TWI489826B - Method for ddos detection based on flow motion model - Google Patents

Description

Method for detecting distributed blocking by packet header based on traffic statistics

The invention is a method for detecting distributed blocking by a packet head based on flow statistics.

In general, a Denial of Service attack is an attempt by a hacker to prevent legitimate users from accessing a service on the network, that is, using flood-like traffic to intercept network traffic. A connection between two hosts and causing a specific network service to be unavailable to the user.

Blocking service attacks can be easily divided into three types. The first is "under-consumption resources", the second is "destroy or change the system network settings", and the third "entity destruction or change network components." Please refer to FIG. 1. FIG. 1 is a schematic diagram of a conventional zombie network. Decentralized blocking service attacks (commonly referred to as DDoS or DoS (Distributed Denial of Service)) are the first type of attack. The hacker will reassemble through the host computer 91 to use a large number of embedded code. They form a corpse network 9 to achieve more powerful damage, and then use multiple computer hosts scattered in different domains to send fake source address packets to block the user's network computer host 92, 93, 94,95, and thus the performance of the normal connection rate is rapidly reduced, resulting in the failure to serve the user, as shown in Figure 1.

The DDos attack method is that it uses multiple hosts on the network to launch DoS-like attacks at the same time. The hosted host will face hundreds of attacks from different domain hosts at the same time. This kind of attack is the same as DoS. It is not to steal the data of the host. Instead, it must block the target by sending packets that exceed the network load or the maximum number of connections allowed by the host. Effect.

In addition, the DDoS attack is characterized by the ability to easily launch large-scale attacks and is difficult to defend and track, because hackers tend to hide their physical location, so even if they go back at most, it is just a computer host under the botnet.

When a user's computer is attacked, the intrusion detection program can respond and alert in a timely manner and take appropriate action against unauthorized or abusive attack programs. For general intrusion detection, it can be roughly divided into two types: "misuse detection" and "abnormal detection". At first, the system will construct a template of positive list and negative list, so as to analyze whether the target has any invasion. The sign of the attack or any incident that violates the security policy occurs as a decision-making consideration for judgment.

"Misson detection" is a hacker who knows the weaknesses of the user's computer system or its program and deliberately attacks its weaknesses. This type of defense is to use known attacks to establish an attack behavior pattern and store it in the attack database. If the result of the comparison is similar to the established attack pattern, it will be determined that the current system may be subject to an intrusion attack. This blacklist-like comparison method only detects each different attack mode with a further scope definition, and if it falls within this interval, it will be regarded as an abnormal behavior. The disadvantage of this approach is that there is no learning ability. The negative list defined is only for the currently known attack mode. If there is an attack method in the future, the system will collapse.

"Exception detection" is the above-mentioned reaction mode. It adopts an indirect design. This method no longer defines the template behavior of various intrusion attacks, but instead defines the normal user mode. Such an approach would be more reasonable, and at the same time have a better effect in collecting data, as long as the normal features are captured as a comparison, and when there is a non-conforming normal user mode, an abnormal behavior is determined. The advantage of this is that the system administrator does not need to update the behavior mode of the intrusion attack frequently, which can effectively reduce the cost. This behavior is usually called a positive list.

The above methods will have some degree of FPR (False Positive Rate) and FNR (False Negative Rate), according to the model threshold value will have different changes, so how to obtain an intermediate value to reduce the misjudgment situation, so that the two can achieve the best solution benefits, That is, the most important problem to be solved by the present invention.

The object of the present invention is to provide a method for detecting distributed blocking by a packet header based on traffic statistics to solve the above problem.

The invention discloses a method for detecting distributed blocking based on traffic statistics, which is to first establish a data model database of a blacklist and a whitelist data model, the method comprising: when a new packet comes in; using traffic changes The flow motion model calculates an upper limit value; compares whether the new packet flow rate at this time is greater than the upper limit value; if the upper limit value is higher than the upper limit value, calculates a first score; compares whether the first score is The pass score is higher than the blacklist; if the pass score is higher than the blacklist, the new packet will be blocked; the pass score of the blacklist will be updated; and the upper limit will be updated.

In addition, the present invention is based on the method for detecting the distributed blocking of the packet header by using the traffic statistics. After comparing the first score, the method further includes: if the pass score of the blacklist is lower, calculating a second score; and the first If the second score is lower than the passing score of the white list, the new packet will be blocked.

