WO2008131667A1 - Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service - Google Patents

Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service Download PDF

Info

Publication number
WO2008131667A1
WO2008131667A1 PCT/CN2008/070621 CN2008070621W WO2008131667A1 WO 2008131667 A1 WO2008131667 A1 WO 2008131667A1 CN 2008070621 W CN2008070621 W CN 2008070621W WO 2008131667 A1 WO2008131667 A1 WO 2008131667A1
Authority
WO
WIPO (PCT)
Prior art keywords
identification information
user
user identification
service flow
module
Prior art date
Application number
PCT/CN2008/070621
Other languages
English (en)
French (fr)
Inventor
Lifeng Liu
Zhibin Zheng
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CNA2007100988798A external-priority patent/CN101039326A/zh
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to EP08715357A priority Critical patent/EP2136526A4/en
Publication of WO2008131667A1 publication Critical patent/WO2008131667A1/zh
Priority to US12/607,854 priority patent/US20100095351A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Definitions

  • the present invention relates to the field of network communication technologies, and in particular, to a service flow identification method, a service flow identification device, a denial of service attack defense method, and a denial of service attack defense system and device.
  • DDoS Distributed Deny of Service
  • Attacking network devices and servers through large traffic 2. Expediting exhaustion of server resources by manufacturing a large number of incomplete requests that cannot be completed. .
  • the DDoS defense method mainly has black hole technology:
  • the operator will block the data packet sent to the attacker as far as possible upstream, and then introduce the intercepted data packet into the "black hole” and discard it, thereby maintaining the operation.
  • the black hole technology in the prior art has at least the following problem: since the operator discards the data packet sent to the attacker, the attacker's legitimate data packet is discarded together with the malicious attack data packet. .
  • this method can protect the carrier's basic network and other customers' services, the attacker loses all the business services. Objectively, the attacker achieves the purpose of the attack.
  • the embodiment of the present invention provides a service flow identification method and apparatus, which can improve the accuracy of identifying a legitimate service flow.
  • the embodiment of the present invention further provides a defense application of a denial of service attack, and improves the defense of the distributed denial of service attack defense system.
  • the present invention further provides an apparatus for generating user information, which can provide required user information for service flow identification, defense, and the like.
  • An embodiment of the present invention provides a service flow identification method, including: detecting user access to a target system; and according to the detected user access to a target system and a preset user access statistical mode Dynamically generating a set of user identification information; extracting user identification information in the service flow when the service flow identification is required; and comparing whether the extracted user identification information and the user identification information in the user identification information set match; The comparison result determines whether the service flow is a legitimate service flow.
  • the embodiment of the present invention further provides a defense method for denial of service attacks, including: detecting user access to a target system; dynamically generating user identification information according to the detected user access to the target system and a preset user access statistical model. Collecting; when the service flow identification is required, extracting the user identification information in the service flow; comparing whether the extracted user identification information and the user identification information in the set match; determining whether the service flow is based on the comparison result A normal service flow is allowed; subsequent normal processing operations are performed on the determined legal service flow, and subsequent normal processing operations on the determined illegal service flow are refused.
  • the embodiment of the present invention further provides a service flow identification device, including: a first module: configured to detect a user access to a target system, and according to the detected user access to a target system and a preset user access statistical model Dynamically generated user identification information, and output; second module: for receiving the user identification information output by the first module, and storing it as a user identification information set; third module: for extracting user identification information in the service flow, comparing Whether the extracted user identification information matches the user identification information in the user identification information set, and determines whether the service flow is a legitimate service flow and outputs a determination result according to the comparison result.
  • a service flow identification device including: a first module: configured to detect a user access to a target system, and according to the detected user access to a target system and a preset user access statistical model Dynamically generated user identification information, and output; second module: for receiving the user identification information output by the first module, and storing it as a user identification information set; third module: for extracting user identification information in the service
  • the embodiment of the present invention further provides a defense system for denial of service attacks, including: a first module: configured to detect user access to a target system, and according to the detected user access to the target system and a preset user access statistical model Dynamically generated user identification information, and output; second module: for receiving the user identification information output by the first module, and storing it as a user identification information set; third module: for extracting user identification information in the service flow, comparing Whether the extracted user identification information matches the user identification information in the user identification information set, and determines whether the service flow is a legitimate service flow and outputs a determination result according to the comparison result; Fourth module: used to receive the third Whether the service flow output by the module is a judgment result of the legal service flow, and allows subsequent normal processing operations on the determined legal service flow, and refuses to perform subsequent normal processing operations on the determined illegal service flow.
  • a defense system for denial of service attacks including: a first module: configured to detect user access to a target system, and according to the detected user access to the target system
  • the embodiment of the present invention further provides an apparatus for generating user information, including: a first module: configured to detect user access to a target system, and according to the detected user access to the target system and a preset user access statistical model dynamic Generated user identification information, and output; Second module: used to connect The user identification information output by the first module is received and stored as a set of user identification information.
  • a first module configured to detect user access to a target system, and according to the detected user access to the target system and a preset user access statistical model dynamic Generated user identification information, and output
  • Second module used to connect The user identification information output by the first module is received and stored as a set of user identification information.
  • FIG. 1 is a schematic flow chart of a service flow identification method according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a distributed denial of service attack defense method according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a distributed denial of service attack defense system according to an embodiment of the present invention.
  • the embodiment of the present invention utilizes the user access statistical model to predict a legitimate user or an illegal user.
  • a specific example of predicting a legitimate user or an illegal user is: predicting a probability that a service system may be accessed in a DDoS attack state according to historical information of the user accessing the target system, and determining that the user is a legitimate user according to the predicted probability.
  • the user identification information corresponding to the user is obtained from the service flow of the user accessing the target system, and is recorded in the user identification information set.
  • the recorded user identification information set may be a user white list; if the user identification information of the illegal user needs to be recorded, when the illegal user is determined, the user identification information corresponding to the user is obtained from the service flow of the user accessing the target system, and the record is recorded.
  • the set of user identification information recorded at this time may be a blacklist of users.
  • the predicted large probability user may be determined as a legitimate user, and then the corresponding user identification information is obtained from the service flow of the user's access target system, and recorded. Then, the legitimate service flow and the illegal service flow can be identified based on the recorded user identification information. Since the user identification information generated according to the user access statistical model can identify the merged/illegal user as accurately as possible, the recorded user identification information can identify the legitimate service flow and the illegal service flow as accurately as possible. Identification of legal industry
  • the process of traffic and illegal traffic can be applied to DDoS attack defense. That is, when the DDoS attack defense is performed, subsequent normal processing operations on the identified legal service flow may be allowed, and subsequent normal processing operations on the identified illegal service flow may be refused.
  • the service flow may be identified according to the user identifier information corresponding to the user who is expected to access the target system, and the corresponding combined/illegal service flow is subjected to corresponding subsequent processing operations. Therefore, the embodiment of the present invention effectively intercepts the attack of the illegal service flow while effectively ensuring the normal access of the legitimate user to the target system.
  • the user identification information recorded in the user identification information set may be the existing user identification information carried in the current service flow, or may be implemented to implement the service flow identification and the distributed denial service.
  • the user identification information added by the attack defense method; the existing user identification information and the newly added user identification information may also be used.
  • the newly added user identification information may be carried in the newly added field of the packet, for example, it may be carried in a new field of the application layer protocol packet, or may be carried in the security field.
  • the newly added user identification information may be carried in the message of the user login phase, or may be carried in the message before the user logs in.
  • the newly added user identification information may be generated by the user side, for example, the client of the service system is generated when the user first starts and accesses the service system initialization.
  • the newly added user identification information may also be generated by the network side. For example, when the client of the service system starts and accesses the service system for the first time, the service system specifies user identification information for the user, and carries the specified user identification information. The message is returned to the client. After the user accesses the service system, the user may carry the newly added user identification information or the new user identification information.
  • the newly added user identification information may be carried in the first application layer>3 ⁇ 4 text of the user access service system.
  • the new The added user identification information may be carried in the first message sent by the service system to the user.
  • the user identification information can be a random value.
  • one user may correspond to multiple user identification information.
  • a set of user identification information is provided.
  • Set user label The way to know the information collection is as follows: According to the history of the user's access to the target system, and the pre-set, certain user access statistical model to predict the outbound/illegal users, such as predicting users who may access the target system under the DDoS attack state and And/or it is impossible to access the user of the target system, and then obtain the corresponding user flag information in the service flow of the user who may access the target system and/or the user who is unlikely to access the target system to access the target system.
  • the user identification information may be an IP address, or other information that can identify the user in the network packet, such as a cookie field in the HTTP packet, and may also be the newly added user identification information.
  • the embodiment of the present invention does not exclude the manner in which the user identification information is statically configured.
  • the user identification information set set in the embodiment of the present invention may be a set of identification information of the legal user.
  • the set of user identification information may be referred to as a user white list.
  • the set of user identification information set by the above may also be a set of identification information of the illegal user.
  • the set of user identification information set may be referred to as a user blacklist.
  • the user access statistical model can be set according to the actual situation of the network, and there are various ways for the user to access the statistical model.
  • the embodiment of the present invention does not limit the specific expression form of the user accessing the statistical model, nor does it limit the specific expression form of the user identification information. .
  • the user identification information in the service flow needs to be extracted, and the user identification information should correspond to the user identification information in the white/black list of the user, for example, the user identification information in the white/black list of the user is IP. Address, you need to extract the source IP address from the service flow.
  • the extracted user identification information is compared with the user identification information set by the foregoing, and the extracted user identification information is compared with the user identification information in the user whitelist to determine Whether the user identification information extracted from the service flow matches the user identification information in the user whitelist.
