TWI711284B - Method for processing a distributed denial-of-service attack - Google Patents

Abstract

A method for processing a distributed denial-of-service attack comprises: receiving a plurality of packets sent by an external requesting terminal at a time interval; detecting a plurality of request times of the packets; respectively inputting the request times to a machine learning model to generate a plurality of model output times; respectively calculating a plurality of time error percentages between the model output times and the request times; determining whether the time error percentages continues to rise and determining whether the time error percentage corresponding to the latest packet in the time interval is greater than a threshold interval; and determining the external requesting terminal making the distributed denial-of-service attack and performing a defense process for the external requesting terminal when the time error percentages continues to rise and the time error percentage of the latest packet is greater than the threshold interval.

Description

Treatment method of decentralized denial of service attack

The present invention relates to a method for processing network attacks, especially a method for processing distributed denial of service attacks.

With the rapid development of computer networks, website platforms have become an important channel for companies to manage brands and make e-commerce profits. If the network platform is attacked by hackers and the network platform cannot provide services, it will cause unpredictable losses.

Distributed denial of service attack (DDos attack for short) is currently one of the most prevalent cyber attacks against network platforms. DDos attacks use one or more computers on the network to simultaneously send multiple Packets make the packet traffic received by the website platform host at the same time far exceed the bandwidth of the network platform host, achieving the purpose of blocking the services provided by the network platform. At present, the main defense method of the website platform host against DDos attacks is to detect the traffic of the packet. When the traffic of the packet sent by the external requesting end to the website platform host is greater than the bandwidth of the network platform host, it is regarded as the external requesting end carrying out a DDos attack. The external requesting end is blocked. However, there are still many loopholes in judging whether the external requesting end is performing a DDos attack only by using the traffic of the packet. Not only does it fail to block malicious users, but it also blocks well-meaning users.

In view of this, there is indeed a need for an improved decentralized denial of service attack processing method in practice, which can at least solve the above shortcomings

The present invention is to provide a method for processing distributed denial of service attacks to ensure that the network platform can continuously provide network services and improve the accuracy of judging whether the network platform is subject to distributed denial of service attacks.

According to an embodiment of the present invention, a method for processing a distributed denial of service attack includes: receiving a number of packets sent by an external requesting terminal in a time interval through a network interface; Multiple processing times of the packet; input the processing times to the machine learning model to generate multiple model output times; use the processor to calculate the multiple time error percentages between the model output times and the processing times, the Some time error percentages have a time error trend in the time interval; the processor determines whether the time error trend is a continuous increase. If the time error trend is a continuous increase, the processor is further used to determine the packet location with the latest time in the time interval. Corresponding to whether the percentage of time error is greater than the threshold interval; and when the time error percentage corresponding to the latest packet is greater than the threshold interval, the processor determines that the external requester performs a distributed denial of service attack on the website platform host and the processor After the time interval, the defense program is executed against the external requester.

A method for processing a distributed denial of service attack disclosed according to another embodiment of the present invention includes: receiving a number of packets sent by an external requesting end in a time interval through a network interface; detecting a host pair of a website platform with a processor Multiple processing times of the packets; input the processing times of the packets to the machine learning model to generate multiple model output times; input multiple actual flows of the packets to the machine learning model to generate multiple models Output flow; the processor calculates multiple time error percentages between the output time of the models and the processing time, and the time error percentages have a time error trend in the time interval; the processor calculates the models respectively There are multiple flow error percentages between the output flow and the actual flow. The flow error percentages have a flow error trend in the time interval; the processor determines whether the ratio of the time error trend and the flow error trend is a continuous increase, if If they all belong to a continuous increase, the processor will further determine whether the time error percentage corresponding to the latest packet in the time interval and whether the traffic error percentage is greater than the threshold interval; and the time error percentage corresponding to the latest packet of the current time and When the traffic error percentages are all greater than the threshold interval, the processor determines that the external requesting terminal performs a distributed denial of service attack on the website platform host and executes a defense program on the external requesting terminal after the time interval.

Since a malicious external requester may fail to log in to the website platform host with multiple virtual IPs multiple times, even if the traffic of each failed login is not large, it can also paralyze the website platform host website. According to the above-mentioned dispersion disclosed by the present invention There are multiple embodiments of typed denial of service attacks. The basis for judging whether a network platform has suffered a distributed denial of service attack is not only the network traffic, but also the processing time of the website platform host for each packet, so it can be effectively blocked The aforementioned distributed denial of service attack. In addition, before some special holidays, there will often be larger Internet traffic, but it is not a malicious attack. Based on processing time and network traffic as the basis for judging distributed denial of service attacks, it can avoid blocking benign external requesters. In this way, it can ensure that the network platform can continue to provide network services and improve the accuracy of determining whether the website platform host has suffered a distributed denial of service attack.

