WO2009018737A1

WO2009018737A1 - Method and network device for preventing dos attacks

Info

Publication number: WO2009018737A1
Application number: PCT/CN2008/071461
Authority: WO
Inventors: Zhiwang Zhao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-08-09
Filing date: 2008-06-27
Publication date: 2009-02-12
Also published as: CN101102323A; CN101102323B

Abstract

A method for preventing DOS attacks is disclosed. The method comprises: making discard packet counting to the data packets according to the first level CAR resource; when determining that the discard packet number of the data packets exceeding the first threshold, extracting the input interface information of the data packets; making flow controlling to the data packets through the input interface according to the input interface information. A network device is disclosed at the same time. The source of attacks can be determined. It can guarantee the furthest that the majority of services can run normally when the network device is being attacked. The cost of managing is decreased and the network resource is saved.

Description

Method and network device for preventing DOS attack

The present invention relates to the field of network technologies, and in particular, to a method and network device for preventing DOS attacks. Background technique

With the development of the Internet, the networking environment is becoming more and more complex, and the subsequent network attacks are becoming more and more frequent, especially DOS (Denial Of Service) attacks (including DDOS attacks (Distributed Deny Of Service). Service attacks)) are the most common and have the greatest hazard to network devices. In a DOS attack, an attacker uses a large number of data packets or malformed packets in a short period of time to continuously initiate a connection or request response to a network device. As a result, the network device cannot handle legitimate tasks due to excessive load, and abnormal services or even device failure occur. .

The prior art provides the following two solutions for preventing DOS attacks:

Prior art one

The DOS attack defense is implemented by the traffic limiting technology, which limits the data traffic sent to the device in a unit time to protect the device.

After analyzing, the inventor found that although the prior art can effectively alleviate the impact of DOS attacks on network devices, it still has the following disadvantages because it relies solely on the traditional manual setting of traffic limiting functions to protect network devices:

1. Once the limited traffic value is set, the network device will continue to discard normal service packets after the abnormal traffic is discarded. As a result, normal services are affected. Under normal circumstances, an attack of a certain type of protocol may cause an abnormality of device-level services, so that an illegal user can achieve the purpose of DOS attack, and simply rely on manually limiting the traffic value to suppress the attack range, and cannot effectively narrow down the attack on the network device. The impact of the business.

2. When an attack occurs, the network device is protected only by packet loss, and attack source tracing cannot be performed. Prior art 2 By deploying NETSTREAM (network traffic sampling) related equipment for device traffic sampling, and analyzing the sample data to achieve DOS traceability, to achieve the purpose of preventing DOS attacks.

In the process of implementing the embodiments of the present invention, the inventors have analyzed and found that the prior art 2 has the following deficiencies:

1, need to deploy equipment such as NETSTREM server, the cost is higher.

2. After the NETSTREAM is turned on, the network device will have a greater impact on device performance. In addition, the physical port of the device needs to be connected to the server, which wastes network resources.

3. Since servers and network devices are different devices, it is much more difficult to manage and maintain than single devices. Summary of the invention

The embodiments of the present invention provide a method and a device for preventing DOS attacks, which are used for attack source tracing to ensure the normal operation of most services of a network device in the event of an attack.

An embodiment of the present invention provides a method for preventing a DOS attack, where the method includes:

Packet loss counting of data packets according to the primary CAR resource;

And determining, when the number of packet loss of the data packet exceeds a first threshold, extracting the inbound interface information of the data packet;

And performing flow control on the data packet passing the inbound interface according to the inbound interface information. The embodiment of the invention further provides a network device, including:

a counting module, configured to perform packet loss counting on the data packet according to the primary CAR resource;

And an extracting module, configured to: when determining that the number of lost packets of the data packet exceeds a first threshold, extracting inbound interface information of the data packet;

The control module is configured to perform flow control on the data packet passing the inbound interface according to the inbound interface information.

In the embodiment of the present invention, the packet loss count is performed on the data packet according to the primary CAR resource. When the number of the data packet loss exceeds the first threshold, the data packet is determined to be a DOS attack. Data packet; and then extracting the source interface information of the data packet to perform attack source tracing,

The DOS attack provides a basis for the flow control of the data packets passing through the inbound interface, and does not need to perform flow control on all data packets processed by the network device, thereby locking the flow control target. The scope of the flow control is narrowed to ensure the normal operation of most services of the network device in the event of an attack. In addition, by using the method of the embodiment of the present invention, the network device itself can implement the function of preventing DOS attacks without deploying special The server interacts with the server to prevent DOS attacks, reducing operating costs, simplifying maintenance, and further saving network resources. DRAWINGS

1 is a flowchart of a process for preventing a DOS attack in an embodiment of the present invention;

FIG. 2 is a flowchart of a specific example of preventing a DOS attack in the embodiment of the present invention; FIG. 3A, FIG. 3B, FIG. 3C, FIG. 3D, and FIG. 3E are schematic diagrams showing the structure of a network device according to an embodiment of the present invention. detailed description

The method of the embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

As shown in FIG. 1 , in the embodiment of the present invention, a process for preventing a DOS attack is as follows: Step 11. Perform a packet loss count on a data packet according to a Level 1 CAR (Committed Access Rate) resource.