In addition, the method for detecting a decentralized blocking of a packet header based on traffic statistics, after comparing the new packet traffic at this time, further comprises: if the upper limit value is lower, calculating a third score; comparing the first Whether the three scores are higher than the pass score of the white list; if the pass score is higher than the white list, the new package will not be blocked; and the pass score of the white list is updated.

Furthermore, the method for detecting a distributed block based on the flow statistics of the present invention, after comparing the third score, further comprises: if the pass score of the white list is lower, calculating a fourth score; The fourth score is higher than the blacklist The passing score will block the new packet.

It should be noted that, although some specific terms are used in the full text of the present specification (including claims) to refer to specific components, those having ordinary knowledge in the technical field of the present disclosure can understand that some manufacturers may The same component will be referred to by a different noun. Therefore, in understanding the full text of the present specification (including the scope of patent application), the difference in name should not be used as a means of distinguishing components, but the difference in function of components should be used as a criterion for differentiation. In addition, the terms "including" and "having" used throughout the present specification are all open-ended terms and should be interpreted as "including but not limited to".

The embodiment of the present invention is a method for detecting distributed blocking based on traffic statistics, and the method first needs to establish a database. That is, whenever a packet comes in, it is compared with the upper limit value (Threshold) calculated by the Flow Motion Model at the current time point. If the flow rate at this time is greater than the critical value, then The header information of the packet (including the packet survival time, packet size, protocol mode, packet source address, and packet connection information) is accessed into the blacklisted data model; conversely, if the current traffic If it is less than the upper limit, the packet attribute is accessed to the whitelisted data model.

Next, please refer to Figure 2. 2 is a flow chart of a method in accordance with an embodiment of the present invention.

After the blacklist data model and the whitelist data model database are established, the detection of the new packet at the next time point is started.

When a new packet comes in (S1), it is compared with the upper limit value (S2) calculated by the Flow Motion Model at the current time point (S3), if the flow rate at this time is greater than the upper limit value. , and the calculated score (Pocket Score) (S4) is higher than the passing score calculated by the blacklist, the new seal The package will be blocked (S5); conversely, if it is lower than the passing score, the data model of the whitelist will be compared again, and the calculated score (S6) is indeed higher than the passing score of the whitelist. This packet will not be blocked for the time being, but if the score is lower than the passing score of the whitelist, the new packet will be directly removed (S7). Then, as long as the new packet is blocked, the blacklisted pass score database is updated (S8). Finally, the upper limit value (S9) is updated.

Conversely, as long as the new packet does not exceed the upper limit, the new packet will be directly compared with the calculated score by the whitelist based on the calculated score (S10). If it is higher than the whitelist, the score is Normal packet (S11), if it is lower than the pass score, it is compared with the blacklist again (S12), if the score is higher than the blacklist, the new packet is blocked (S13), otherwise the new packet is left. . Then, the white list passing score database is updated (S14). Finally, update the upper limit (S9)

The following describes the process of establishing the database again. In this embodiment, the traffic size is used as a distinguishing feature point (that is, the above upper limit value), so that two databases are used to store packet information, and one of the databases is called a whitelist data model, which is responsible for Stores the packet allocation situation under normal circumstances; another database is called the blacklist data model, which is responsible for accessing the packet information after the attack occurs.

The main purpose of the present invention is to obtain a pure database to avoid the occurrence of FPR (False Positive Rate). However, how to define the load upper limit of the server is a big difficulty, because the processing power is different for different servers, and the flow also has different changes from sharp peaks. If you only define a fixed traffic cap to distinguish between the whitelist and the blacklist data model, you will lose the ability to adapt to network changes, and there will be a large deviation in the judgment. If the upper limit is too large, too much data will be collected in the whitelisted data model. In other words, it will happen when some malicious packets will still run into the whitelisted data model, which does not achieve the goal of improving the system. Conversely, if the upper limit is too small, there will be too many normal packet accesses in the blacklisted data model. The phenomenon of offset, and the case of misjudgment still exists.

Next, the manner in which the flow motion model of the present invention is established will be further explained. The present invention proposes a time series model to simulate changes in network traffic and then calculate confidence intervals to define appropriate flow upper limits, as detailed below.

The establishment of model standard procedures can be carried out according to the following four points:

1. Observe the description and non-quantitative analysis of the flow time series by observing the actual data of the packet.