The above description of the content of the present invention and the description of the following embodiments are used to demonstrate and explain the spirit and principle of the present invention and provide a further explanation of the scope of the patent application of the present invention.

100: Distributed denial of service attack processing system

10: Network interface

12: processor

14: Memory

16: machine learning model

E: External request terminal

S: website platform host

FIG. 1 is a functional block diagram of a processing system for a distributed denial of service attack according to the first embodiment of the present invention.

Fig. 2 is a flowchart of a method for processing a distributed denial of service attack according to the first embodiment of the present invention.

FIG. 3 is a flowchart of a method for processing a distributed denial of service attack according to the second embodiment of the present invention.

FIG. 4 is a flowchart of a method for processing a distributed denial of service attack according to the third embodiment of the present invention.

5A and 5B are flowcharts of a method for processing a distributed denial of service attack according to a fourth embodiment of the present invention.

6A and 6B are flowcharts of a method for processing a distributed denial of service attack according to the fifth embodiment of the present invention

7A and 7B are flowcharts of a method for processing a distributed denial of service attack according to the sixth embodiment of the invention.

The detailed features and advantages of the present invention are described in detail in the following embodiments, and the content is sufficient to enable anyone familiar with the relevant art to understand the technical content of the present invention and implement it accordingly, and according to the content disclosed in this specification, the scope of patent application and the drawings Anyone who is familiar with the relevant art can easily understand the related purpose and advantages of the present invention. The following examples further illustrate the viewpoints of the present invention in detail, but do not limit the scope of the present invention by any viewpoint.

FIG. 1 is a functional block diagram of the distributed denial of service attack processing system according to the first embodiment of the present invention. As shown in Figure 1, the distributed denial of service (hereinafter referred to as DDos) attack processing system 100 is set in the connection network between the external requesting end E and the network platform host S. The DDos attack processing system 100 is used for judgment Whether the website platform host S used to manage the website is a specific device attacked by DDos. The DDos attack processing system 100 includes a network interface 10, a processor 12 and a memory 14, and the processor 12 is electrically connected to the network interface 10 and the memory 14. When the external requesting end E continuously transmits packets to the network platform host S via the network, the sent packets will be received by the DDos processing system 100 and analyzed for the packets, and then the DDos attack processing system 100 will output the packets to the website platform Host S. The content described below takes an external requesting terminal E and a website platform host S as examples. It can be understood that the DDos attack processing system and processing method of the present invention can also be applied to multiple external requesting terminals E and multiple website platform hosts S.

As shown in FIG. 1, the network interface 10 includes, for example, an interconnection point between a user terminal and a private network or a public network, a network card on a computer host, and a public switched telephone network. (Public Switched Telephone Network) and the interconnection point between private terminals, or the interconnection point between two networks. The processor 12 includes a general purpose Processor, digital signal processor (DSP), multiple microprocessors, one or more microprocessors associated with the DSP core, controller, microcontroller, special integrated circuit (ASIC), field programmable design Gate array (FPGA) circuit or complex programmable logic device (CPLD). The memory 14 includes, for example, random access memory (RAM), read-only memory (ROM), or hard disk. In this embodiment, the network interface 10 is a network card, the processor 12 is a general-purpose processor, and the memory 14 is a RAM. The network interface is used to receive multiple packets sent by the external requesting terminal E. The processor 12 is used to detect the processing time of each packet and the actual flow of each packet by the website platform host S, and store the processing time and the data of the actual flow in the memory 14. The memory 14 stores a machine learning model 16, and the machine learning model 16 is used to receive data on the processing time and actual traffic of each packet. The machine learning model 16 includes, for example, Auto encoder, Neuro-Linguistic Programming, Fuzzy Logic Model, Hidden Markov Model, Decision Tree, Bayesian Algorithm, Conditional Random Domain or Support Vector machine. In this embodiment, the machine learning model 16 is an auto encoder neural network (Auto encoder).