  • the user identification information extracted from the service flow matches the user identification information in the user whitelist, the user identification information extracted from the service flow is the legal user identification information, and the service flow is sent by the legal user. If the user identification information extracted from the service flow does not match the user identification information in the user whitelist, the user identification information extracted from the service flow is illegal user identification information, and the service flow is an illegal user. The service flow is an illegal service flow.
  • the description of the service flow identification process is described by taking the user whitelist as an example. If the user blacklist is generated by using the user access statistical model, the service flow identification process is basically the same as the above description, and the description is not repeated here.
  • the foregoing service flow identification process can be applied to multiple defense technical solutions, such as the DDoS attack defense technical solution.
  • the DDoS attack defense method provided by the embodiment of the present invention is described below.
  • the above service flow identification process is utilized. After the service flow identification process described above is used to identify whether the service flow is a legitimate service flow or an illegal service flow, the subsequent normal processing operations may be allowed to be performed on the identified legal service flow, such as allowing normal transmission, etc.; The illegal traffic flows for subsequent normal processing operations, such as rejecting normal transmissions and discarding the identified illegal traffic flows.
  • the above DDoS attack prevention and unloading process can be started when a DDoS attack occurs.
  • the startup mode can be manually configured or started for dynamic detection.
  • the dynamic detection starts, if the service traffic is detected, and the detection result is judged to determine whether a DDoS attack occurs.
  • the DDoS attack is determined, the user identification information in the service flow is extracted, and the subsequent process such as the service flow identification is performed.
  • the implementation method of the present invention can detect the presence or absence of a DDoS attack by using an existing method.
  • the embodiment of the present invention does not limit the specific implementation manner for detecting whether or not a DDoS attack occurs.
  • the service flow can be processed according to the priority.
  • the priority here may be dynamically generated by the user access statistical model; for example, in detecting the historical access data of the user to the target system, the user access statistical model is used to dynamically predict the user who may access the target system during the DDoS attack or not. Users who may access the target system, and corresponding priority information.
  • the user whitelist or user blacklist containing the user identification information and the corresponding priority information is dynamically generated according to the above-mentioned expected users who may or may not access the target system and the priority information.
  • the service flow can be processed according to the priority information, such as according to the priority.
  • the legal service flow is allowed to perform subsequent normal processing. For example, when the DDoS attack is severe, the legal traffic can be discarded according to the low to high.
  • the embodiment of the present invention does not limit the specific implementation manner of processing the service flow according to the priority information.
  • the embodiment of the present invention can also limit the bandwidth occupied by a legitimate service flow, for example, bandwidth limitation for each legal service flow. Moreover, the limit bandwidth corresponding to each legal service flow can be the same, or To make a difference.
  • the service flow identification method provided by the embodiment of the present invention is as shown in FIG.
  • step 1 Set the user access statistical model.
  • a simple user access statistical model can be used to access a target system based on historical access records, or to access a target system based on historical access records, and so on.
  • Users can access statistical models in a variety of ways.
  • Step 2 Detecting a user accessing the target system, dynamically generating user identification information according to the user access statistical model, such as determining a probability that the user may access the target system during the DDoS attack according to the user access statistical model, and determining the When the probability is that the user is a legitimate user, the corresponding user identification information is obtained from the service flow of the user accessing the target system.
  • the user identification information and the priority information corresponding to the user identification information may be dynamically generated according to the user access statistical model, for example, determining the priority information of the user according to the predicted probability.
  • Step 3 The dynamically generated user identification information is stored in the user white list.
  • step 3 the dynamically generated user identification information and the priority information may be stored in the user white list.
  • step 4 the user identification information in the service flow is extracted, for example, the source IP address is extracted from the service flow.
  • Step 5 Compare the extracted user identification information with the user identification information in the user whitelist. If the user identification information extracted from the service flow matches the user identification information in the user whitelist, go to step 6; otherwise, go to the step. 7.
  • Step 6 Confirm that the service flow is sent by a legitimate user, and output the service flow as information of a legitimate service flow. If the user whitelist includes the priority information, in step 6, the information of the service flow as a legal service flow and the priority information corresponding to the legal service flow may be output.
  • Step 7. Confirm that the service flow is sent by an illegal user, and output the service flow as information of an illegal service flow.
  • step 1 set the user access statistical model.
  • a simple user access statistical model can be used to access a target system based on historical access records, or to access a target system a predetermined number of times based on historical access records, and so on.
  • Users can access statistical models in a variety of ways.
  • Step 2 According to the service flow sent by the user, the user access to the target system is detected, and the user identification information and the priority information corresponding to the user identification information are dynamically generated according to the user access statistical model. For example, according to the user access statistical model, the probability that the user may access the target system during the DDoS attack process is determined, and when the user is determined to be a legitimate user according to the determined probability, the corresponding user identifier is obtained from the service flow of the user accessing the target system. Information, and determining the priority information of the user according to the determined probability.
  • Step 3 The dynamically generated user identification information and the priority information are stored in the user white list.
  • Step 4 Detect service traffic, and determine whether a DDoS attack occurs according to the service traffic detection result. If a DDoS attack occurs, go to step 5. If there is no DDoS attack, the service traffic detection process is still performed.
  • Step 5 Extract user identification information in the service flow, such as extracting a source IP address from the service flow.
  • Step 6 Compare the extracted user identification information with the user identification information in the user whitelist. If the user identification information extracted from the service flow matches the user identification information in the user whitelist, go to step 7; otherwise, go to the step. 8.
  • Step 7 Confirm that the service flow is sent by a legal user, and perform subsequent normal processing operations on the service flow according to the priority information corresponding to the service flow.
  • Step 8 Confirm that the service flow is sent by an illegal user, refuse to perform subsequent normal processing operations on the service flow, and discard the service flow.
  • step 2 and step 3 and step 4 may be in no order, that is, the execution processes of steps 2 and 3 are independent, and the execution of step 4 is not sequential. Relationship, the execution process of step 4 is independent, and has no relationship with the execution of steps 2 and 3.
  • the service traffic is detected.
  • step 5 to step 8 are stopped, and steps 2 and 3 are continued.
  • the process is merely an illustration, and the specific implementation process can be various, and is no longer exemplified.
  • the detection is detected.
  • a DDoS attack when a user logs in or initiates a connection, it can determine whether to allow the user to log in or allow a connection with the user according to the user identification information, so that DDoS attacks can be avoided to some extent.
  • a correspondence relationship may be set in the user identification information set as the user identification information, for example, the correspondence between the user account and the newly added user identification information is set.
  • the service flow is determined to be a legal service flow according to the newly added user identification information carried in the service flow
  • other service flows under the user account that do not carry the newly added user identification information in the corresponding relationship may also be confirmed as Legal business flow.
  • the above correspondence can be updated.
  • the DDoS attack defense method provided by the embodiment of the present invention will be described below by taking the newly added user identification information as an example.
  • the UID (User Identity Information) field can be included in all protocol packets that are set to interact with the service system.
  • the field can be 128 bits.
  • User A and user B are successfully registered to a service system, which may be a service system that provides application services for users, or a service system that provides access authentication services for users.
  • a service system which may be a service system that provides application services for users, or a service system that provides access authentication services for users.
  • the user A's UID field is initialized to a random value of 0x0123456789abcdef
  • user B's UID field is initialized to 0xfedcba9876543210.
  • the UID of User A and User B is dynamically set in the set of user identification information established by the service system according to the user access statistical model.
  • the service system can immediately filter the service flow according to the UID in the user identification information set and the UID field in the service flow. Since only the UIDs of the user A and the user B are set in the user identification information set of the service system, the service system determines that the value in the UID field in the received service flow is not 0x0123456789abcdef or 0xfedcba9876543210. The service flow is an illegal service flow, and the subsequent normal processing operation of the illegal service flow is refused.
  • the service flow is determined to be a legitimate service flow. , allowing subsequent normal processing operations on legitimate traffic flows. This effectively prevents DDoS attacks.
  • the service system can also limit the bandwidth of the traffic of user A and user B, so that the service flow of user A and user B does not exceed the preset bandwidth, so that even if the attacker performs a DDOS attack by forging the UID value, Can to some extent avoid the serious adverse consequences of DDOS attacks.
  • the preset bandwidths of User A and User B may be the same or different.
  • the service flow identifying apparatus includes: a first module, a second module, and a third module.
  • the first module is mainly used for detecting user access to the target system, and dynamically generating user identification information according to the detected user's access to the target system and the preset user access statistical model, and the first module dynamically generates the user identification information.
  • the first module may further dynamically generate priority information corresponding to the user identification information according to the detected user access to the target system and the preset user access statistical model, and store the dynamically generated priority information to the second module. For example, the first module predicts the probability that the user may access the target system during the DDoS attack according to the user access statistical model, and determines that the user is a legitimate user according to the determined probability, and accesses the service of the target system from the user.
  • the corresponding user identification information is obtained in the flow, and the priority information of the user is determined according to the determined probability, and then the user identification information and the priority information are stored in the second module.
  • the user identification information may be the existing user identification information carried in the current service flow, or may be the user identification information added to implement the service flow identification and the distributed denial of service attack defense method according to the embodiment of the present invention. As described in the above method embodiments.
  • the second module is mainly configured to receive user identification information output by the first module, and store the information as a user identification set.
  • the set of user identification information stored in the second module may be referred to as a user white list.
  • the user whitelist stored in the second module may further include priority information corresponding to the user identifier information.
  • the third module is mainly used for extracting user identification information in the service flow, and comparing the extracted user identification information with the user identification information stored in the second module to determine user identification information in the service flow and the user stored in the second module. Whether the identification information is matched; when it is determined that the user identification information in the service flow matches the user identification information stored in the second module, determining whether the service flow is a legitimate service flow, and outputting the service flow as a judgment result information of the legal service flow, When the priority information corresponding to the user identifier is stored in the second module, the third module may also output the priority information corresponding to the legal service flow; When the user identification information in the service flow does not match the user identification information stored in the second module, the service flow is determined to be an illegal service flow, and the service flow is output as the judgment result information of the illegal service flow.
  • the DDoS attack defense system provided by the embodiment of the present invention is described below.
