WO2011075922A1

WO2011075922A1 - Method for detecting distributed denial of service attack

Info

Publication number: WO2011075922A1
Application number: PCT/CN2010/000050
Authority: WO
Inventors: 安丙春
Original assignee: 北京锐安科技有限公司
Priority date: 2009-12-22
Filing date: 2010-01-12
Publication date: 2011-06-30
Also published as: CN101741847A; CN101741847B

Abstract

A method for detecting Distributed Denial of Service (DDOS) attack is provided, which is in the field of computer network safety. The method includes: 1) a data packet intercept module resolves the accessed network data packet information; 2) a data packet feature statistics module makes statistics to the resolved network data packet information; 3) a statistics data processing module computes the proportion of each kind of data packets to the total data packets within a unit time interval; 4) a data analysis module computes alarm thresholds of network data according to the stored history data computed in the steps 2) and 3); 5) the data analysis module determines whether the network data value within the current unit time interval exceeds the alarm threshold of corresponding network data, if it does, the data analysis module submits the network data value to an attack analysis module; 6) the attack analysis module generates a detection report based on the received network data value. Compared with the prior art, the present invention integrates the history data of the network transportation, analyses the current network data deeply, and can recognize kinds of DDOS attack.

Description

DDOS attack detection method

Technical field

The invention belongs to the field of computer network security, and particularly relates to a DD0S attack detection method. Background technique

Denial of service attacks, English Denial of Service (DOS), as an attack on the Internet, has a long history, mainly using the shortcomings of the TCP/IP protocol, exhausting the resources of the network providing the service, resulting in Failure to provide normal services is a malicious attack that is very harmful to the network. Some denial of service attacks consume bandwidth, some consume CPU and memory of network devices, and some cause system crashes. Representative attacks include SYN. Flood, ICMP flood UDP flood, etc.

Initially, the attack is usually based on a single computer attacking the target, that is, the DOS attack we often say. With the development of technology, the current attack technology has developed into the DD0S mode via the DOS mode, that is, multiple units controlled by the unified. A computer, using distributed technology, simultaneously initiates a denial of service attack to an attack target, known as a distributed denial of service attack.

So far, there is no good technology to thoroughly detect and defend against denial of service attacks. Summary of the invention

In view of the current threat of distributed denial of service attacks on the Internet, the present invention aims to provide a DD0S attack detection method, which can detect DD0S attacks in real time. The invention integrates multiple network features of the DD0S attack, and comprehensively analyzes and detects the DD0S attack.

The technical solution of the present invention is:

A DD0S attack detection method, the steps of which are:

1) the packet intercepting module parses the accessed network packet information; the network packet information includes: a packet type, an IP address, and a port;

2) The packet feature statistics module collects statistics on the parsed network packet information, and obtains the total number of packets intercepted per unit time, the number of packets of different types in the network layer, the number of packets of different types in the transport layer, and the application layer are different. The number of packets of the type, the total number of IP addresses of the packets, and the total number of ports;

3) The statistical data processing module calculates the proportion distribution of each type of data packet per unit time in the total number of data packets; 4) The data analysis module calculates the alarm threshold of the network data according to the stored historical data calculated in step 2) and step 3);

5) The data analysis module determines whether the network data value in the current unit time exceeds an alarm threshold of the corresponding network data, and if yes, submits the network data value to the attack analysis module;

6) The attack analysis module generates a test report based on the received network data values.

Further, the network packet information further includes a data packet length of each type of data packet; and the data packet feature statistics module performs statistics on the parsed data packet length of each type of data packet.

Further, the statistical data processing module calculates an average length of each type of data packet per unit time. Further, the data analysis module updates the alarm threshold of each type of data packet in real time; the calculation method of the alarm threshold is: first calculating a ratio of the total data packet of the type of data packet in a time period before and after a certain time of a certain type of data packet The average value of F1; then calculate the average of the proportion of the type of k F 4- k F -4- k F packets in the total packet at the same time in the first few days, the first few weeks and the previous months of the moment. Fn; Finally, calculate n according to the formula F ₌ £il £2 - ± I£L _X Q

The alarm threshold F of this type of data packet _; where n is the number of time segments, kn is the weight corresponding to Fn, Q is a multiple factor, and Q>1.