Before actual use, an auto encoder must be trained in advance through multiple pieces of training data collected during a predetermined period, and the collected training data has been verified to belong to packets sent by normal network behavior. In addition, the attributes of the selected training data must also have a considerable degree of representativeness and interrelationship in order to build an accurate model for the packets sent by normal network behavior. The attributes of the training data include, for example, the Packets transmitted in the previous week, packets transmitted in the first week of each month, packets transmitted in the last week of each month, and packets transmitted on Friday of each week. After the self-encoding neural network has been trained with the selected training data, it is then tested with new data that is different from the training data belonging to the normal network behavior. If the output of the self-encoding neural network is When the error percentage between the inputs is less than the preset threshold interval (for example, 1%~2%), it means that the Auto encoder training is successful.

FIG. 2 is a flowchart of a method for processing a DDos attack according to the first embodiment of the present invention. As shown in FIG. 2, in step S201, the network interface 10 is used to receive external The requester E continuously sends multiple packets to the website platform host S in a time interval, and the time interval can be appropriately adjusted relative to the performance of the network interface 10. In step S202, the processor 12 detects multiple processing times (request time) of the packets by the website platform host S. In step S203, the processor 12 inputs the processing times to the machine learning model 18 to generate multiple model output times. In this embodiment, the machine learning model 18 is an auto encoder. In step S204, the processor 12 is used to calculate multiple time errors between the output time of the models and the processing time. In step S205, the processor 12 divides the time errors by the processing times to obtain multiple time error percentages. The time error percentages have a time error trend in the time interval. In step S206, the processor 12 determines whether the time error trend is a continuous increase, if the time error trend is not a continuous increase, then step S207 is entered; if the time error trend is a continuous rise, then step S208 is entered. In step S207, the processor 12 determines that the external requesting terminal E performs normal network behavior on the website platform host S, and allows the external requesting terminal E to send packets to the website platform host S. In step S208, it is further determined whether the time error percentage corresponding to the packet with the latest time in the time interval is greater than a threshold interval, where the threshold interval is, for example, between 1% and 2%. When the time error percentage is not greater than the threshold interval, step S209 is entered; if the time error percentage corresponding to the latest packet is greater than the threshold interval, step S210 is entered. In step S209, the processor 12 determines that the external requesting terminal E performs normal network behavior on the website platform host S, and allows the external requesting terminal E to send packets to the website platform host S. In step S210, the processor 12 determines that the external requesting terminal E performs a DDos attack on the website platform host S, and then proceeds to step S211. In step S211, the processor 12 executes a defense procedure on the external requester E after the time interval, wherein the defense procedure delays the response time of the website platform host S to the external requester E.

FIG. 3 is a flowchart of the processing method of the DDos attack according to the second embodiment of the present invention. As shown in FIG. 3, the DDos attack processing method of the second embodiment includes steps S301 to S311, wherein steps S301 to S310 are the same as steps S201 to S210 of the first embodiment. The same, the difference is that in step S311, the defense program executed by the processor 12 on the external requesting terminal E is replaced with the processing of the website platform host S on the external requesting terminal E after other external requesting terminals. In detail, if the website platform host S can tolerate up to 1000 external requesting terminals logging in at the same time, the processor 12 determines that it is the external requesting terminal carrying out the DDos attack, and it will be sorted after the website platform host S has processed 1000 external requesting terminals. , The external requesting end deemed to be carrying out DDos attacks will be processed. If multiple external requesters are deemed to be conducting DDos attacks, they will be queued according to the time of sending packets to the website platform host S.

FIG. 4 is a flowchart of the processing method of the DDos attack according to the third embodiment of the present invention. As shown in Figure 4, the DDos attack processing method of the third embodiment includes steps S401 to S411, where steps S401 to S410 are the same as steps S201 to S210 of the first embodiment. The difference is that in step S411, the processor 12 responds to external The defense program executed by the requesting end E is replaced by blocking the packet sent by the external request E to the website platform host S after the time interval.

5A and 5B are flowcharts of the DDos attack processing method according to the fourth embodiment of the present invention. As shown in FIG. 5A, in step S501, the network interface 10 is used to receive a plurality of packets continuously sent by the external requesting terminal E to the website platform host S in a time interval, and then steps S502 and S503 are respectively performed. In step S502, the processor 12 detects multiple processing times of the packets by the website platform host S, and then step S504 is executed. In step S503, the processor 12 detects multiple actual flows of the packets, and then step S505 is executed. In step S504, the processor 12 inputs these processing times to the machine learning model 18 to generate multiple model output times. In this embodiment, the machine learning model 18 is an auto encoder, and then Step S506 is executed. In step S505, the processor 12 inputs the actual flows to the machine learning model 18 to generate multiple model output flows, and then step S507 is executed. In step S506, the processor 12 respectively calculates multiple time errors between the output time of the models and the processing time, and then step S508 is executed. In step S507, the processor 12 respectively calculates the multiple flows between the model output flows and the actual flows. To measure the error, step S509 is then executed. In step S508, the processor 12 divides the time errors by the processing times to obtain a plurality of time error percentages, where the time error percentages have a time error trend in the time interval, and then step S510 is executed. . In step S509, the processor 12 divides the flow errors by the actual flow rates to obtain a plurality of flow error percentages, where the flow error percentages have a flow error trend in the time interval, and then step S510 is executed. .

