to specific 1-2 destination IPs. In addition, DDoS attacks using zombie PCs often occur while changing the timing and target of the attack.

Here, the traffic analyzer 200 may collect IP information of zombie PCs used in the attack in real time or periodically, and analyze the collected IP information of zombie PCs installed in each subscriber network (N2) (100a, 100b, 100c). Thereafter, when the analysis servers 100a, 100b, and 100c detect signs of a DDoS attack, they can create a CB blocking policy based on the IP information of the shared zombie PC, through which DDoS traffic can be blocked in real time.

Specifically, as shown in FIG. 4, the analysis server 100 may analyze traffic flowing into the subscriber network N2 to determine whether a DDoS attack has occurred (S110). At this time, in order to determine whether a DDoS attack has occurred, the analysis server 100 retrieves the IP list of zombie PCs used in the DDoS attack from the traffic analyzer 200 of the backbone network N1 connected to the subscriber network N2. It can be provided in real time or periodically (S111).

Thereafter, the analysis server 100 may learn a discrimination model with learning data generated by utilizing the IP list of the provided zombie PC (S112). That is, when blocking a small amount of traffic from tens of thousands of source IPs, it may be efficient to operate a blocking policy based on destination IPs and ports using machine learning, etc., since there is a performance limit of a router. Therefore, here, the analysis server 100 can learn the discrimination model with learning data using the IP list of zombie PCs.

Specifically, as shown in FIG. 5, learning data can be generated by utilizing the IP list of zombie PCs. That is, from the IP list of the zombie PC, the day of the DDoS attack, the time of occurrence, the number of zombie IPs (the number of IPs corresponding to the zombie source IP among the source IPs generated based on the destination IP), and the number of flows (based on the destination IP) Number of source IPs generated), occupancy based on destination IP, destination IP, destination port, packet length, IP fragment, R2 uplink occupancy (X _n Vector), etc. can be extracted, and then the operator (1 ), learning data can be created by adding the blocking decision (Y label). That is, learning data for supervised learning can be generated by adding information on whether or not the operator 1 has decided to block in each case. Here, the discrimination module may be learned using a multi-layer perceptron neural network model.

When the learning of the determination module is completed, the analysis server 100 may determine whether a DDoS attack has occurred by applying the traffic flowing into the subscriber network N2 to the determination model (S113). That is, upon receiving information corresponding to each X _n Vector, the determination module may output whether Y label has been blocked or whether a DDoS attack has occurred. Depending on the embodiment, it is also possible for the discrimination model to provide a DDoS attack probability for each traffic. In this case, the analysis server 100 detects a DDoS attack only when there is traffic with a DDoS attack probability greater than a threshold value. can be identified as having occurred.

On the other hand, if it is determined that there is a DDoS attack on the subscriber network N2, the analysis server 100 may transmit an alarm message to the operator 1 (S120). That is, the analysis server 100 may inform the operator 1 that a DDoS attack has occurred in the subscriber network N2 through an alarm message. The analysis server 100 may transmit an alarm message in the form of a text message or instant message to a pre-registered terminal such as a mobile communication terminal of the operator 1, a laptop computer, or a computer.

However, in some cases, there may be a case where there is no response to the alarm message within the set time, or the operator 1 makes a reply to proceed with automatic setting. In this case, the analysis server 100 can automatically set the IP where the DDoS attack occurred as the IP to be blocked, create a blocking policy for the IPs to be blocked, and apply it to the R2 router (R2) of the subscriber network (N2). there is.

In addition, depending on the embodiment, an automatic mode in which the analysis device 100 automatically sets a blocking policy may be set in advance. In this case, the analysis server 100 may directly create and apply the blocking policy. there is. When the automatic mode is set in the analysis device 100, the step of transmitting an alarm message from the analysis server 100 to the operator 1 (S120) can be omitted.

On the other hand, if the alarm message is returned within the set time, the analysis server 100 may create a blocking policy according to the instruction received from the operator 1 and apply it to the R2 router R2 of the subscriber network N2. . Here, the blocking policy specifies the blocking target IP that transmits the DDoS traffic (A), and makes the R2 router (R2) advertise the blocking target IP to the backbone network (N1) connected to the subscriber network (N2) using the BGP protocol. it may be

The above-described present invention can be implemented as computer readable code on a medium on which a program is recorded. The computer-readable medium may continuously store programs executable by the computer or temporarily store them for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or combined hardware, but is not limited to a medium directly connected to a certain computer system, and may be distributed on a network. Examples of the medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROM and DVD, magneto-optical media such as floptical disks, and ROM, RAM, flash memory, etc. configured to store program instructions. In addition, examples of other media include recording media or storage media managed by an app store that distributes applications, a site that supplies or distributes various other software, and a server. Accordingly, the above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the foregoing embodiments and accompanying drawings. It will be clear to those skilled in the art that the components according to the present invention can be substituted, modified, and changed without departing from the technical spirit of the present invention.

N1: backbone network N2: subscriber network
100: analysis server 200: traffic analysis device

Claims (5)

In the method of blocking DDoS (Distributed Denial of Service) traffic of a subscriber network using an analysis server,
analyzing traffic flowing into the subscriber network to determine whether a DDoS attack has occurred;
If it is determined that the DDoS attack, sending an alarm message to the operator; and
When receiving an instruction from the operator to apply the blocking policy to the DDoS attack, generating a blocking policy and applying it to the R2 router of the subscriber network,
The blocking policy
A method for blocking DDoS traffic in a subscriber network comprising: specifying an IP to be blocked that transmits DDoS traffic, and advertising the IP to be blocked to a backbone network connected to the subscriber network using a BGP protocol.
The method of claim 1, wherein the step of determining whether the DDoS attack has occurred
The method of blocking DDoS traffic in a subscriber network for determining that the DDoS attack has occurred if the share of uplink incoming traffic of the R2 router is equal to or greater than a threshold value and the share of a specific destination among the share of traffic by destination is equal to or greater than a set value.
The method of claim 1, wherein the alarm message
The DDoS traffic blocking method of the subscriber network comprising a destination IP to which the DDoS traffic due to the DDoS attack flows, and respective meta information about the destination IP.
The method of claim 1, wherein the step of determining whether the DDoS attack has occurred
receiving an IP list of zombie PCs used for DDoS attacks in real time or periodically from a traffic analyzer of a backbone network connected to the subscriber network;
Learning a discrimination model with learning data generated by using the IP list of the zombie PC; and
and determining whether a DDoS attack has occurred by applying the traffic flowing into the subscriber network to the discrimination model.
According to claim 4,
If there is no response to the alarm message within the set time or if an automatic setting is received from the operator, the IP where the DDoS attack occurred is set as the IP to be blocked, and a blocking policy for the IPs to be blocked is created to ensure that the subscriber network DDoS traffic blocking method of a subscriber network comprising the step of applying to the R2 router of the.

Images