  • the DDoS attack defense system includes: a first module, a second module, a third module, a fourth module, a fifth module, and a sixth module.
  • the first module is mainly used for detecting user access to the target system, and dynamically generating user identification information according to the detected user access to the target system and a preset user access statistical model, or dynamically generating user identification information and user identification. Priority information corresponding to the information.
  • the first module then stores the user identification information, or the user identification information, and the priority information to the second module. For example, the first module predicts the probability that the user may access the target system during the DDoS attack according to the user access statistical model, and determines that the user is a legitimate user according to the determined probability, and accesses the service of the target system from the user.
  • the corresponding user identification information is obtained in the flow, and the priority information of the user is determined according to the determined probability, and then the user identification information and the priority information are stored in the second module.
  • the first module may be composed of a storage submodule, a detection submodule, and a first dynamic submodule, or may be composed of a storage submodule, a detection submodule, a first dynamic submodule, and a second dynamic submodule.
  • the storage submodule is mainly used to store the user access statistical model.
  • the detection sub-module is mainly used to detect the user's access to the target system, and dynamically generate user identification information according to the detected user access to the target system and the user access statistical model stored in the storage sub-module, and predict the user in the DDoS. The probability of accessing the target system during the attack and outputting the 4 rate information.
  • the first dynamic sub-module is configured to: when determining that the user is a legitimate user according to the probability information output by the detecting sub-module, obtain the corresponding user identification information from the service flow of the user accessing the target system, and then store the user identification information to the second Module.
  • the first dynamic sub-module may also determine that the user is an illegal user, obtain corresponding user identification information from the service flow of the user accessing the target system, and then store the user identification information to the second module.
  • the second dynamic sub-module is mainly configured to determine the priority information corresponding to the user according to the probability information output by the detecting sub-module, and transmit the priority information to the second module for storage.
  • the second dynamic submodule may determine the priority letter corresponding to the user when the first dynamic submodule determines that the user is a legitimate user.
  • the second dynamic sub-module can also directly determine the priority information according to the probability threshold value stored therein, and determine the priority corresponding to the user when determining the priority information according to the probability threshold. Level information and output.
  • the second module is mainly configured to receive user identification information and priority information transmitted by the first module, and store, for example, the second module receives the user identification information transmitted by the first dynamic submodule and stores the information, and then receives the second module.
  • the priority information transmitted by the second dynamic submodule is stored and stored.
  • the user identification information stored in the second module and the priority information may be referred to as a user white list.
  • the information stored in the second module can also be referred to as a user blacklist.
  • the third module is mainly used for extracting user identification information in the service flow, and comparing the extracted user identification information with the user identification information stored in the second module to determine user identification information in the service flow and the user stored in the second module. Whether the identification information is matched; when it is determined that the user identification information in the service flow matches the user identification information stored in the second module, determining whether the service flow is a legitimate service flow, and outputting the service flow as a judgment result information of the legal service flow, When the priority information corresponding to the user identifier is stored in the second module, the third module may further output the priority information corresponding to the legal service flow; and determine the user identification information in the service flow and the user identifier stored in the second module. When the information does not match, it is determined that the service flow is an illegal service flow, and the service flow is output as the judgment result information of the illegal service flow.
  • the third module may initiate the operation of extracting the user identification information in the service flow and the subsequent comparison process according to the notification of the fifth module.
  • the third module may start to extract the user identification information in the service flow and the operation of the subsequent comparison process according to other methods such as manual configuration.
  • the fourth module is mainly configured to receive the service result outputted by the third module as the judgment result information of the legal service.
  • the judgment result information output by the third module is a legitimate service
  • the subsequent normal processing operation is allowed on the service flow, for example, Allowing the continuation of the service flow
  • the judgment result information output by the third module is an illegal service
  • the subsequent normal processing operations of the service flow are refused, such as prohibiting the continuation of the service flow, discarding the service flow, etc.
  • the information output by the third module includes the priority information
  • the fourth module allows subsequent normal processing operations on the service flow, the subsequent normal processing operations should be performed according to the priority corresponding to the service flow, such as the fourth.
  • the module allows the service flow to continue to transmit in sequence according to the priority information of each legal service flow in descending order.
  • the fifth module is mainly used to detect service traffic and determine the service traffic detection result according to the service.
  • the third module is notified to extract the user identification information in the service flow.
  • the fifth module can continue to detect the service traffic and continue to determine the service traffic detection result.
  • the third module is notified to stop extracting the service flow.
  • the third module may stop the subsequent processing operations of extracting and judging when receiving the stop notification.
  • the fifth module may be an optional module.
  • the sixth module is mainly used to limit the bandwidth occupied by the legal service flow according to whether the service flow output by the third module is the judgment result of the legitimate service.
  • bandwidth is restricted for the legal traffic of different users, different bandwidths can be restricted for the legal traffic of different users, and the same bandwidth can be restricted for the legal traffic of different users.
  • the sixth module may be an optional module.
  • the system provided by the embodiments of the present invention may be directed to one target system or to multiple target systems. That is to say, the system provided by the embodiment of the present invention can provide DDoS attack defense for a certain target system, and can also provide DDoS attack defense for multiple target systems at the same time.
  • the system provided by the embodiment of the present invention provides DDoS attack defense for a certain target system
  • the system may be a front system of the target system, and may be set independently of the target system or may be set in the target system.
  • FIG. 3 is a schematic diagram of a DDoS attack defense system according to an embodiment of the present invention.
  • the system in FIG. 3 includes: a DDoS detection module 31, a message filtering device 34, a user whitelist and priority module 32, and a user access statistical model module 33.
  • the DDoS detection module 31 is the fifth module described above.
  • the message filtering device 34 is the above-described third module, fourth module, and sixth module.
  • User Whitelist and Priority Module 32 is the second module described above.
  • the user access statistical model module 33 is the first module described above.
  • the message filtering device 34 is mainly used to filter the service flow that attempts to access the service system, that is, to filter the packet.
  • the message filtering device 34 may be filtered based on information stored in the user whitelist and priority module 32. For example, the message filtering device 34 filters the packet according to the source IP address in the packet, the user whitelist, and the IP address in the priority module 32.
  • the business system here is the above target system.
  • the message filtering device 34 can also limit the bandwidth occupied by the legitimate traffic flow.
  • the information stored in the user whitelist and priority module 32 is the user's white name containing the priority information. Single.
  • the user identification information and priority information stored in the user whitelist and priority module 32 may exist in the form of an entry.
  • the user whitelist and the priority entry record the user identification information that can access the service system and the priority information corresponding to the user identification information.
  • the user whitelist and priority entries are maintained by the user accessing the statistical model module 33. During the DDoS attack defense, the user whitelist and priority entries provide a query for the message filtering device 34.
  • the user access statistical model module 33 is mainly used to establish and maintain a user whitelist and a priority entry according to the user's access to the service system under normal circumstances.
  • the user access statistics model module 33 establishes and maintains the user identification information and priority information that the user accesses the statistical model and allows access to the service system in the case of a DDoS attack. If the user identification information corresponds to a high priority, it can indicate that a user who frequently accesses the service system can access the service system without any restrictions in the case of a DDoS attack under normal circumstances without a DDoS attack. If the user identification information corresponds to a low priority, it can indicate that the user who accidentally accesses the service system under normal circumstances without being attacked by the DDoS needs to be restricted to access the service system in the case of a DDoS attack.
  • the DDoS detection module 31 is mainly used for detecting service traffic of the service system to determine whether the service system is currently subjected to a DDoS attack. After detecting that the service system is subjected to a DDoS attack, the DDoS is notified to the packet filtering device 34, such as sending a filtering instruction.
  • the message filtering device 34 performs a transparent transmission operation, i.e., does not perform any processing on the traffic flow.
  • the user access statistical model module 33 detects the user's access to the business system, and dynamically generates a user access white list including the priority corresponding to each user according to the user access statistical model. User access whitelists with priority can be used during DDoS attacks.
  • the DDoS detection module 31 continuously detects the traffic of the service system to determine whether a DDoS attack has occurred.
  • the packet filtering device starts to extract the user identification information of the service flow.
  • the message filtering device may also perform a bandwidth limiting operation on the service flow according to a preset bandwidth.
  • the user access statistical model module 33 stops functioning.
  • the DDoS detection module 31 continuously detects traffic flow to determine if the DDoS attack has disappeared.
  • the above normal state and switching by the DDoS attack state are triggered by the DDoS detecting module 31.
  • the packet filtering device 34 is triggered to enable the DDoS attack defense system to enter the DDoS attack state.
  • the DDoS detection module 31 detects that the DDoS attack of the service system disappears
  • the DDoS detection module 31 detects that the DDoS attack of the service system disappears.
  • the message filtering device 34 is triggered to bring the DDoS attack defense system into a normal state.
  • the above user access statistical model module 33 can be integrated and set in the business system.
  • the DDOS detection module 31 can be co-located with the message filtering device 34 in the same device, and the DDOS detection module 31, the message filtering device 34, and the user whitelist and priority module 32 can also be co-located in the same device.
  • the apparatus provided by the embodiments of the present invention includes a first module and a second module.
  • the first module may be composed of a storage submodule, a detection submodule and a first dynamic submodule, or may be composed of a storage submodule, a detection submodule, a first dynamic submodule and a second dynamic submodule.
  • the operations performed by the above modules and sub-modules are as described in the above embodiments, and the description thereof will not be repeated here.
  • the device provided by the embodiment of the present invention may be a server that needs to generate a user whitelist, and/or a blacklist, such as a server of a business system.
  • the embodiment of the present invention dynamically generates user identification information by using a user access statistical model, so that the user identification information is easy to maintain, and the generated user identification information can identify a legitimate user as accurately as possible; therefore, the dynamically generated user identification information is utilized.
  • the accuracy of identifying the legal service flow can be improved. Since the embodiment of the present invention can accurately identify the legitimate service flow, the embodiment of the present invention can effectively prevent the illegal service flow.
  • Distributed denial of service attack that is, the distributed denial of service attack using the user access model and the packet filtering linkage defense in the embodiment of the present invention improves the distributed denial of service while avoiding the phenomenon that the attacker loses the legitimate traffic flow.
  • the defense capabilities of the attack defense system By limiting the bandwidth occupied by the legitimate service flow, the embodiment of the present invention can avoid the serious unfavorable consequences of the distributed denial of service attack to some extent, and further improve the defense capability of the distributed denial of service attack defense system.