Step 12: When the number of data packet loss exceeds the first threshold, the inbound interface information of the data packet is extracted.

Step 13. Perform flow control on the data packet passing the inbound interface according to the extracted inbound interface information.

In step 11, the first threshold may be set according to the delivered primary CAR resource. In step 12, extracting the inbound interface information of the data packet may include: generating a data packet and generating the data packet The sample data is used to analyze the sample data; according to the analysis of the sample data, the inbound interface information of the data message is extracted.

In one embodiment, after the data message is sampled, the sample data can be stored locally after the sample data is generated. It can be stored in a specified format, such as storing the data in the Ethereal format locally. Ethereal is a common packet capture software. It is also possible to store the sample data in a local RAM (Random Access Memory), NVRAM (Non Volatile Random Access Memory), CF (Compact Flash Card) memory card, FLASH. (Flash) One or any combination.

In step 13, the flow control of the data packet passing the inbound interface may be performed according to the extracted inbound interface information, and the second level CAR is started according to the extracted inbound interface information, that is, the CAR is refined for the data packet. A CAR based on the inbound interface information and the data packet information is implemented, and the secondary CAR resource is further delivered. The traffic of the data packet passing the inbound interface is controlled according to the delivered secondary CAR resource. In an embodiment, the second threshold may be set according to the original primary CAR and the secondary CAR that is subsequently started. When the traffic of the data packet passing the inbound interface does not exceed the second threshold, the second packet may be collected. Level CAR resources, in order to reuse secondary CAR resources when they are attacked again.

As shown in FIG. 2, in a specific example, the process for preventing a DOS attack is as follows: Step 21: The device arranges a traditional CAR solution, that is, performs CAR resource allocation according to a service classification or a policy or whether the service has at least one common feature. Level CAR resources).

Step 22: The device starts the monitoring system, and performs real-time monitoring of the first-level CAR discarding count. The monitoring system finds that a large number of packet loss occurs in a certain type of protocol packet, and exceeds the set first threshold, indicating that such a service has occurred in DOS. attack.

Step 23: When the monitoring system detects that the attack occurs, the triggering device starts the learning mechanism, and performs the learning of the feature information of the packet according to the set sampling time within a preset time. The learning information may include: Incoming interface information (such as VLAN (Virtual Local Area Network), PORT (port), etc.), message content information, and so on. Step 24: After the learning time reaches the set value, the learning is stopped, and the storage is performed according to the specified format. The specified format includes the Ethereal format, etc., and the storage area includes the device's RAM/NVRAM/CF card/FLASH. In one embodiment, the device may provide an interactive means for querying the data, and the device may provide an interactive means to manually trigger the learning.

Step 25: The device performs data feature analysis according to the learning content, and starts the secondary CAR according to the inbound interface information of the packet, that is, CAR is refined for the protocol packet, and the CAR based on the sub-interface and the protocol information is implemented. Ensure that the DOS attack only affects the inbound interface range where the attack is located. The other interface services of the device can resume normal operation.

Step 26: The device continues to monitor the DOS attack. If the DOS attack does not exist, that is, the number of lost packets does not exceed the second threshold, the secondary CAR resource delivered by the smart device is recovered. The system continues to run according to the original primary CAR solution. . The secondary CAR resource can be reused again when the device is attacked again.

One of ordinary skill in the art will appreciate that all or part of the steps in implementing the above-described embodiments can be accomplished by program-related hardware. The software corresponding to the embodiment can be stored in a computer readable storage medium such as ROM/RAM, disk, optical disk, and the like.

Based on the same inventive concept, an embodiment of the present invention further provides a network device, which is configured as shown in FIG. 3A, and includes: a counting module 31, an extracting module 32, and a control module 33; wherein, the counting module 31 is configured according to a first-level CAR. The resource module performs a packet loss count on the data packet. The extracting module 32 is configured to extract the inbound interface information of the data packet when the number of the data packet loss exceeds the first threshold, and the control module 33 is configured to Interface information, which controls traffic on data packets passing the inbound interface.

As shown in FIG. 3B, in an embodiment, the extraction module 32 shown in FIG. 3A may further include: a sampling unit 321, an analyzing unit 322, and an extracting unit 323; wherein, the sampling unit 321 is configured to perform data packet processing. After the sample is generated, the sample data is generated; the analyzing unit 322 is configured to analyze the sample data; and the extracting unit 323 is configured to extract the inbound interface information of the data message according to the analysis of the sample data.

As shown in FIG. 3C, in an embodiment, the extraction module 32 shown in FIG. 3B may further include: The storage unit 324 is configured to store the sample data locally.

The storage unit 324 can be further used to store the sample data locally in the Ethereal format. The storage unit 324 can be further configured to store the sample data to one of local RAM, NVRAM, CF card, FLASH, or any combination.

