WO2011010823A3 - 클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버 - Google Patents

클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버 Download PDF

Info

Publication number
WO2011010823A3
WO2011010823A3 PCT/KR2010/004519 KR2010004519W WO2011010823A3 WO 2011010823 A3 WO2011010823 A3 WO 2011010823A3 KR 2010004519 W KR2010004519 W KR 2010004519W WO 2011010823 A3 WO2011010823 A3 WO 2011010823A3
Authority
WO
WIPO (PCT)
Prior art keywords
file
server
ddos attack
preventing
detecting
Prior art date
Application number
PCT/KR2010/004519
Other languages
English (en)
French (fr)
Other versions
WO2011010823A2 (ko
Inventor
김정훈
김성현
Original Assignee
주식회사 안철수연구소
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 주식회사 안철수연구소 filed Critical 주식회사 안철수연구소
Priority to US13/386,516 priority Critical patent/US9386036B2/en
Publication of WO2011010823A2 publication Critical patent/WO2011010823A2/ko
Publication of WO2011010823A3 publication Critical patent/WO2011010823A3/ko

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Debugging And Monitoring (AREA)

Abstract

본 발명은, 서버에 연결된 복수의 클라이언트를 포함하는 클라우드 컴퓨팅 환경에서 DDoS 공격을 탐지하고 차단하는 방법으로서, 클라이언트에 설치되어 클라이언트에서 실행 중인 파일 및 프로그램을 모니터링하는 에이전트를 이용하여 파일에서 추출된 파일DNA와 파일이 유발하는 네트워크 트래픽에 관한 트래픽정보를 서버가 클라이언트로부터 수집하는 정보수집단계와, 파일의 파일DNA 및 트래픽정보에 기반하여 서버가 DDoS 공격의 위험도를 분석하는 분석단계와, 분석된 위험도에 따라 클라이언트에 파일의 차단 여부에 관한 명령을 전송하는 명령단계를 포함하는 DDoS 공격 탐지 및 차단 방법을 제공한다.
PCT/KR2010/004519 2009-07-23 2010-07-12 클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버 WO2011010823A2 (ko)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US13/386,516 US9386036B2 (en) 2009-07-23 2010-07-12 Method for detecting and preventing a DDoS attack using cloud computing, and server

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR10-2009-0067353 2009-07-23
KR1020090067353A KR100942456B1 (ko) 2009-07-23 2009-07-23 클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버

Publications (2)

Publication Number Publication Date
WO2011010823A2 WO2011010823A2 (ko) 2011-01-27
WO2011010823A3 true WO2011010823A3 (ko) 2011-03-31

Family

ID=42083428

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2010/004519 WO2011010823A2 (ko) 2009-07-23 2010-07-12 클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버

Country Status (3)

Country Link
US (1) US9386036B2 (ko)
KR (1) KR100942456B1 (ko)
WO (1) WO2011010823A2 (ko)

