TW201441861A - Network attack-proof sampling detection system and method - Google Patents

Abstract

Disclosed is a network attack-proof sampling detection system and method, including a monitoring device, a plurality of servers and judging devices, wherein the monitoring device receives a plurality of inquiry data packets; at least one of the servers is provided with a detection module and the at least one of the servers with the detection module receives at least one of the inquiry data packets from the monitoring device for the detection modules to proceed sampling detection, thereby analyzing the packet to detect any suspicious information; the judging devices receive the suspicious packet information by the at least one of the servers thereof to analyze the suspicious information and detect any malicious packet information for the control of the monitoring device, thereby reducing whole system operational workload to achieve attack-proof effects.

Description

Sampling detection system and method for defending against network attacks

The present invention relates to a network security technology, and more particularly to a sample detection system and method for defending against network attacks.

DNS is a decentralized database system for managing host name and network address information mapping, so that the host name is associated with the network address information. Therefore, the DNS service is the basis of the Internet, and the attack on the DNS service will be It has a serious impact on the entire network.

Among various network attack methods for DNS, distributed denial of service (DDoS) is a common method used by attackers. DNS that is attacked by this type of attack cannot perform domain name resolution normally, for example, on May 19, 2009. Due to DNS attacks, a rare network failure occurred in mainland China.

At present, there are many methods for preventing network attacks such as DDoS. However, the conventional prevention method is insufficient for the accuracy of DNS abnormal traffic such as DDoS network attacks. In addition, in the prior art, the defense device of the DNS server front end (such as various intrusion detection systems) is generally used for the prevention operation. Since the prevention device has multiple tasks, when the traffic is too large, the protection device is likely to be overloaded and has System expansion is poor, into This is a higher disadvantage.

Therefore, there is a need for a sample detection system and method for mitigating network attacks that can reduce overall system load, have better system scalability, better judgment accuracy, and lower cost.

It is an object of the present invention to provide a sample detection system and method for mitigating network attacks that can reduce overall system load, have better system scalability, and reduce cost.

Another object of the present invention is to provide a sample detection system and method for defending against cyber attacks that can improve the defense effect and reduce the risk of misjudgment.

The invention discloses a sampling detection system for defending against network attacks, which comprises a control device, a plurality of servers and a judging device, wherein the control device is configured to receive a plurality of query packets, and the plurality of servers are in the plurality of servers. At least one server has a detection module, and the server having the detection module receives at least one of the plurality of query packets from the control device, so that the detection module is The at least one query packet is sampled and detected, and then the at least one query packet is analyzed to obtain suspicious query packet information, and the determining device is configured to receive the suspicious query packet information from the server, and analyze the suspicious query packet information to obtain malicious The packet information is queried, and the malicious query packet information is controlled by the control device.

In addition, the present invention further discloses a method for detecting a spoofing network attack, comprising the steps of: receiving a plurality of query packets, performing sample detection on at least one of the plurality of query packets, and analyzing the at least one Query the packet to obtain suspicious query packet information, analyze the suspect The packet information is obtained to obtain malicious inquiry packet information and to control the malicious inquiry packet information.

In an embodiment, the plurality of servers are DNS servers or DNSSEC servers. In addition, the detection module uses a script to sample the at least one query packet at a specific time.

In another embodiment, the detecting module analyzes a source address or a domain name of the at least one query packet to obtain the suspicious query packet information. In addition, the determining device analyzes the query traffic of the source address or the domain name to obtain the malicious query packet information. Moreover, the determining device further analyzes the impact of the query traffic on the server to obtain the malicious query packet information.

In another embodiment, the control device includes an integration module for receiving other malicious query packet information from the other determining device, and then performing the malicious query packet information and the other malicious query packet information through the control device. Control.

The sampling detection system and method for defending against network attacks disclosed by the present invention utilizes a plurality of server load balancing characteristics to detect, by sampling, a query packet received by one of the plurality of servers. In order to prevent the server from being attacked by a network such as DDoS, the sampling detection system and method adopted by the present invention can reduce the overall system load, thereby improving the detection efficiency and reducing the risk of misjudgment. Better system scalability.

1, 3‧‧‧Sampling detection system

10, 30‧‧‧Control device

12, 32‧‧‧ server group

14, 34‧‧‧ judgment device

102, 302‧‧‧ integrated modules

122, 124, 126, 322, 324, 326‧‧ ‧ servers

1225, 3225‧‧‧Detection Module

S20, S22, S24, S26‧‧ steps

Figure 1 is a diagram of a system for sampling detection of defensive network attacks of the present invention. FIG. 2 is a flow chart of steps of a sample detection method for defending against network attacks according to the present invention; and FIG. 3 is another system architecture diagram of a sample detection system for defending against network attacks according to the present invention.