Description

业务流识别方法、 装置及拒绝服务攻击防御方法、 系统 本申请要求于 2007 年 4 月 28 日提交中国专利局、 申请号为 200710098879.8、 发明名称为"业务流识别方法、 装置及分布式拒绝服务攻击 防御方法、 系统"的中国专利申请的优先权， 以及要求于 2007年 8月 20 日提 交中国专利局、 申请号为 200710138784.4、 发明名称为"业务流识别方法、 装 置及分布式拒绝服务攻击防御方法、 系统"的中国专利申请的优先权， 其全部 内容通过引用结合在本申请中。
技术领域
本发明涉及网络通讯技术领域， 具体涉及一种业务流识别方法、 业务流识 别装置、 拒绝服务攻击防御方法、 拒绝服务攻击防御系统和装置。
背景技术
DDoS ( Distributed Deny of Service, 分布式拒绝服务）攻击主要包括两种 实现方式， 1、 通过大流量来攻击网络设备和服务器； 2、 通过制造大量无法完 成的不完全请求， 以快速耗尽服务器资源。
目前， DDoS防御方法主要有黑洞技术： 在发生 DDoS攻击时， 运营商将发 送至被攻击者的数据包尽量阻截在上游， 然后， 将阻截的数据包引进"黑洞" 并丟弃， 从而保全运营商的基础网络和其它客户的业务。
发明人发现现有技术中的黑洞技术至少存在如下问题：由于运营商将发送 至被攻击者的数据包丟弃了，因此该被攻击者的合法数据包和恶意攻击数据包 一起被丟弃了。 虽然该方法能够保全运营商的基础网络以及其它客户的业务， 但是， 被攻击者失去了所有的业务服务， 从客观上讲， 攻击者达到了攻击的目 的。
发明内容
本发明实施方式提供一种业务流识别方法、装置， 可以提高识别合法业务 流的准确性； 本发明实施方式还提供一种拒绝服务攻击的防御应用，提高了分 布式拒绝服务攻击防御系统的防御能力；本发明实施方式还提供一种产生用户 信息的装置， 可以为业务流识别以及防御等提供所需的用户信息。
本发明实施方式提供一种业务流识别方法， 包括： 检测用户对目标系统的 访问；根据所述检测到的用户对目标系统的访问和预先设置的用户访问统计模 型动态生成用户标识信息集合； 当需要进行业务流识别时，提取业务流中的用 户标识信息；比较所述提取的用户标识信息和所述用户标识信息集合中的用户 标识信息是否匹配； 根据所述比较结果确定所述业务流是否为合法业务流。
本发明实施方式还提供一种拒绝服务攻击的防御方法， 包括： 检测用户对 目标系统的访问；根据所述检测到的用户对目标系统的访问和预先设置的用户 访问统计模型动态生成用户标识信息集合； 当需要进行业务流识别时，提取业 务流中的用户标识信息；比较所述提取的用户标识信息和所述集合中的用户标 识信息是否匹配； 根据所述比较结果确定所述业务流是否为合法业务流； 允许 对所述确定的合法业务流进行后续的正常处理操作，拒绝对所述确定的非法业 务流进行后续的正常处理操作。
本发明实施方式还提供一种业务流识别装置， 包括： 第一模块： 用于检测 用户对目标系统的访问，并根据所述检测到的用户对目标系统的访问和预先设 置的用户访问统计模型动态生成的用户标识信息， 并输出； 第二模块： 用于接 收第一模块输出的用户标识信息， 并存储为用户标识信息集合； 第三模块： 用 于提取业务流中的用户标识信息，比较所述提取的用户标识信息与所述用户标 识信息集合中的用户标识信息是否匹配，并根据比较结果判断所述业务流是否 为合法业务流以及输出判断结果。
本发明实施方式还提供一种拒绝服务攻击的防御系统， 包括： 第一模块： 用于检测用户对目标系统的访问，并根据检测到的用户对目标系统的访问和预 先设置的用户访问统计模型动态生成的用户标识信息， 并输出； 第二模块： 用 于接收第一模块输出的用户标识信息，并存储为用户标识信息集合；第三模块： 用于提取业务流中的用户标识信息，比较所述提取的用户标识信息与所述用户 标识信息集合中的用户标识信息是否匹配，并根据比较结果判断所述业务流是 否为合法业务流以及输出判断结果； 第四模块： 用于接收第三模块输出的业务 流是否为合法业务流的判断结果，并允许对所述确定的合法业务流进行后续的 正常处理操作， 拒绝对所述确定的非法业务流进行后续的正常处理操作。
本发明实施方式还提供一种产生用户信息的装置， 包括： 第一模块： 用于 检测用户对目标系统的访问，并根据检测到的用户对目标系统的访问和预先设 置的用户访问统计模型动态生成的用户标识信息， 并输出； 第二模块： 用于接 收第一模块输出的用户标识信息， 并存储为用户标识信息集合。
附图说明
图 1是依据本发明实施方式的业务流识别方法示意流程图；
图 2是依据本发明实施方式的分布式拒绝服务攻击防御方法示意流程图； 图 3是依据本发明实施方式的分布式拒绝服务攻击防御系统示意图。
具体实施方式
发明人通过大量研究发现： 在 DDoS攻击中， 虽然从报文特征和报文行为 的角度上讲， 攻击业务流和正常业务流没有什么不同， 但是， 攻击业务流和正 常业务流在访问目标系统的用户上是有区别的。 其区别在于： 由于 DDoS攻击 是大量傀儡主机发起的， 所以攻击业务流是大量傀儡主机发送出来的； 而正常 业务流是合法用户发送出来的。一般来说，合法用户访问目标系统是可预期的， 而傀儡主机访问目标系统是不可预期的。
发明人正是利用了上述发现的合法用户访问目标系统的可预期性这一特 点， 来实现业务流识别和 DDoS攻击防御的。 也就是说， 由于合法用户访问目 标系统一般是符合一定的用户访问统计模型的， 因此， 本发明实施方式利用了 用户访问统计模型来预测合法用户或非法用户。预测合法用户或非法用户的一 个具体的例子为： 根据用户访问目标系统的历史信息， 预测在 DDoS攻击状态 下可能对业务系统进行访问的概率，并根据预测出的概率来判断用户是合法用 户， 还是非法用户， 如果需要记录合法用户的标识信息， 则在判断出合法用户 时，从用户访问目标系统的业务流中获取该用户对应的用户标识信息， 并记录 在用户标识信息集合中， 此时记录的用户标识信息集合可以为用户白名单； 如 果需要记录非法用户的用户标识信息， 则在判断出非法用户时，从用户访问目 标系统的业务流中获取该用户对应的用户标识信息，并记录在用户标识信息集 合中， 此时记录的用户标识信息集合可以为用户黑名单。
例如可以将预测出的大概率用户确定为合法用户，然后从该用户的访问目 标系统的业务流中获取相应的用户标识信息， 并记录。 然后， 可根据记录的用 户标识信息来识别合法业务流和非法业务流。由于根据用户访问统计模型产生 的用户标识信息能够尽可能准确标识出合 /非法用户， 因此， 通过记录的用户 标识信息能够尽可能准确的识别出合法业务流和非法业务流。上述识别合法业 务流和非法业务流的过程可以应用在 DDoS攻击防御中。即在进行 DDoS攻击防 御时， 可以允许对识别出的合法业务流进行后续的正常处理操作， 可以拒绝对 识别出的非法业务流进行后续的正常处理操作。 即在进行 DDoS攻击防御时， 可以才艮据预期可能访问目标系统的用户对应的用户标志信息来识别业务流，并 对识别出的合 /非法业务流进行相应的后续处理操作。 从而本发明实施方式在 有效保证了合法用户对目标系统的正常访问的同时，有效拦截了非法业务流的 攻击。
在本发明实施方式中，用户标识信息集合中记录的用户标识信息可以为目 前业务流中承载的现有的用户标识信息；也可以为本发明实施方式为实现业务 流识别、 以及分布式拒绝服务攻击防御方法而新增的用户标识信息； 还可以为 上述现有的用户标识信息和新增的用户标识信息。当用户标识信息包括新增的 用户标识信息时， 新增的用户标识信息可以携带在报文新增的字段中， 例如可 以携带在应用层协议报文新增的字段中，也可以携带在安全协议报文新增的字 段中； 再例如新增的用户标识信息可以携带在用户登录阶段的报文中， 也可以 携带在用户登录之前阶段的报文中。
新增的用户标识信息可以是用户侧生成的，例如业务系统的客户端在用户 首次启动并接入业务系统初始化时生成。新增的用户标识信息也可以是网络侧 生成的， 例如， 业务系统的客户端在用户首次启动并接入业务系统时， 业务系 统为用户指定用户标识信息，并将指定的用户标识信息携带在消息中返回给客 户端。 之后， 用户访问业务系统时， 可以在报文中携带新增的用户标识信息， 也可以不携带新增的用户标识信息。
当新增的用户标识信息为用户侧生成时，新增的用户标识信息可以携带在 用户访问业务系统的第一个应用层 >¾文中，当新增的用户标识信息为网络侧生 成时， 新增的用户标识信息可以携带在业务系统发送至用户的第一个报文中。 的用户标识信息可以为随机值。
在本发明实施方式中， 一个用户可以对应多个用户标识信息。
下面首先对本发明实施方式提供的业务流识别方法进行说明。
在业务流识别方法的实施方式中，设置有用户标识信息集合。设置用户标 识信息集合的方式为： 根据用户对目标系统进行访问的历史情况、 以及预先设 置的、 一定的用户访问统计模型预测出合 /非法用户， 如预测出在 DDoS攻击 状态下可能访问目标系统的用户和 /或不可能访问目标系统的用户， 然后， 获 取可能访问目标系统的用户和 /或不可能访问目标系统的用户访问目标系统的 业务流中对应的用户标志信息。 用户标识信息可以为 IP地址， 也可以为其它 在网络报文中能够标识用户的信息， 如 HTTP报文中的 Cookie字段等， 还可 以为上述新增的用户标识信息。本发明实施方式不排除釆用静态配置用户标识 信息的方式。
本发明实施方式中设置的用户标识信息集合可以为合法用户的标识信息 集合， 此时， 设置的用户标识信息集合可以称为用户白名单。 上述设置的用户 标识信息集合也可以为非法用户的标识信息集合， 此时，设置的用户标识信息 集合可以称为用户黑名单。 用户访问统计模型可以根据网络的实际情况来设 置， 而且设置用户访问统计模型的方式有多种， 本发明实施方式不限制用户访 问统计模型的具体表现形式， 也不限制用户标识信息的具体表现形式。
在进行业务流识别过程中， 需要提取业务流中的用户标识信息， 该用户标 识信息应该与用户白 /黑名单中的用户标识信息相对应， 如用户白 /黑名单中的 用户标识信息为 IP地址， 则需要从业务流中提取源 IP地址。 在从业务流中提 取了用户标识信息后 ,需要对提取的用户标识信息与上述设置的用户标识信息 进行比较， 如将提取的用户标识信息与用户白名单中的用户标识信息进行比 较，以确定从业务流中提取的用户标识信息是否与用户白名单中的用户标识信 息匹配。如果从业务流中提取的用户标识信息与用户白名单中的用户标识信息 匹配， 则表示从业务流中提取的用户标识信息为合法用户标识信息， 该业务流 是合法用户发送的， 该业务流为合法业务流； 如果从业务流中提取的用户标识 信息与用户白名单中的用户标识信息不匹配，则表示从业务流中提取的用户标 识信息为非法用户标识信息， 该业务流是非法用户发送的， 该业务流为非法业 务流。