As shown in FIG. 5B, in step S510, the processor 12 determines whether the time error trend and the flow error trend both belong to a continuous increase. If the time error trend and the flow error trend do not both belong to a continuous increase (one If the time error trend and the flow error trend both belong to a continuous rise, then step S512 is entered. In step S511, the processor 12 determines that the external requesting terminal E performs normal network behavior on the website platform host S, and allows the external requesting terminal E to continue to send packets to the website platform host S.

In step S512, it is further determined whether the time error percentage and the traffic error percentage corresponding to the packet with the latest time in the time interval are both greater than a threshold interval, for example, the threshold interval is between 1% and 2%. When the time error percentage and the flow error percentage corresponding to the packet of are not both greater than the threshold interval (one of them is greater than the threshold interval or neither is greater than the threshold interval), then go to step S513; if the time error corresponding to the latest packet When both the percentage and the flow error percentage are greater than the threshold interval, step S514 is entered. In step S513, the processor 12 determines that the external requesting terminal E performs normal network behavior on the website platform host S, and allows the external requesting terminal E to continue to send packets to the website platform host S. In step S514, the processor 12 determines that the external requesting terminal E performs a DDos attack on the website platform host S, and then proceeds to step S516. In step S516, the processor 12 executes a defense program on the external requester E after the time interval, wherein the defense program delays the response time of the website platform host S to the external requester E.

6A and 6B are the DDos attack illustrated in the fifth embodiment of the present invention A flowchart of how to deal with a click. As shown in Figs. 6A and 6B, the DDos attack processing method of the fifth embodiment includes steps S601 to S616, where steps S601 to S615 are the same as steps S501 to S515 of the fourth embodiment. The difference is that in step S616, the processor 12 The defensive program executed on the external requesting end E is replaced by ordering the processing of the external requesting end by the website platform host S after other external requesting ends. In detail, if the website platform host S can tolerate up to 1000 external requesting terminals logging in at the same time, the external requesting terminal E judged by the processor 12 to be carrying out a DDos attack will be sorted in the external platform where the website platform host S has processed 1000. After the requester, the external requester that conducts the DDos attack will be processed. If multiple external requesting ends are deemed to be carrying out DDos attacks, they will be queued according to the time when these external requesting ends send packets to the website platform host S.

7A and 7B are flowcharts of the processing method of the DDos attack according to the sixth embodiment of the present invention. As shown in FIG. 7A and FIG. 7B, the DDos attack processing method of the sixth embodiment includes steps S701 to S716, wherein steps S701 to S715 are the same as steps S501 to S515 of the fifth embodiment. The difference is that in step S716, the processor 12 The defense program performed on the external requesting end E is replaced by blocking the packet sent by the external request E to the website platform host S after the time interval.

In addition, in any of the above-mentioned embodiments, after the processor 12 determines that the external requesting terminal E is performing a DDos attack, it can further include the network address of the external requesting terminal E in the blacklist database stored in the memory 14 to facilitate Follow-up tracking and analysis.

In summary, since malicious external requesters may fail to log in to the website platform host with multiple virtual IPs multiple times, even if the traffic of each failed login is not large, the website platform host can be paralyzed. According to the multiple embodiments of the DDos attack disclosed in the present invention, the basis for determining whether a network platform is subject to a DDos attack is not only the network traffic, but also the processing time of the website platform host for each packet, so it can be effectively blocked The aforementioned DDos attack. In addition, before some special holidays, there will often be larger Internet traffic, but it is not a malicious attack. Based on processing time and network traffic as the basis for judging DDos attacks, it can be avoided Avoid blocking good-faith external requesters. In this way, it can ensure that the network platform can continue to provide network services and improve the accuracy of determining whether the website platform host has been attacked by DDos.