As shown in FIG. 3D, in an embodiment, the control module 33 shown in FIG. 3A may further include: a sending unit 331 and a control unit 332. The sending unit 331 is configured to deliver a secondary CAR according to the inbound interface information. The control unit 332 is configured to perform flow control on the data packet passing the inbound interface according to the secondary CAR resource.

As shown in FIG. 3E, in an embodiment, the network device shown in FIG. 3D may further include: a recovery module 34, configured to: when the traffic of the data packet passing the inbound interface does not exceed a second threshold, Secondary CAR resources.

A person skilled in the art can understand that all or part of the steps in the foregoing method can be completed by a program, and the program can be stored in a computer readable storage medium. The storage medium can include: ROM, RAM, Disk or disc, etc.

In the embodiment of the present invention, the packet loss count is performed on the data packet according to the first-level CAR resource. When the number of packet loss of the data packet exceeds the first threshold, the data packet is determined to be a DOS attack data packet; Attack source tracing is performed by extracting the inbound interface information of the data packet to provide a basis for preventing DOS attacks. Only the inbound interface information is used to perform flow control on the data packets passing the inbound interface without all data processed by the network device. The traffic control is performed on the packet, so that the flow control target is locked, the flow control range is narrowed, and the majority of the services of the network device in the event of an attack are ensured to the maximum extent. In addition, the network device itself can be used by the method of the embodiment of the present invention. It implements the function of preventing DOS attacks without deploying a dedicated server and interacting with the server to prevent DOS attacks, reducing operating costs, simplifying maintenance and management, and further saving network resources.

In the embodiment of the present invention, data can be sampled and stored locally for attack by the network device for attack source tracing; the classification and analysis of the trace source data can be used to generate dynamic and intelligent according to the data source range. Small-scale CAR function, intelligent suppression of attacks, The DOS attack is effectively prevented. When the attack is removed, the network device can reclaim the CAR resources that are sent by the smart device for use in the next attack.

The embodiment of the present invention provides only the case of the second-level CAR. If necessary, three or more levels of CAR can be set to implement the refinement control, and the technical effects of the embodiments of the present invention can also be achieved.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and the modifications of the invention

Claims

Claim

A method for preventing a DOS attack, characterized in that the method comprises:

According to the access rate of the first-level commitment, the CAR resource counts the packet loss of the data packet.

And determining, when the number of packet loss of the data packet exceeds a first threshold, extracting the ingress interface information of the data packet;

And performing flow control on the data packet passing the inbound interface according to the inbound interface information.

2. The method for preventing DOS attacks according to claim 1, wherein extracting the inbound interface information of the data packet comprises: sampling the data packet to generate sample data; Performing an analysis; extracting the inbound interface information of the data packet according to the analysis of the sample data.

The method for preventing a DOS attack according to claim 2, wherein after the step of generating the sample data and the step of generating the sample data, the method further comprises: storing the sample data locally.

4. A method of preventing DOS attacks according to claim 3, wherein the sample data is stored locally in the Ethereal format.

The method for preventing DOS attacks according to claim 3, wherein the data is stored in one of local RAM, NVRAM, CF card, FLASH or any combination.

The method for preventing DOS attacks according to any one of claims 1 to 5, wherein, according to the inbound interface information, performing flow control on data packets passing the inbound interface includes:

Delivering a secondary CAR resource according to the inbound interface information;

Performing flow control on the data packet passing the inbound interface according to the secondary CAR resource.

7. The method of preventing a DOS attack according to claim 6, wherein the method further comprises:

The secondary CAR resource is recovered when the traffic of the data packet passing the inbound interface does not exceed the second threshold.

8. A network device, comprising:

a counting module (31), configured to perform packet loss counting on the data packet according to the primary CAR resource; and an extracting module (32), configured to: when determining that the number of lost packets of the data packet exceeds a first threshold, Taking the inbound interface information of the data packet;

The control module (33) is configured to perform flow control on the data packet passing the inbound interface according to the inbound interface information.

The network device according to claim 8, wherein the extracting module (32) further comprises:

a sample unit (321), configured to sample the data message to generate sample data; and an analysis unit (322) configured to analyze the sample data;

The extracting unit (323) is configured to extract the inbound interface information of the data packet according to the analysis of the sample data.

The network device according to claim 9, wherein the extracting module further comprises:

The storage unit (324) is configured to store the sample data locally.

The network device according to claim 10, wherein the storage unit (324) is further configured to store the sample data locally in the Ethereal format.

The network device according to claim 10, wherein the storage unit (324) is further configured to store the sample data to one of the local RAM, the NVRAM, the CF card, the FLASH, or any combination thereof.

The network device according to any one of claims 8 to 12, wherein the control module (33) further comprises:

a sending unit (331), configured to send a secondary CAR resource according to the inbound interface information, where the control unit (332) is configured to perform flow control on the data packet passing the inbound interface according to the secondary CAR resource .

The network device according to claim 13, wherein the device further comprises: a recycling module (34), configured to: when determining that the traffic of the data packet passing the inbound interface does not exceed a second threshold, Recover the secondary CAR resources.