上述针对业务流识别过程的描述是以用户白名单为例进行说明的，如果利 用用户访问统计模型生成的是用户黑名单，其业务流识别过程与上述描述基本 相同， 在此不再重复描述。 上述业务流识别过程可以应用于多种防御技术方案中， 如可以应用于 DDoS攻击防御技术方案中。 下面对本发明实施方式提供的 DDoS攻击防御方 法进行说明。
DDoS攻击防御过程中， 利用了上述业务流识别过程。 在利用上述描述的 业务流识别过程识别出业务流为合法业务流还是非法业务流后，可以允许对识 别出的合法业务流进行后续的正常处理操作，如允许正常传输等； 可以拒绝对 识别出的非法业务流进行后续的正常处理操作，如拒绝正常传输、 并将识别出 的非法业务流丟弃等。
上述 DDoS攻击防^卸过程可以在出现 DDoS攻击时启动。启动方式可以为 手工配置启动，也可以为动态检测启动。动态检测启动如对业务流量进行检测， 并判断检测结果， 以确定是否出现 DDoS攻击； 在确定出现 DDoS攻击时， 开 始提取业务流中的用户标识信息， 并进行业务流识别等后续过程。对业务流量 进行检测、 并根据检测结果确定是否出现 DDoS攻击的实现方式有多种， 本发 明实施方式可以釆用现有的方法来检测判断是否出现 DDoS攻击。本发明实施 方式不限制检测判断是否出现 DDoS攻击的具体实现方式。
在识别出合法业务流和非法业务流后，可以根据优先级对业务流进行后续 处理。这里的优先级可以是通过用户访问统计模型动态生成的； 如在检测用户 对目标系统的历史访问数据过程中， 利用用户访问统计模型动态预测出在 DDoS攻击过程中可能访问目标系统的用户或者不可能访问目标系统的用户、 以及对应的优先级信息。根据上述预期可能访问目标系统或者不可能访问目标 系统的用户、 以及优先级信息动态生成包含用户标识信息、 以及对应的优先级 信息的用户白名单或用户黑名单。 在动态生成了包含优先级信息的用户白 /黑 名单后， 如果检测到 DDoS攻击、 并启动了 DDoS攻击防御， 根据优先级信息 对业务流进行处理的方式有多种，如按照优先级从高到低的顺序来允许合法业 务流进行后续的正常处理流程， 再如在 DDoS攻击严重时，也可以按照从低到 高的顺丟弃合法业务流。本发明实施方式不限制根据优先级信息对业务流进行 处理的具体实现方式。
本发明实施方式还可以限制合法业务流占用的带宽， 例如， 对每个合法业 务流均进行带宽限制。 而且， 每个合法业务流对应的限制带宽可以相同， 也可 以有所区别。
下面以用户白名单为例、结合附图对本发明实施方式提供的业务流识别方 法进行说明。
本发明实施方式提供的业务流识别方法如附图 1所示。
图 1中， 步骤 1、 设置用户访问统计模型。 简单的用户访问统计模型可以 为根据历史访问记录访问过目标系统，或者为根据历史访问记录访问过目标系 统预定次数等等。 这里仅仅举了两个很简单的用户访问统计模型的例子， 用户 访问统计模型可以多种多样的。
步骤 2、 检测用户对目标系统进行访问的情况， 根据用户访问统计模型动 态生成用户标识信息，如根据用户访问统计模型确定该用户在 DDoS攻击过程 中可能访问目标系统的概率， 并根据确定出的概率判断出该用户为合法用户 时， 从该用户访问目标系统的业务流中获取相应的用户标识信息。 在步骤 2 中也可以根据用户访问统计模型动态生成用户标识信息、以及该用户标识信息 对应的优先级信息， 如根据预测出的概率来确定该用户的优先级信息。
步骤 3、 将动态生成的用户标识信息存储在用户白名单中。
如果在步骤 2中动态生成了该用户标识信息对应的优先级信息，则在步骤 3中， 可以将动态生成的用户标识信息以及优先级信息存储在用户白名单中。
在需要进行业务流识别时， 到步骤 4, 提取业务流中的用户标识信息， 如 从业务流中提取源 IP地址等。
步骤 5、将提取的用户标识信息与用户白名单中的用户标识信息进行比较， 如果从业务流中提取的用户标识信息与用户白名单中的用户标识信息匹配，则 到步骤 6; 否则到步骤 7。
步骤 6、 确认该业务流是合法用户发送的， 输出该业务流为合法业务流的 信息。 如果用户白名单中包含有优先级信息， 则在步骤 6中， 可以输出该业务 流为合法业务流的信息、 以及该合法业务流对应的优先级信息。
步骤 7、 确认该业务流是非法用户发送的， 输出该业务流为非法业务流的 信息。
下面结合附图对本发明实施方式提供的 DDoS攻击防御方法进行说明。 本发明实施方式提供的 DDoS攻击防御方法如附图 2所示。 图 2中， 步骤 1、 设置用户访问统计模型。 简单的用户访问统计模型可以 为根据历史访问记录访问过目标系统，或者为根据历史访问记录访问过目标系 统预定次数等等。 这里仅仅举了两个很简单的用户访问统计模型的例子， 用户 访问统计模型可以多种多样的。
步骤 2、 根据用户发送的业务流检测用户对目标系统进行访问的情况， 根 据用户访问统计模型动态生成用户标识信息、以及该用户标识信息对应的优先 级信息。例如根据用户访问统计模型确定该用户在 DDoS攻击过程中可能访问 目标系统的概率， 并根据确定出的概率判断出该用户为合法用户时，从该用户 访问目标系统的业务流中获取相应用户标识信息，并根据确定出的概率确定该 用户的优先级信息。
步骤 3、将动态生成的用户标识信息以及优先级信息存储在用户白名单中。 步骤 4、 检测业务流量， 并根据业务流量检测结果判断是否出现 DDoS攻 击， 如果出现 DDoS攻击， 到步骤 5; 如果没有出现 DDoS攻击， 仍然进行业 务流量检测过程。
步骤 5 , 提取业务流中的用户标识信息， 如从业务流中提取源 IP地址等。 步骤 6、将提取的用户标识信息与用户白名单中的用户标识信息进行比较， 如果从业务流中提取的用户标识信息与用户白名单中的用户标识信息匹配，则 到步骤 7; 否则到步骤 8。
步骤 7、 确认该业务流是合法用户发送的， 根据该业务流对应的优先级信 息允许对该业务流进行后续的正常处理操作。
步骤 8、 确认该业务流是非法用户发送的， 拒绝对该业务流进行后续的正 常处理操作， 并丟弃该业务流。
在上述针对图 2的描述中，步骤 2和步骤 3这两个步骤与步骤 4之间是可 以没有先后顺序的， 即步骤 2和步骤 3的执行过程是独立的， 与步骤 4的执行 没有先后关系， 步骤 4的执行过程是独立的， 与步骤 2和步骤 3的执行没有先 后关系。本发明实施方式还可以在检测出 DDoS攻击后，持续对业务流量进行 检测， 在根据业务流量检测结果确定出 DDoS 攻击结束后， 停止执行步骤 5 至步骤 8, 而继续执行步骤 2、 步骤 3。 该流程仅仅是一个示意， 具体的实现 流程可以有多种， 在此不再——例举。 在上述各实施方式的描述中， 如果用户标识信息为新增的用户标识信息、 且用户标识信息只携带在用户登录阶段的报文或者用户登录之前阶段的报文 中的情况下， 在检测出 DDoS攻击后， 则在有用户登录或者发起连接时， 可以 根据用户标识信息来确定是否允许用户登录或者允许与该用户建立连接，从而 可以在一定程度上避免 DDoS攻击。
在上述各实施方式的描述中，用户标识信息集合中可以设置一个对应关系 来作为用户标识信息 ,例如，设置用户账号与新增的用户标识信息的对应关系。 这样，在根据业务流中携带的新增的用户标识信息确定出该业务流为合法业务 流后，该用户账号下的不携带对应关系中新增的用户标识信息的其它业务流也 可以确认为合法业务流。 上述对应关系可以更新。
下面以新增的用户标识信息为例， 对本发明实施方式提供的 DDoS攻击防 御方法进行说明。
设定与该业务系统交互的所有协议报文中都可以包含 UID (用户标识信 息）字段， 该字段可以为 128bit。
设定用户 A和用户 B成功注册到一个业务系统， 该业务系统可以是为用户 提供应用服务的业务系统，也可以是为用户提供接入认证服务的业务系统。用 户 A和用户 B在首次访问业务系统时， 将用户 A的 UID字段初始化为为随机值 0x0123456789abcdef, 将用户 B的 UID字段初始化为 0xfedcba9876543210。
业务系统根据用户访问统计模型建立的用户标识信息集合中动态设置了 用户 A和用户 B的 UID。
设定检测出业务系统出现 DDoS攻击， 则该业务系统可以立刻根据用户标 识信息集合中的 UID、 以及业务流中的 UID字段对业务流进行过滤。 由于该业 务系统的用户标识信息集合中只设置有用户 A和用户 B的 UID, 所以， 该业务 系统在判断出接收到的业务流中的 UID字段中的值不为 0x0123456789abcdef或 者 0xfedcba9876543210时， 确定该业务流为非法业务流， 拒绝对非法业务流进 行后续的正常处理操作； 该业务系统在判断出接收到业务流中的 UID字段中的 值为 0x0123456789abcdef或者 0xfedcba9876543210时， 确定该业务流为合法业 务流， 允许对合法业务流进行后续的正常处理操作。 从而有效防范了 DDoS攻 击。 该业务系统还可以对用户 A和用户 B的业务流进行带宽限制，使用户 A和用 户 B的业务流不会超过预设定带宽， 这样， 即使是攻击者通过伪造 UID值进行 DDOS攻击， 也能够在一定程度上避免 DDOS攻击带来的严重的不良后果。 这 里的用户 A和用户 B的预设定带宽可以相同， 也可以不同。
下面对本发明实施方式提供的业务流识别装置进行说明。
本发明实施方式提供的业务流识别装置包括： 第一模块、第二模块和第三 模块。
第一模块主要用于检测用户对目标系统的访问，并根据检测到的用户对目 标系统的访问、 以及预先设置的用户访问统计模型动态生成用户标识信息， 第 一模块将动态生成的用户标识信息存储至第二模块。而且第一模块还可以根据 检测到的用户对目标系统的访问、以及预先设置的用户访问统计模型动态生成 用户标识信息对应的优先级信息， 并将动态生成的优先级信息存储至第二模 块。 例如， 第一模块在根据用户访问统计模型预测出该用户在 DDoS攻击过程 中可能访问目标系统的概率， 并根据确定出的概率判断出该用户为合法用户 时，从该用户访问目标系统的业务流中获取相应用户标识信息， 并根据确定出 的概率确定该用户的优先级信息 ,然后将用户标识信息和优先级信息存储至第 二模块。 这里的用户标识信息可以为目前业务流中承载的现有的用户标识信 息； 也可以为本发明实施方式为实现业务流识别、 以及分布式拒绝服务攻击防 御方法而新增的用户标识信息， 具体如上述方法实施方式中的描述。
第二模块主要用于接收第一模块输出的用户标识信息 ,并存储为用户标识 集合。 第二模块中存储的用户标识信息集合可以称为用户白名单。 而且在第一 模块传输来用户标识对应的优先级信息时，第二模块中存储的用户白名单中还 可以包括用户标识信息对应的优先级信息。
第三模块主要用于提取业务流中的用户标识信息，将提取的用户标识信息 与第二模块中存储的用户标识信息进行比较，以确定业务流中的用户标识信息 与第二模块存储的用户标识信息是否匹配；在判断出业务流中的用户标识信息 与第二模块存储的用户标识信息匹配时，确定该业务流是否为合法业务流， 并 输出业务流为合法业务流的判断结果信息，在第二模块中存储有用户标识对应 的优先级信息时， 第三模块还可以输出该合法业务流对应的优先级信息； 在判 断出业务流中的用户标识信息与第二模块存储的用户标识信息不匹配时，确定 该业务流为非法业务流， 并输出业务流为非法业务流的判断结果信息。