Although the present invention is disclosed in the foregoing embodiments, it is not intended to limit the present invention. All changes and modifications made without departing from the spirit and scope of the present invention fall within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the attached patent scope.

Claims (15)

A method for processing distributed denial of service attacks includes: receiving a number of packets sent by an external requesting terminal in a time interval through a network interface; using a processor to detect the amount of these packets by a website platform host Processing times; input the processing times to a machine learning model to generate a plurality of model output times; use the processor to calculate the percentages of time error between the model output times and the processing times, the The time error percentage has a time error trend in the time interval, where the time error trend is the change trend of the time error percentages; the processor determines whether the time error trend is a continuous increase, if the time error trend is a continuous increase , The processor further determines whether the time error percentage corresponding to the packet with the latest time in the time interval is greater than a threshold interval; and the time error percentage corresponding to the packet with the latest time is greater than the threshold interval At this time, the processor determines that the external requesting terminal performs a distributed denial of service attack on the website platform host and the processor executes a defense program on the external requesting terminal after the time interval. The method for processing distributed denial of service attacks according to claim 1, wherein calculating the time error percentages between the model output time and the processing time respectively includes: calculating the model output by the processor respectively The multiple time errors between the time and the processing times; the processor divides the time errors by the processing times to obtain the time error percentages. The method for processing distributed denial of service attacks described in claim 1, wherein the threshold range is between 1% and 2%. The method for processing distributed denial of service attacks described in claim 1, wherein the defense procedure includes: delaying a response time of the website platform host to the external requesting end. The method for processing a distributed denial of service attack as described in claim 1, wherein the defense program includes: ranking the processing of the website platform host on the external requesting terminal after other external requesting terminals. The method for processing a distributed denial of service attack described in claim 1, wherein the defense program includes: blocking the external request from the packet sent by the website platform host. The method for processing a distributed denial of service attack as described in claim 1, further includes, after the processor determines that the external requesting end has carried out a distributed denial of service attack, listing the network address of the external request into a A blacklist database stored in the memory. A method for processing distributed denial of service attacks includes: receiving a number of packets sent by an external requesting terminal in a time interval through a network interface; using a processor to detect the amount of these packets by a website platform host Processing time; using the processor to detect multiple actual flows of the packets; input the processing times to a machine learning model to generate multiple model output times; input the actual flows to a machine learning model to Generate a plurality of model output flows; use the processor to respectively calculate a plurality of time error percentages between the model output time and the processing time, the time error percentages have a time error trend in the time interval, wherein the time The error trend is the change trend of the time error percentages; the processor separately calculates a plurality of flow error percentages between the model output flows and the actual flows, and the flow error percentages have a flow error in the time interval trend; Use the processor to determine whether the time error trend and the flow error trend are both continuously rising; when the time error trend and the flow error trend are both continuously rising, the processor is further used to determine the latest time in the time interval Whether the time error percentage and the flow error percentage corresponding to the packet are both greater than a threshold interval; and when the time error percentage and the flow error percentage corresponding to the latest packet are both greater than the threshold interval, use the The processor determines that the external requesting terminal performs a distributed denial of service attack on the website platform host and executes a defense program on the external requesting terminal after the time interval. The method for processing distributed denial of service attacks according to claim 8, wherein calculating the time error percentages between the model output times and the processing times respectively includes: calculating the model outputs separately by the processor The multiple time errors between the time and the processing times; the processor divides the time errors by the processing times to obtain the time error percentages. The method for processing distributed denial of service attacks as described in claim 8, wherein not calculating the error percentages between the model output traffic and the actual traffic includes: using the processor to calculate the model outputs separately The flow rate errors between the flow rate and the actual flow rates; the processor divides the flow rate errors by the actual flow rates to obtain the flow rate error percentages. The method for processing distributed denial of service attacks described in claim 8, wherein the threshold range is between 1% and 2%. The method for processing distributed denial of service attacks described in claim 8, wherein the defense procedure includes: delaying a response time of the website platform host to the external requesting end. The method for processing a distributed denial of service attack as described in claim 8, wherein the defense procedure includes: ranking the processing of the website platform host on the external requesting terminal after other external requesting terminals. The method for processing a distributed denial of service attack described in claim 8, wherein the defense program includes: blocking the external request from the external request to the website platform host. The method for processing distributed denial-of-service attacks as described in claim 8, further includes, after the processor determines that the external requesting end has conducted a distributed denial-of-service attack, including the network address of the external request A blacklist database stored in the memory.

Images