The other embodiments of the present invention will be readily understood by those skilled in the art from this disclosure. Or application.

Please refer to FIG. 1 , which is a system architecture diagram of the sample detection system 1 for defending against network attacks according to the present invention, which mainly defends against network attacks such as DDos. As shown in the figure, the case is applied to the server of the ISP, which has a control device (such as a router, an intrusion prevention system, etc.) 10. A server group composed of a plurality of servers 122, 124, and 126 (DNS Server Farm) 12) and the judging device 14. It should be noted that the number of the above servers is merely an illustration, and the above server is a DNS server or a DNSSEC server.

As shown in FIG. 1, the control device 10 is configured to receive a plurality of query packets, such as DNS or DNSSEC, wherein at least one of the plurality of query packets is transmitted to a server having a detection module. The remaining query packets are transmitted to a server that does not have a detection module (described in more detail below).

In addition, at least one server 122 of the server group 12 has a detection module 1225, wherein the server 122 receives from the control device 10 The at least one query packet. It should be noted that the location and number of the above detection modules are merely illustrative, but are not limited thereto.

Then, the detecting module 1225 that receives the at least one query packet performs sampling detection on the at least one query packet, and then analyzes the at least one query packet to determine whether the at least one query packet is a suspicious query packet and obtains a suspicious query packet. News. Specifically, the detection module 1225 performs a sample detection on the at least one query packet at a specific time by using a self-developed script program, that is, the detection module 1225 does not detect all the query packets. The detection module 1225 is activated at a specific time by the script program to enable the server 122 to perform part-time detection, while the other servers 124 and 126 maintain the original operation, wherein the specific time can be set according to the actual situation.

In this embodiment, the detecting means of the detecting module 1225 mainly includes analyzing whether the source address of the at least one query packet is from a same or similar network address, or whether the at least one query packet includes a large number of queries. The same or similar domain name is used to determine whether the query packet is a suspicious query packet to obtain suspicious query packet information such as a source address or a domain name.

Next, the determining device 14 is configured to receive the suspicious query packet information from the server 122, and analyze the suspicious query packet information to determine whether the at least one query packet is a malicious query packet to obtain malicious query packet information. Specifically, the determining device 14 analyzes the query traffic of the source address or the domain name to determine whether the query traffic is too high, and determines whether the at least one query packet is a malicious query packet to obtain, for example, a source address. or Malicious query packet information for domain name. In addition, the determining device 14 can also analyze whether the impact of the query traffic on the load of the server 122 is too high, and determine whether the query packet is a malicious query packet to obtain a traffic characteristic such as a source address or a domain name. Malicious query packet information.

In this embodiment, the determining device 14 may analyze whether the query traffic for the domain name (or its feature value) exceeds a preset traffic threshold value in a unit time period to determine whether the at least one query packet is a malicious query. Packet. It should be noted that the traffic threshold must take into account the normality of the query of individual domains. For example, if the domain name (or its characteristic value) corresponds to a personal website that is not known, it exceeds every second. 10 times of query traffic can be considered as abnormal traffic, however, if it is for a popular domain name such as google.com, query traffic of more than 100 times per second is completely normal. In addition, the judging device 14 may also analyze the relative query amount (proportion) or the change trend for the domain name (or its feature value) within the unit time period.

Next, the judging device 14 controls the malicious enquiry packet information through the control device 10. Specifically, the determining device 14 provides the malicious query packet information to the control device 10 to instantly update the control list of the control device, so the control device 10 can block the information (such as the source address or Instant traffic filtering and control for traffic characteristics such as domain name. That is to say, for a normal query packet, the server provides a normal query service, but for a malicious query packet, the control device filters for control.

Figure 2 is a sampling detection method for defending against cyber attacks of the present invention. The step flow chart includes the following steps: In step S20, the control device device receives a plurality of query packets, and then proceeds to step S22.

In step S22, at least one server of the server group performs sampling detection on at least one query packet of the plurality of query packets, and then analyzes the at least one query packet to obtain suspicious query packet information, and then proceeds to step S24. .

In this embodiment, the server has a detection module to perform sampling detection on the at least one query packet at a specific time by using a script program. In addition, the detecting module analyzes the source address or the domain name of the at least one query packet to obtain the suspicious query packet information.

In step S24, the determining means analyzes the suspicious query packet information to obtain malicious query packet information, and then proceeds to step S26.