下面对本发明实施方式提供的 DDoS攻击防御系统进行说明。
本发明实施方式提供的 DDoS攻击防御系统包括： 第一模块、 第二模块、 第三模块、 第四模块、 第五模块和第六模块。
第一模块主要用于检测用户对目标系统的访问，并根据检测到的用户对目 标系统的访问、 以及预先设置的用户访问统计模型动态生成用户标识信息， 或 者动态生成用户标识信息、 以及用户标识信息对应的优先级信息。 然后， 第一 模块并将用户标识信息、或者将用户标识信息、 以及优先级信息存储至第二模 块。 例如， 第一模块在根据用户访问统计模型预测出该用户在 DDoS攻击过程 中可能访问目标系统的概率， 并根据确定出的概率判断出该用户为合法用户 时，从该用户访问目标系统的业务流中获取相应用户标识信息， 并根据确定出 的概率确定该用户的优先级信息 ,然后将用户标识信息和优先级信息存储至第 二模块。
第一模块可以由存储子模块、检测子模块和第一动态子模块组成， 也可以 由存储子模块、 检测子模块、 第一动态子模块和第二动态子模块组成。
存储子模块主要用于存储用户访问统计模型。
检测子模块主要用于检测用户对目标系统的访问情况，并根据检测到的用 户对目标系统的访问情况、存储子模块中存储的用户访问统计模型动态生成用 户标识信息，预测出该用户在 DDoS攻击过程中可能访问目标系统的概率，并 输出该 4既率信息。
第一动态子模块主要用于根据检测子模块输出的概率信息判断出该用户 为合法用户时，从该用户访问目标系统的业务流中获取相应用户标识信息， 然 后将用户标识信息存储至第二模块。第一动态子模块也可以确定出该用户为非 法用户时，从该用户访问目标系统的业务流中获取相应用户标识信息， 然后将 用户标识信息存储至第二模块。
第二动态子模块主要用于根据检测子模块输出的概率信息确定该用户对 应的优先级信息， 并将优先级信息传输至第二模块存储。 第二动态子模块可以 在第一动态子模块判断出该用户为合法用户时， 确定该用户对应的优先级信 息， 并输出； 第二动态子模块也可以直接根据其内部存储的概率阔值来判断是 否需要确定优先级信息， 在根据概率阔值判断出需要确定优先级信息时，确定 该用户对应的优先级信息并输出。
第二模块主要用于接收第一模块传输来的用户标识信息、 以及优先级信 息， 并存储， 如第二模块接收第一动态子模块传输来的用户标识信息并存储， 再如第二模块接收第二动态子模块传输来的优先级信息并存储。第二模块中存 储的用户标识信息、 以及优先级信息可以称为用户白名单。 第二模块中存储的 信息也可以称为用户黑名单。
第三模块主要用于提取业务流中的用户标识信息，将提取的用户标识信息 与第二模块中存储的用户标识信息进行比较，以确定业务流中的用户标识信息 与第二模块存储的用户标识信息是否匹配；在判断出业务流中的用户标识信息 与第二模块存储的用户标识信息匹配时，确定该业务流是否为合法业务流， 并 输出业务流为合法业务流的判断结果信息，在第二模块中存储有用户标识对应 的优先级信息时， 第三模块还可以输出该合法业务流对应的优先级信息； 在判 断出业务流中的用户标识信息与第二模块存储的用户标识信息不匹配时，确定 该业务流为非法业务流， 并输出业务流为非法业务流的判断结果信息。
第三模块可以根据第五模块的通知启动提取业务流中的用户标识信息、以 及后续比较过程的操作。 当然， 在该系统不包括第五模块时， 第三模块可以根 据手工配置等其它方式来启动提取业务流中的用户标识信息、以及后续比较过 程的操作。
第四模块主要用于接收第三模块输出的业务流是否为合法业务的判断结 果信息， 当第三模块输出的判断结果信息为合法业务时， 允许对该业务流进行 后续的正常处理操作，如允许该业务流的继续传输； 当第三模块输出的判断结 果信息为非法业务时，拒绝对该业务流进行后续的正常处理操作，如禁止该业 务流的继续传输， 将该业务流丟弃等。 当第三模块输出的信息包括优先级信息 时， 第四模块在允许对该业务流进行后续的正常处理操作时，应根据该业务流 对应的优先级来进行后续的正常处理操作 ,如第四模块根据各合法业务流的优 先级信息、 按照由高到低的顺序允许业务流依次进行继续传输。
第五模块主要用于检测业务流量， 并判断业务流量检测结果， 在根据业务 流量检测结果确定出现 DDoS攻击时，通知第三模块提取业务流中的用户标识 信息。在根据业务流量检测结果确定出现 DDoS攻击后， 第五模块仍然可以继 续检测业务流量， 并继续判断业务流量检测结果， 在根据业务流量检测结果确 定 DDoS攻击消失时，通知第三模块停止提取业务流中的用户标识信息。 第三 模块可以在接收到停止通知时，停止进行提取并判断的后续处理操作。在本发 明系统实施方式中， 第五模块可以为可选模块。
第六模块主要用于根据第三模块输出的业务流是否为合法业务的判断结 果信息， 限制合法业务流占用的带宽。对不同用户的合法业务流进行带宽限制 时， 可以对不同用户的合法业务流进行不同带宽的限制， 也可以对不同用户的 合法业务流进行相同带宽的限制。在本发明系统实施方式中， 第六模块可以为 可选模块。
本发明实施方式提供的系统可以针对一个目标系统，也可以针对多个目标 系统。 也就是说， 本发明实施方式提供的系统可以为某一个目标系统提供 DDoS攻击防御， 也可以同时为多个目标系统提供 DDoS攻击防御。 当本发明 实施方式提供的系统为某一个目标系统提供 DDoS攻击防御时，该系统可以为 目标系统的前置系统， 而且可以独立于目标系统设置，也可以设置于目标系统 中。
下面结合附图对本发明实施方式提供的 DDoS攻击防御系统进行说明。 图 3为本发明实施方式提供的 DDoS攻击防御系统。
图 3中的系统包括： DDoS检测模块 31、 报文过滤装置 34、 用户白名单及优 先级模块 32、 用户访问统计模型模块 33。 DDoS检测模块 31即上述第五模块。 报文过滤装置 34即上述第三模块、第四模块和第六模块。 用户白名单及优先级 模块 32即上述第二模块。 用户访问统计模型模块 33即上述第一模块。
报文过滤装置 34主要用于完成对试图访问业务系统的业务流进行过滤，即 对报文包进行过滤。 报文过滤装置 34可以是基于用户白名单及优先级模块 32 中存储的信息进行过滤的。 例如， 报文过滤装置 34根据报文包中的源 IP地址、 用户白名单及优先级模块 32中的 IP地址对报文包进行过滤。这里的业务系统即 上述目标系统。 报文过滤装置 34还可以对合法业务流占用的带宽进行限制。
用户白名单及优先级模块 32中存储的信息为包含优先级信息的用户白名 单。用户白名单及优先级模块 32中存储的用户标识信息和优先级信息可以以表 项的形式存在。用户白名单及优先级表项中记录有可以访问该业务系统的用户 标识信息、 及其该用户标识信息对应的优先级信息。
上述用户白名单及优先级表项由用户访问统计模型模块 33来进行维护。在 DDoS攻击防御时，上述用户白名单及优先级表项为报文过滤装置 34提供查询。
用户访问统计模型模块 33主要用于在正常情况下根据用户对业务系统的 访问情况建立并维护用户白名单和优先级表项。用户访问统计模型模块 33建立 并维护的表项为用户访问统计模型声明的、 在受到 DDoS攻击情况下、 允许访 问业务系统的用户标识信息以及优先级信息。 如果用户标识信息对应高优先 级， 则可以表示在没有受到 DDoS攻击的正常情况下、 经常访问该业务系统的 用户可以在受到 DDoS攻击情况下、 毫无限制的访问该业务系统。 如果用户标 识信息对应低优先级， 则可以表示在没有受到 DDoS攻击的正常情况下、 偶然 访问业务系统的用户在受到 DDoS攻击情况下、需要受限制的访问该业务系统。
DDoS检测模块 31主要用于检测业务系统的业务流量， 以确定业务系统目 前是否受到 DDoS攻击，在检测到业务系统受到 DDoS攻击后， 向报文过滤装置 34发出通知， 如发送过滤指令等。
下面分正常状态、 受攻击状态对上述防御系统的工作流程进行说明。
在正常状态下，报文过滤装置 34执行透明传输操作， 即不对业务流进行任 何处理。用户访问统计模型模块 33检测用户对业务系统的访问情况， 并根据用 户访问统计模型动态生成包含各用户对应的优先级的用户访问白名单。包含优 先级的用户访问白名单可以在 DDoS攻击期间使用。 DDoS检测模块 31持续对业 务系统的业务流量进行检测， 以确定是否出现 DDoS攻击。
在受到 DDoS攻击状态下，报文过滤装置开始提取业务流的用户标识信息，
报文过滤装置还可以根据预先设定的带宽对业务流执行带宽限制操作。用户访 问统计模型模块 33停止运作。 DDoS检测模块 31持续对业务流量进行检测， 以 确定 DDoS攻击是否消失。
上述正常状态和受到 DDoS攻击状态的切换是由 DDoS检测模块 31触发的。 即 DDoS检测模块 31在检测到业务系统出现 DDoS攻击时，则触发报文过滤装置 34, 使 DDoS攻击防御系统进入受到 DDoS攻击状态， DDoS检测模块 31在检测 到业务系统的 DDoS攻击消失时， 则触发报文过滤装置 34,使 DDoS攻击防御系 统进入正常状态。
上述用户访问统计模型模块 33可以集成设置于业务系统中。 DDOS检测模 块 31可以和报文过滤装置 34可以合设在同一个设备中， DDOS检测模块 31、 报 文过滤装置 34和用户白名单及优先级模块 32也可以合设在同一个设备中。
下面对本发明实施方式提供的装置进行说明。
本发明实施方式提供的装置包括第一模块和第二模块。第一模块可以由存 储子模块、检测子模块和第一动态子模块组成， 也可以由存储子模块、检测子 模块、 第一动态子模块和第二动态子模块组成。 上述各模块、 子模块所执行的 操作如上述实施方式中的描述， 在此不再重复说明。
本发明实施方式提供的装置可以为业务系统的服务器等需要产生用户白 名单、 和 /或黑名单的设备。
本发明实施方式通过利用用户访问统计模型来动态生成用户标识信息，使 用户标识信息易于维护、而且使生成的用户标识信息能够尽可能准确的标识出 合法用户；因此在利用动态生成的用户标识信息对合法业务流和非法业务流进 行识别时， 能够提高识别合法业务流的准确性； 由于本发明实施方式能够准确 识别出合法业务流， 因此， 本发明实施方式能够有效防止非法业务流带来的分 布式拒绝服务攻击；即本发明实施方式釆用用户访问模型与报文过滤连动防御 的分布式拒绝服务攻击， 在避免了被攻击者失去合法业务流现象的同时，提高 了分布式拒绝服务攻击防御系统的防御能力。本发明实施方式通过限制合法业 务流占用的带宽，能够在一定程度上避免分布式拒绝服务攻击带来的严重的不 良后果， 进一步提高了分布式拒绝服务攻击防御系统的防御能力。
虽然通过实施例描绘了本发明， 本领域普通技术人员知道， 本发明有许多 变形和变化而不脱离本发明的精神，本发明的申请文件的权利要求包括这些变 形和变化。