Families Citing this family (50)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101267725B1 (ko) 2010-08-30 2013-05-24 주식회사 엔씨소프트 온라인 게임의 봇 프로그램 패턴 수집방법
US9088601B2 (en) 2010-12-01 2015-07-21 Cisco Technology, Inc. Method and apparatus for detecting malicious software through contextual convictions, generic signatures and machine learning techniques
US9218461B2 (en) * 2010-12-01 2015-12-22 Cisco Technology, Inc. Method and apparatus for detecting malicious software through contextual convictions
KR20120072120A (ko) * 2010-12-23 2012-07-03 한국전자통신연구원 악성 파일 진단 장치 및 방법, 악성 파일 감시 장치 및 방법
KR101156011B1 (ko) 2010-12-24 2012-06-18 고려대학교 산학협력단 네트워크 트래픽 분석을 통한 봇넷 위험도 산정 시스템 및 그 방법
KR101059199B1 (ko) * 2011-01-13 2011-08-25 주식회사 이글루시큐리티 클라우드 컴퓨팅 통합보안관제시스템 및 그 방법
US9037564B2 (en) 2011-04-29 2015-05-19 Stephen Lesavich Method and system for electronic content storage and retrieval with galois fields on cloud computing networks
US9569771B2 (en) 2011-04-29 2017-02-14 Stephen Lesavich Method and system for storage and retrieval of blockchain blocks using galois fields
US9361479B2 (en) 2011-04-29 2016-06-07 Stephen Lesavich Method and system for electronic content storage and retrieval using Galois fields and geometric shapes on cloud computing networks
US9137250B2 (en) 2011-04-29 2015-09-15 Stephen Lesavich Method and system for electronic content storage and retrieval using galois fields and information entropy on cloud computing networks
US20120297483A1 (en) * 2011-05-16 2012-11-22 General Electric Company Systems, methods, and apparatus for network intrusion detection based on monitoring network traffic
US20130031042A1 (en) * 2011-07-27 2013-01-31 Sintayehu Dehnie Distributed assured network system (DANS)
US9294489B2 (en) 2011-09-26 2016-03-22 Intellectual Discovery Co., Ltd. Method and apparatus for detecting an intrusion on a cloud computing service
US20130198805A1 (en) * 2012-01-24 2013-08-01 Matthew Strebe Methods and apparatus for managing network traffic
US8914406B1 (en) * 2012-02-01 2014-12-16 Vorstack, Inc. Scalable network security with fast response protocol
US9201911B2 (en) 2012-03-29 2015-12-01 International Business Machines Corporation Managing test data in large scale performance environment
US9444880B2 (en) 2012-04-11 2016-09-13 Illumina, Inc. Cloud computing environment for biological data
US8856924B2 (en) 2012-08-07 2014-10-07 Cloudflare, Inc. Mitigating a denial-of-service attack in a cloud-based proxy service
CN102801739A (zh) * 2012-08-25 2012-11-28 乐山师范学院 基于云计算环境的网络风险测定取证方法
KR20140064057A (ko) * 2012-11-19 2014-05-28 한국인터넷진흥원 웹사이트 악성여부 고속 판별방법
EP3474589A1 (en) * 2012-11-22 2019-04-24 Koninklijke KPN N.V. System to detect behaviour in a telecommunications network
US9875500B2 (en) 2013-09-20 2018-01-23 Target Brands, Inc. Network traffic-based throttling of electronic commerce activity
KR101940512B1 (ko) * 2014-02-03 2019-01-21 한국전자통신연구원 공격특성 dna 분석 장치 및 그 방법
US9900344B2 (en) 2014-09-12 2018-02-20 Level 3 Communications, Llc Identifying a potential DDOS attack using statistical analysis
WO2016073457A2 (en) * 2014-11-03 2016-05-12 Level 3 Communications, Llc Identifying a potential ddos attack using statistical analysis
US9853988B2 (en) 2014-11-18 2017-12-26 Vectra Networks, Inc. Method and system for detecting threats using metadata vectors
US9661011B1 (en) 2014-12-17 2017-05-23 Amazon Technologies, Inc. Techniques for data routing and management using risk classification and data sampling
US9591022B2 (en) * 2014-12-17 2017-03-07 The Boeing Company Computer defenses and counterattacks
US9253206B1 (en) * 2014-12-18 2016-02-02 Docusign, Inc. Systems and methods for protecting an online service attack against a network-based attack
US10560466B2 (en) * 2015-01-13 2020-02-11 Level 3 Communications, Llc Vertical threat analytics for DDoS attacks
KR101657180B1 (ko) * 2015-05-04 2016-09-19 최승환 프로세스 접근 제어 시스템 및 방법
US10938781B2 (en) 2016-04-22 2021-03-02 Sophos Limited Secure labeling of network flows
US11102238B2 (en) * 2016-04-22 2021-08-24 Sophos Limited Detecting triggering events for distributed denial of service attacks
US11165797B2 (en) 2016-04-22 2021-11-02 Sophos Limited Detecting endpoint compromise based on network usage history
US11277416B2 (en) 2016-04-22 2022-03-15 Sophos Limited Labeling network flows according to source applications
US10986109B2 (en) 2016-04-22 2021-04-20 Sophos Limited Local proxy detection
WO2017184189A1 (en) * 2016-04-22 2017-10-26 Sophos Limited Detecting triggering events for distributed denial of service attacks
CN107623663B (zh) 2016-07-15 2020-12-15 阿里巴巴集团控股有限公司 处理网络流量的方法及装置
US10462166B2 (en) * 2016-10-11 2019-10-29 Arbor Networks, Inc. System and method for managing tiered blacklists for mitigating network attacks
KR101971013B1 (ko) * 2016-12-13 2019-04-22 나무기술 주식회사 빅데이터 기반의 클라우드 인프라 실시간 분석 시스템 및 그 제공방법
US10616271B2 (en) 2017-01-03 2020-04-07 Microsemi Frequency And Time Corporation System and method for mitigating distributed denial of service attacks
US10951648B2 (en) 2017-03-06 2021-03-16 Radware, Ltd. Techniques for protecting against excessive utilization of cloud services
US10887341B2 (en) 2017-03-06 2021-01-05 Radware, Ltd. Detection and mitigation of slow application layer DDoS attacks
CN108270795A (zh) * 2018-02-23 2018-07-10 上海市信息网络有限公司 数据安全防泄露自救系统、方法、可读存储介质及设备
US11050785B2 (en) * 2018-08-25 2021-06-29 Mcafee, Llc Cooperative mitigation of distributed denial of service attacks originating in local networks
CN110061971A (zh) * 2019-03-20 2019-07-26 合肥名德光电科技股份有限公司 一种云计算防御检测方法
US11539741B2 (en) 2019-09-05 2022-12-27 Bank Of America Corporation Systems and methods for preventing, through machine learning and access filtering, distributed denial of service (“DDoS”) attacks originating from IoT devices
CN113645238B (zh) * 2021-08-11 2023-04-25 码客工场工业科技(北京)有限公司 一种面向Handle标识体系的DDoS防御方法
CN115242436B (zh) * 2022-06-14 2023-12-01 徐州恒佳电子科技有限公司 一种基于命令行特征的恶意流量检测方法及系统
CN115190107B (zh) * 2022-07-07 2023-04-18 四川川大智胜系统集成有限公司 基于泛域名多子系统管理方法、管理终端及可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1998041919A1 (en) * 1997-03-18 1998-09-24 Trend Micro, Incorporated Virus detection in client-server system
KR20040080534A (ko) * 2003-03-12 2004-09-20 한국전자통신연구원 클라이언트-서버 모델을 활용한 정보전 시뮬레이션 장치및 방법
KR20060049821A (ko) * 2004-07-09 2006-05-19 인터내셔널 비지네스 머신즈 코포레이션 네트워크 내에서의 분산 서비스 거부(ＤＤｏＳ) 공격의식별 및 이러한 공격에 대한 방어 방법