In this embodiment, the determining device analyzes the source address or the query traffic of the domain name to obtain the malicious query packet information. In addition, the determining device analyzes the impact of the query traffic on the server to obtain the malicious query packet information.

In step S26, the control device controls the malicious query packet information.

Please refer to FIG. 3 , which is another system architecture diagram of the sample detection system 3 for defending against network attacks according to the present invention. The main difference between FIG. 3 and FIG. 1 is that the control device 10 , 30 has an integrated mode. The group 102, 302 is configured to receive other malicious query packet information from other determining devices after obtaining the malicious query packet information, and then block the malicious query through the control device. The package information is controlled by the other malicious query packet information. That is to say, in addition to receiving the control list provided by the judging device 14, the control device 10 can also receive the control list provided by other judging devices (such as the judging device 34) to integrate the control list and update the control. The list of controls for device 10. In particular, since the sampling detection system may be set up in different regions, in order to consider the differences in query packets in different regions, it is possible to obtain a control list for different regions and integrate them into a network attack that can respond to a wider area. Control list.

In summary, the sampling detection system and method for defending against cyber attacks of the present invention utilizes the characteristics of server load balancing to select at least one server for sampling detection by sampling, and by judging suspicious query packets and The malicious query packet is controlled to control, so the invention not only can reduce the operating load of the system, improve the detection efficiency, but also reduce the risk of misjudgment, and has better system scalability. At the same time, the sampling detection system and method for defending against network attacks of the present invention can analyze the source address or the domain name, and can also analyze the query traffic or load impact, and can analyze not only more and diverse objects and projects. And the time required is also reduced.

In addition, the sample detection system and method for defending against network attacks of the present invention have the advantages of being compatible with different protocols (such as IPv4, IPv6 or/and DNS, DNSSEC), and having lower cost and better system scalability. .

However, the above-described embodiments are intended to exemplify the principles of the invention and its effects, and are not intended to limit the invention. Any of the above-described embodiments may be modified by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be patented as described later. Listed in the scope.

1‧‧‧Sampling detection system

10‧‧‧Control device

12‧‧‧Server group

14‧‧‧Judgement device

122, 124, 126‧‧‧ server

1225‧‧‧Detection module

Claims (12)

A sampling detection system for defending against network attacks includes: a control device for receiving a plurality of query packets; and a plurality of servers, wherein at least one of the plurality of servers has a detection module, wherein The server having the detection module receives at least one of the plurality of query packets from the control device, so that the detection module performs sampling detection on the at least one query packet, and further analyzes The at least one query packet obtains suspicious query packet information; the determining device is configured to receive the suspicious query packet information from the server to analyze the suspicious query packet information to obtain malicious query packet information, and then pass the control device pair The malicious query packet information is controlled. The sample detection system of claim 1, wherein the plurality of servers are DNS servers or DNSSEC servers. The sample detection system of claim 1, wherein the detection module analyzes a source address or a domain name of the at least one query packet to obtain the suspicious query packet information. The sample detection system of claim 3, wherein the determining device analyzes the source address or the query traffic of the domain name to obtain the malicious query packet information. The sampling detection system of claim 4, wherein the determining device analyzes the impact of the query traffic on the server to obtain the malicious query packet information. The sampling detection system of claim 1, wherein the control device comprises an integration module for receiving other malicious inquiry packet information from other determining devices, and then the malicious query is obtained through the control device. The packet information is controlled by the other malicious query packet information. A sampling detection method for defending against network attacks includes the steps of: receiving a plurality of query packets; performing sampling detection on at least one of the plurality of query packets, and analyzing the at least one query packet to obtain a suspicious query Packet information; analyze the suspicious query packet information to obtain malicious query packet information; and control the malicious query packet information. The sampling detection method of claim 7, wherein in the step of performing sampling detection on the at least one query packet, the script program is used to perform sampling detection on the at least one query packet at a specific time. The method for sampling detection according to claim 7, wherein in analyzing the at least one query packet to obtain suspicious query packet information, analyzing a source address or a domain name of the at least one query packet, Get the information of the suspicious query packet. For example, in the sampling detection method described in claim 9, wherein in the step of analyzing the suspicious query packet information to obtain malicious query packet information, analyzing the source address or the query flow of the domain name Amount to get the information of the malicious query packet. For example, the sampling detection method described in claim 10, wherein the impact of the query traffic on the server is analyzed to obtain the malicious query packet information. For example, in the sampling detection method described in claim 7, wherein after analyzing the suspicious query packet information to obtain the information of the malicious query packet, further receiving the information of the other malicious query packet, and then the information of the malicious query packet is The other malicious query packet information is controlled.