Claims

权 利 要 求
1、 一种业务流识别方法， 其特征在于， 所述方法包括：
检测用户对目标系统的访问；
根据所述检测到的用户对目标系统的访问和预先设置的用户访问统计模 型动态生成用户标识信息集合；
当需要进行业务流识别时， 提取业务流中的用户标识信息；
比较所述提取的用户标识信息和所述用户标识信息集合中的用户标识信 息是否匹配；
根据所述比较结果确定所述业务流是否为合法业务流。
2、 一种拒绝服务攻击的防御方法， 其特征在于， 所述方法包括： 检测用户对目标系统的访问；
根据所述检测到的用户对目标系统的访问和预先设置的用户访问统计模 型动态生成用户标识信息集合；
当需要进行业务流识别时， 提取业务流中的用户标识信息；
比较所述提取的用户标识信息和所述集合中的用户标识信息是否匹配； 根据所述比较结果确定所述业务流是否为合法业务流；
允许对所述确定的合法业务流进行后续的正常处理操作，拒绝对所述确定 的非法业务流进行后续的正常处理操作。
3、 如权利要求 2所述的方法， 其特征在于， 所述当需要进行业务流识别 时， 提取业务流中的用户标识信息的步骤包括： 当确定出现拒绝服务攻击时， 提取业务流中的用户标识信息。
4、 如权利要求 3所述的方法， 其特征在于， 通过检测业务流量确定是否 出现拒绝服务攻击。
5、 如权利要求 2至 4中任一项所述的方法， 其特征在于， 在所述根据检 测到的用户对目标系统的访问和预先设置的用户访问统计模型动态生成的用 户标识信息集合中还包括用户标识信息对应的优先级信息；
所述允许对所述确定的合法业务流进行后续的正常处理操作的步骤包括： 根据所述合法业务流的用户标识信息对应的优先级信息，允许对所述确定的合 法业务流进行后续的正常处理操作。
6、 如权利要求 2至 4中任一项所述的方法， 其特征在于， 所述用户标识 信息集合中的用户标识信息包括： 业务流中现有的用户标识信息和 /或业务流 中新增的用户标识信息；
所述提取的业务流中的用户标识信息与所述用户标识信息集合中的用户 标识信息相对应。
7、 如权利要求 2至 4中任一项所述的方法， 其特征在于， 所述用户标识 信息集合中的用户标识信息包括业务流中新增的用户标识信息，所述新增的用 户标识信息由用户侧生成或者由网络侧生成。
8、 如权利要求 2至 4中任一项所述的方法， 其特征在于， 所述用户标识 信息集合包括合法用户的标识信息集合和 /或非法用户的标识信息集合。
9、 如权利要求 2至 4中任一项所述的方法， 其特征在于， 所述方法还包 括： 限制所述合法业务流占用的带宽。
10、 一种业务流识别装置， 其特征在于， 所述装置包括：
第一模块： 用于检测用户对目标系统的访问， 并根据所述检测到的用户对 目标系统的访问和预先设置的用户访问统计模型动态生成的用户标识信息，并 输出；
第二模块： 用于接收第一模块输出的用户标识信息， 并存储为用户标识信 息集合；
第三模块： 用于提取业务流中的用户标识信息， 比较所述提取的用户标识 信息与所述用户标识信息集合中的用户标识信息是否匹配，并根据比较结果判 断所述业务流是否为合法业务流以及输出判断结果。
11、 一种拒绝服务攻击的防御系统， 其特征在于， 所述系统包括： 第一模块： 用于检测用户对目标系统的访问， 并根据检测到的用户对目标 系统的访问和预先设置的用户访问统计模型动态生成的用户标识信息， 并输 出；
第二模块： 用于接收第一模块输出的用户标识信息， 并存储为用户标识信 息集合；
第三模块： 用于提取业务流中的用户标识信息， 比较所述提取的用户标识 信息与所述用户标识信息集合中的用户标识信息是否匹配，并根据比较结果判 断所述业务流是否为合法业务流以及输出判断结果；
第四模块： 用于接收第三模块输出的业务流是否为合法业务流的判断结 果， 并允许对所述确定的合法业务流进行后续的正常处理操作，拒绝对所述确 定的非法业务流进行后续的正常处理操作。
12、 如权利要求 11所述的系统， 其特征在于， 所述系统还包括： 第五模块： 用于检测业务流量， 确定是否出现拒绝服务攻击， 并在确定出 现拒绝服务攻击时通知第三模块提取业务流中的用户标识信息。
13、 如权利要求 11所述的系统， 其特征在于， 所述第一模块包括： 存储子模块： 用于存储用户访问统计模型；
检测子模块： 用于检测用户对目标系统的访问， 并根据检测到的用户对目 标系统的访问信息、存储子模块中存储的用户访问统计模型确定用户访问目标 系统的概率；
第一动态子模块：用于根据检测子模块确定的概率确定需要从用户访问目 标系统的业务流中获取用户标识信息时，获取用户标识信息并输出至所述第二 模块。
14、 如权利要求 13所述的系统， 其特征在于， 所述第一模块还包括： 第二动态子模块：用于根据检测子模块确定的概率动态生成用户标识信息 对应的优先级信息， 并输出至第二模块予以存储；
所述第四模块在允许对所述确定的合法业务流进行后续的正常处理操作 时，根据所述第二模块中存储的优先级信息确定所述合法业务流的用户标识信 息对应的优先级，并根据所述确定的优先级允许对所述确定的合法业务流进行 后续的正常处理操作。
15、 如权利要求 11至 14中任一项所述的系统， 其特征在于：
所述拒绝服务攻击防御系统为所述目标系统的前置系统，所述拒绝服务攻 击防御系统独立于所述目标系统或者设置于所述目标系统之中。
16、 如权利要求 11至 14中任一项所述的系统， 其特征在于， 所述拒绝服 务攻击防御系统对应一个目标系统或者对应多个目标系统。
17、 如权利要求 11至 14中任一项所述的系统， 其特征在于， 还包括： 第六模块：用于根据所述第三模块输出的业务流是否为合法业务流的判断 结果， 限制合法业务流占用的带宽。
18、 一种产生用户信息的装置， 其特征在于， 包括：
第一模块： 用于检测用户对目标系统的访问， 并根据检测到的用户对目标 系统的访问和预先设置的用户访问统计模型动态生成的用户标识信息， 并输 出；
第二模块： 用于接收第一模块输出的用户标识信息， 并存储为用户标识信 息集合。
19、 如权利要求 18所述的装置， 其特征在于， 所述第一模块包括： 存储子模块： 用于存储用户访问统计模型；
检测子模块： 用于检测用户对目标系统的访问， 并根据检测到的用户对目 标系统的访问信息、存储子模块中存储的用户访问统计模型确定用户访问目标 系统的概率；
第一动态子模块：用于根据检测子模块确定的概率确定需要从用户访问目 标系统的业务流中获取用户标识信息时，获取用户标识信息并输出至所述第二 模块。
20、 如权利要求 18或 19所述的装置， 其特征在于， 所述用户标识信息集 合包括合法用户标识信息集合和 /或非法用户标识信息集合。
PCT/CN2008/070621 2007-04-28 2008-03-28 Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service WO2008131667A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP08715357A EP2136526A4 (en) 2007-04-28 2008-03-28 METHOD, DEVICE FOR IDENTIFYING SERVICE FLOWS AND METHOD, SYSTEM FOR PROTECTING AGAINST SERVICE DISNI ATTACK
US12/607,854 US20100095351A1 (en) 2007-04-28 2009-10-28 Method, device for identifying service flows and method, system for protecting against deny of service attack

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN200710098879.8 2007-04-28
CNA2007100988798A CN101039326A (zh) 2007-04-28 2007-04-28 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统
CN2007101387844A CN101136922B (zh) 2007-04-28 2007-08-20 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统
CN200710138784.4 2007-08-20

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/607,854 Continuation US20100095351A1 (en) 2007-04-28 2009-10-28 Method, device for identifying service flows and method, system for protecting against deny of service attack

Publications (1)

Publication Number Publication Date
WO2008131667A1 true WO2008131667A1 (fr) 2008-11-06