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100684986B1 (ko) * 1999-12-31 2007-02-22 주식회사 잉카인터넷 온라인상에서의 실시간 유해 정보 차단 시스템 및 방법
US7124440B2 (en) * 2000-09-07 2006-10-17 Mazu Networks, Inc. Monitoring network traffic denial of service attacks
DE60230601D1 (ko) * 2001-01-10 2009-02-12 Cisco Tech Inc
US20060095961A1 (en) * 2004-10-29 2006-05-04 Priya Govindarajan Auto-triage of potentially vulnerable network machines
US7617533B1 (en) * 2005-01-31 2009-11-10 Symantec Corporation Self-quarantining network
US8775521B2 (en) * 2006-06-30 2014-07-08 At&T Intellectual Property Ii, L.P. Method and apparatus for detecting zombie-generated spam
US7681132B2 (en) * 2006-07-13 2010-03-16 International Business Machines Corporation System, method and program product for visually presenting data describing network intrusions
KR100803029B1 (ko) 2006-12-01 2008-02-18 경희대학교 산학협력단 협력적인 통계기반 탐지기법을 이용한 분산서비스거부공격의 방어 방법
KR20090012561A (ko) 2007-07-30 2009-02-04 영남대학교 산학협력단 플로우별 통계 분석을 통한 송신단에서 양방향 디디오에스방어 시스템 및 방법
US20090182614A1 (en) * 2008-01-11 2009-07-16 Yahoo! Inc. System And Method For Serving Advertisements According To Network Traffic
AU2009279430B2 (en) * 2008-08-08 2014-04-10 Absolute Software Corporation Secure computing environment to address theft and unauthorized access
US8504504B2 (en) * 2008-09-26 2013-08-06 Oracle America, Inc. System and method for distributed denial of service identification and prevention
US8914878B2 (en) * 2009-04-29 2014-12-16 Juniper Networks, Inc. Detecting malicious network software agents