2. Create a model list.

3. Estimate parameters (eg, drift terms) by time series analysis.

4. Compare the predictions and select the most appropriate model.

According to the actual traffic data, it can be found that the network traffic has two characteristics:

1. Changes are maintained at an average level.

2. At the same time, the demand for traffic will vary depending on the time period.

According to the above four standard procedures and two characteristics, the present invention proposes a very intuitive flow motion model (Flow Motion Model), after a series of derivation and use of historical data, the following calculation formula parameters can be calculated. Observe the dynamic process as: dX = α ( m - X _t ) dt + σdZ _t

Where X is the flow rate, α is the recovery velocity of the flow leaving the mean, m is the mean value of the flow, σ is the instantaneous fluctuation of the network flow, dZ _t is Brownian motion, dZ _t ~ N (0, dt ). There are three parameters to be calculated, namely the recovery speed, the flow mean and the variance.

In detail, using historical data from the past, you can calculate the current network. The flow changes. It can be seen that the above formula for network traffic is to learn the current network changes at any time. Because the latest and latest data is used to calculate new parameters, the formula will change with time. Higher accuracy.

Finally, the part about the above score (Pocket Score) is explained. In the embodiment of the present invention, the following simple calculation formula is used to describe the packet when the packet enters at a low flow rate and when the packet enters at a high flow rate.

The mathematical formula when the packet enters at low flow is described below.

Among them, P _L is the packet that enters the calculated score at low flow, n is the total number of attributes, and i is the first attribute.

The mathematical formula when the packet enters at high flow is described below.

Among them, P _H is the packet entering the calculated score at high flow rate, n is the total number of attributes, and i is the first attribute.

In summary, the method for detecting distributed deblocking of a packet header based on traffic statistics is that the server traffic has exceeded the calculated upper limit value, and the packet attribute entrained in the packet entering the server at the moment is When the packet passing score is greater than the blacklist database, it means that the server often receives this type of packet under high traffic conditions, so it is reasonable to suspect that this packet is a member of the distributed blocking attack. Conversely, if the packet inflow time is greater than the upper limit, but does not meet the blacklist database of the packet attribute (that is, the score is less than the pass score), it means that the packet may be a packet sent by a normal user. It just happens to enter the server at the time of the malicious attack, so it can be determined that the packet is not a malicious packet.

S1~S14‧‧‧Steps

Figure 1 is a schematic diagram of a conventional corpse network.

FIG. 2 is a flowchart of a method for detecting distributed blocking of a packet header based on traffic statistics according to an embodiment of the present invention.

S1~S14‧‧‧Steps

Claims (6)

A method for detecting distributed blocking based on traffic statistics, which first establishes a blacklist and a whitelist data model database, the method includes: when a new packet comes in; using one of the traffic change models Calculate an upper limit value, which is: dX = α ( m - X _t ) dt + σdZ _t , where X is the flow rate, α is the recovery velocity of the flow leaving the mean, m is the flow mean, σ is The instantaneous fluctuation of the network traffic, dZ _t is Brownian motion, dZ _t ~ N (0, dt ); whether the new packet flow rate at this time is higher than the upper limit value, if the new packet flow rate is higher than the upper limit a value, a first score is calculated; whether the first score is higher than the pass score of the blacklist, and if the first score is higher than the pass score of the blacklist, the new packet is blocked; the black is updated The passing score of the list; and updating the upper limit. The method for detecting a distributed block based on traffic statistics according to claim 1, wherein the step of comparing the first score further comprises: if the first score is lower than the pass of the blacklist If the score is a second score, and if the second score is lower than the pass score of the whitelist, the new packet is blocked. The method for detecting distributed blocking based on traffic statistics according to the second aspect of the patent application, wherein the step of comparing the new packet traffic at this time further comprises: if the new packet traffic is lower than the If the limit value is calculated, a third score is calculated; if the third score is higher than the pass score of the white list, if the third score is higher than the pass score of the white list, the new packet will not be Block; and update the passing score of the whitelist. The method for detecting the distributed blocking based on the flow statistics according to the third aspect of the patent application scope, wherein the step of comparing the third score further comprises: if the pass score of the white list is lower, recalculate A fourth score; and the fourth score is higher than the pass score of the blacklist, the new packet will be blocked. The method for detecting distributed blocking based on traffic statistics based on the traffic statistics in claim 1, wherein when the new packet enters at a low flow rate, the calculation formula is as follows: Among them, P _L is the packet that enters the calculated score at low flow, n is the total number of attributes, and i is the first attribute. The method for detecting distributed blocking based on traffic statistics according to item 1 of the patent application scope, wherein when the new packet enters at a high flow rate, the calculation formula is as follows: Among them, P _H is the packet entering the calculated score at high flow rate, n is the total number of attributes, and i is the first attribute.