Family

ID=39160749

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/070621 WO2008131667A1 (fr) 2007-04-28 2008-03-28 Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service

Country Status (4)

Country Link
US (1) US20100095351A1 (zh)
EP (1) EP2136526A4 (zh)
CN (1) CN101136922B (zh)
WO (1) WO2008131667A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106204847A (zh) * 2016-07-18 2016-12-07 北京千丁互联科技有限公司 门禁管理系统、后台服务器及其自学习方法

Families Citing this family (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101136922B (zh) * 2007-04-28 2011-04-13 华为技术有限公司 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统
US8533821B2 (en) * 2007-05-25 2013-09-10 International Business Machines Corporation Detecting and defending against man-in-the-middle attacks
FR2932043B1 (fr) * 2008-06-03 2010-07-30 Groupe Ecoles Telecomm Procede de tracabilite et de resurgence de flux pseudonymises sur des reseaux de communication, et procede d'emission de flux informatif apte a securiser le trafic de donnees et ses destinataires
US20100269162A1 (en) 2009-04-15 2010-10-21 Jose Bravo Website authentication
US8683609B2 (en) 2009-12-04 2014-03-25 International Business Machines Corporation Mobile phone and IP address correlation service
US8838988B2 (en) 2011-04-12 2014-09-16 International Business Machines Corporation Verification of transactional integrity
CN102761531B (zh) * 2011-04-29 2015-12-16 腾讯科技（深圳）有限公司 一种社区验证方法和服务器
CN102263788B (zh) * 2011-07-14 2014-06-04 百度在线网络技术（北京）有限公司 一种用于防御指向多业务系统的DDoS攻击的方法与设备
CN103139246B (zh) * 2011-11-25 2016-06-15 百度在线网络技术（北京）有限公司 负载均衡设备和负载均衡及防御方法
US9338095B2 (en) 2012-05-01 2016-05-10 F5 Networks, Inc. Data flow segment optimized for hot flows
US8917826B2 (en) 2012-07-31 2014-12-23 International Business Machines Corporation Detecting man-in-the-middle attacks in electronic transactions using prompts
CN102868737B (zh) * 2012-08-30 2015-09-02 浪潮(北京)电子信息产业有限公司 安全调度方法和系统
CN104348795B (zh) * 2013-07-30 2019-09-20 深圳市腾讯计算机系统有限公司 通用网关接口业务入侵防护的方法及装置
US10152605B2 (en) 2014-05-21 2018-12-11 Siddharth Shetye Systems and methods for front-end and back-end data security protocols
US10193922B2 (en) * 2015-01-13 2019-01-29 Level 3 Communications, Llc ISP blacklist feed
KR101621019B1 (ko) * 2015-01-28 2016-05-13 한국인터넷진흥원 시계열 통계 기반 공격의심 이상징후를 탐지하기 위한 방법
US10284595B2 (en) * 2015-05-08 2019-05-07 Citrix Systems, Inc. Combining internet routing information with access logs to assess risk of user exposure
CN105991637B (zh) * 2015-06-15 2019-06-07 杭州迪普科技股份有限公司 网络攻击的防护方法和装置
CN105337970A (zh) * 2015-10-20 2016-02-17 上海斐讯数据通信技术有限公司 路由器、服务器以及两者协同的网络访问控制方法
US20170115864A1 (en) 2015-10-24 2017-04-27 Oracle International Corporation Visual form designer
CN105721494B (zh) * 2016-03-25 2019-04-19 中国互联网络信息中心 一种异常流量攻击检测处置的方法和装置
CN106059939B (zh) * 2016-05-19 2019-12-06 新华三技术有限公司 一种报文转发方法及装置
CN107239928B (zh) * 2017-01-03 2018-04-06 北京嘀嘀无限科技发展有限公司 一种资源分配的流程生成方法及装置
CN110636508B (zh) * 2018-06-25 2023-05-09 中国移动通信有限公司研究院 一种拒绝服务Detach控制方法及网络设备
US10944783B2 (en) 2018-07-12 2021-03-09 At&T Intellectual Property I, L.P. Dynamic denial of service mitigation system
US11483346B2 (en) * 2020-05-27 2022-10-25 Sap Se Reinforcement learning for application responses using deception technology
RU2768536C1 (ru) * 2021-04-21 2022-03-24 Федеральное государственное бюджетное образовательное учреждение высшего образования "Санкт-Петербургский государственный университет телекоммуникаций им. проф. М.А. Бонч-Бруевича" Способ защиты сервера услуг от DDoS атак

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
CN1602470A (zh) * 2001-12-10 2005-03-30 思科技术公司 防御恶意流量
CN1649311A (zh) * 2005-03-23 2005-08-03 北京首信科技有限公司 基于机器学习的用户行为异常检测系统和方法
CN1658576A (zh) * 2005-03-09 2005-08-24 中山大学 一种大型网站数据流的检测与防御方法
CN1674558A (zh) * 2004-03-25 2005-09-28 株式会社日立制作所 信息中继装置和数据流统计信息收集方法
CN1750481A (zh) * 2005-09-29 2006-03-22 西安交大捷普网络科技有限公司 基于时间段加权统计模型的网络异常检测方法
CN1822593A (zh) * 2006-03-20 2006-08-23 赵洪宇 一种抵御拒绝服务攻击事件的网络安全保护方法
CN101039326A (zh) * 2007-04-28 2007-09-19 华为技术有限公司 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统
CN101136922A (zh) * 2007-04-28 2008-03-05 华为技术有限公司 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7707305B2 (en) * 2000-10-17 2010-04-27 Cisco Technology, Inc. Methods and apparatus for protecting against overload conditions on nodes of a distributed network
US7225270B2 (en) * 2000-10-17 2007-05-29 Cisco Technology, Inc. Selective diversion and injection of communication traffic
AU2002303501A1 (en) * 2001-04-27 2002-11-11 Wanwall, Inc. Weighted fair queuing-based methods and apparatus for protecting against overload conditions on nodes of a distributed network
US6907525B2 (en) * 2001-08-14 2005-06-14 Riverhead Networks Inc. Protecting against spoofed DNS messages
US20040123142A1 (en) * 2002-12-18 2004-06-24 Dubal Scott P. Detecting a network attack
CN102098305A (zh) * 2004-01-26 2011-06-15 思科技术公司 较高级协议认证
CN1838607A (zh) * 2005-03-23 2006-09-27 中国人民解放军理工大学 一种阻止网络拒绝服务攻击的高速检测和控制机制
CN100384149C (zh) * 2005-11-11 2008-04-23 上海交通大学 突发性异常网络流量的检测与监控方法

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6513122B1 (en) * 2001-06-29 2003-01-28 Networks Associates Technology, Inc. Secure gateway for analyzing textual content to identify a harmful impact on computer systems with known vulnerabilities
CN1602470A (zh) * 2001-12-10 2005-03-30 思科技术公司 防御恶意流量
CN1674558A (zh) * 2004-03-25 2005-09-28 株式会社日立制作所 信息中继装置和数据流统计信息收集方法
CN1658576A (zh) * 2005-03-09 2005-08-24 中山大学 一种大型网站数据流的检测与防御方法
CN1649311A (zh) * 2005-03-23 2005-08-03 北京首信科技有限公司 基于机器学习的用户行为异常检测系统和方法
CN1750481A (zh) * 2005-09-29 2006-03-22 西安交大捷普网络科技有限公司 基于时间段加权统计模型的网络异常检测方法
CN1822593A (zh) * 2006-03-20 2006-08-23 赵洪宇 一种抵御拒绝服务攻击事件的网络安全保护方法
CN101039326A (zh) * 2007-04-28 2007-09-19 华为技术有限公司 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统
CN101136922A (zh) * 2007-04-28 2008-03-05 华为技术有限公司 业务流识别方法、装置及分布式拒绝服务攻击防御方法、系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2136526A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106204847A (zh) * 2016-07-18 2016-12-07 北京千丁互联科技有限公司 门禁管理系统、后台服务器及其自学习方法
CN106204847B (zh) * 2016-07-18 2018-10-19 北京千丁互联科技有限公司 门禁管理系统、后台服务器及其自学习方法

Also Published As

Publication number Publication date
EP2136526A4 (en) 2010-04-14
US20100095351A1 (en) 2010-04-15
CN101136922A (zh) 2008-03-05
EP2136526A1 (en) 2009-12-23
CN101136922B (zh) 2011-04-13

Similar Documents

Publication Publication Date Title
WO2008131667A1 (fr) Procédé, dispositif d'identification des flux de services et procédé, système de protection contre une attaque par déni de service
US7716729B2 (en) Method for responding to denial of service attacks at the session layer or above
US10157280B2 (en) System and method for identifying security breach attempts of a website
KR101217647B1 (ko) 특정 소스/목적지 ｉｐ 어드레스 쌍들에 기초한 ｉｐ 네트워크들에서 서비스 거부 공격들에 대한 방어 방법 및 장치
US20140325648A1 (en) Attack Defense Method and Device
WO2019178966A1 (zh) 抵抗网络攻击方法、装置、计算机设备及存储介质
WO2011000304A1 (zh) 一种异常连接的检测方法、装置及网关设备
CN108270722B (zh) 一种攻击行为检测方法和装置
WO2008141584A1 (en) Message processing method, system, and equipment
US10484380B2 (en) Untrusted network device identification and removal for access control and information security
US10375076B2 (en) Network device location information validation for access control and information security
WO2009140889A1 (zh) 一种数据传输控制方法以及数据传输控制装置
US11165817B2 (en) Mitigation of network denial of service attacks using IP location services
US11451582B2 (en) Detecting malicious packets in edge network devices
WO2011012056A1 (zh) 一种僵尸网络检测方法及系统以及相关设备
WO2008131658A1 (fr) Procédé et dispositif pour fureter le dhcp
KR20080026122A (ko) 타겟 희생자 자체-식별 및 제어에 의해 ｉｐ네트워크들에서 서비스 거부 공격들에 대한 방어 방법
US10375099B2 (en) Network device spoofing detection for information security
US10992643B2 (en) Port authentication control for access control and information security
US10462141B2 (en) Network device information validation for access control and information security
US10567379B2 (en) Network switch port access control and information security
US10462147B2 (en) Network device isolation for access control and information security
WO2019096104A1 (zh) 攻击防范
US11178177B1 (en) System and method for preventing session level attacks
Salim et al. Preventing ARP spoofing attacks through gratuitous decision packet

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08715357

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2008715357

Country of ref document: EP