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1998041919A1 (en) * 1997-03-18 1998-09-24 Trend Micro, Incorporated Virus detection in client-server system
KR20040080534A (ko) * 2003-03-12 2004-09-20 한국전자통신연구원 클라이언트-서버 모델을 활용한 정보전 시뮬레이션 장치및 방법
KR20060049821A (ko) * 2004-07-09 2006-05-19 인터내셔널 비지네스 머신즈 코포레이션 네트워크 내에서의 분산 서비스 거부(ＤＤｏＳ) 공격의식별 및 이러한 공격에 대한 방어 방법

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
KIM, KOOK-HAN ET AL: "Analysis of trends in Dol attacks and response program work", JOURNAL OF THE INFORMATION SECURITY & CRYPTOLOGY, vol. 16, no. 1, February 2006 (2006-02-01) *
SEO, DONG WON ET AL: "A Study on Detecting Malcodes Distribution Sites", JOURNAL OF THE 30TH ANNUAL CONFERENCE OF INFORMATION PROCESSING SOCIETY, vol. 15, no. 2, - November 2008 (2008-11-01) *
WEI-ZHOU LU ET AL: "One-way queuing delay measurement and its application on detecting DDoS attack", JOURNAL OF NETWORK AND COMPUTER APPLICATIONS, vol. 32, 13 June 2008 (2008-06-13), pages 367 - 376, XP025913871, Retrieved from the Internet <URL:www.elsevier.com/locate/jnca> DOI: doi:10.1016/j.jnca.2008.02.018 *

Also Published As

Publication number Publication date
WO2011010823A2 (ko) 2011-01-27
US9386036B2 (en) 2016-07-05
US20120124666A1 (en) 2012-05-17
KR100942456B1 (ko) 2010-02-12

Similar Documents

Publication Publication Date Title
WO2011010823A3 (ko) 클라우드 컴퓨팅을 이용한 ＤＤｏＳ 공격 탐지 및 차단 방법 및 서버
EP4335703A3 (en) Systems and methods for detection of malicious activity in vehicle data communication networks
WO2011031777A3 (en) System and method for probabilistic attack planning
WO2010048430A3 (en) System and method for identifying trends in web feeds collected from various content servers
JP2017538376A5 (ko)
WO2013170064A3 (en) Methods and apparatus for identifying and removing malicious applications
US20120167161A1 (en) Apparatus and method for controlling security condition of global network
WO2012141444A3 (ko) 소셜 네트워크 분석 서비스 방법 및 장치
WO2012154664A3 (en) Methods, systems, and computer readable media for detecting injected machine code
WO2010011897A3 (en) Global network monitoring
WO2012071384A3 (en) Optimization of resource polling intervals to satisfy mobile device requests
JP2014504399A5 (ko)
WO2012058486A3 (en) Automated policy builder
WO2013040386A3 (en) Predicting user navigation events
WO2012151485A3 (en) Predicting user navigation events
WO2012004418A3 (en) Systems and methods for power consumption profiling and auditing
WO2012172509A3 (en) Device and method for application request throttling in a distributed computing environment
CA2679967A1 (en) System and method for providing application penetration testing
WO2013172898A3 (en) System for detecting, analyzing, and controlling infiltration of computer and network systems
GB2509036A (en) Providing a network-accessible malware analysis
WO2009041686A1 (ja) ネットワーク監視装置、ネットワーク監視方法およびネットワーク監視プログラム
WO2008091785A3 (en) System and method for determining data entropy to identify malware
WO2012135192A3 (en) System and method for virtual machine monitor based anti-malware security
WO2013102932A3 (en) System and method facilitating forecasting, optimization and visualization of energy data for industry
WO2007144504A3 (fr) Procédé et système de traitement de données de sécurité d&#39;un réseau informatique

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10802416

Country of ref document: EP

Kind code of ref document: A2

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 13386516

Country of ref document: US

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 30.03.12)

122 Ep: pct application non-entry in european phase

Ref document number: 10802416

Country of ref document: EP

Kind code of ref document: A2