Further, the data packet type of the network layer includes: an IP data packet, an ICMP data packet, and an ARP data packet; the data packet type of the transport layer includes: a TCP data packet, a TCPsyn data packet, a TCPsyn-ack data packet, and a UDP packet. The data packet type of the application layer includes: a DNS data packet, an RTP data packet, a QQ data packet, and an HTTP data packet.

Further, the detection report is a network attack report, and includes: an attack type, an attack target, an attack source, and an attack scale.

Further, the attack type includes -

1) UDPfloor attack type, the identification method is: the total network traffic exceeds the total traffic alarm threshold, and the UDP packet traffic exceeds the UDP packet traffic alarm threshold, and the ratio of UDP packets to the total number of network packets reaches the UDP packet ratio. Alarm threshold, and the average packet length of the UDP packet is reduced to the UDP packet length alarm threshold, and the average packet length of the UDP packet is reduced to the UDP packet length alarm threshold;

2) The TCPsynfloOT attack type is identified as follows: The total network traffic exceeds the total traffic alarm threshold, and the TCPsyn packet traffic exceeds the TCPsyn packet traffic alarm threshold, and the proportion of TCPsyn packets and TCPsynack packets exceeds the TCPsyn-ACK packet ratio. Alarm threshold, and TCPsyn data The ratio of the total number of packets to the TCP packet exceeds the TCPsyn packet occupancy alarm threshold, and the average length of the TCP packet exceeds the TCP packet length alarm threshold;

3) TCPfloor attack type, the identification method is: the total network traffic exceeds the total traffic alarm threshold, and the TCP network traffic exceeds the TCP packet traffic alarm threshold, and the proportion of TCP packets occupying the total number of network packets exceeds the TCP packet occupancy alarm threshold. ;

4) DNS attack type, in fact, the other methods are: DNS packet traffic exceeds the DNS packet traffic alarm threshold, and the ratio of DNS packet traffic to total traffic exceeds the DNS traffic percentage alarm threshold.

Further, the method for determining the attack size is: first, obtaining the current attack traffic of the corresponding type according to the determined attack type; and then comprehensively comparing the traffic alarm threshold and the historical normal traffic of the type of the data packet to evaluate the current attack type. The scale of the attack.

Further, the method for determining the attack target is: first, counting the number of data packets sent to the same destination IP address; then ranking the destination IPs in the comparison set, and determining the top IP address as the target to be attacked. The attack source IP is determined by: counting the source IP address of the data packet, and performing high-to-low alignment according to the number of sent data packets, and determining the top IP as the attack source IP.

Further, the detection report is a network monitoring daily report, which includes: a line chart of network traffic at different time points on the day; a line chart of proportions of various types of data packets on the day; a cake with an average value of each type of data packets on the day Figure; A line chart of the average length of each type of packet in the network at different points in the day.

The system of the present invention is divided into three subsystems, a network data detection subsystem, a network data display subsystem, and an attack alarm subsystem.

1, network data detection subsystem

The main function is responsible for the detection of network data, divided into the following modules:

(1) Packet interception module.

The device is connected to the detected network, and the network data is connected to the detecting device. The module is responsible for parsing the accessed data packet, and the parsing depth may be determined according to network traffic, current device performance, and detection security level, and parsed. The deeper the depth, the higher the performance of the device. The higher the security level, the deeper the depth of detection. According to the above factors, the packet information can be parsed to the network layer, the transport layer, or even the application layer.

(2) Packet feature statistics module.

Statistics on the parsed packet information, including:

A. Statistics on the total number of data packets intercepted per unit time. B. Statistics on the number of different types of data packets intercepted in the network layer per unit time, including the number of IP data packets, the number of ICMP data packets, and the number of data packets such as ARP.

C. Statistics on the number of different types of data packets intercepted in the unit time, including the number of TCP packets, the number of TCPsyn packets, the number of TCPsyn-ack packets, and the number of UDP packets.

D. Statistics on the number of different types of data packets intercepted in the application layer per unit time, including DNS data packets, RTP data packets, QQ data packets, and HTTP data packets.

E. Count the IP address and port of the packet intercepted per unit time.

F. Record the packet length of each type of data packet.

(3) Statistical data processing module.

1) Calculate the proportion distribution of each type of data packet in the total number of data packets per unit time.

2) Calculate the average length of each type of data packet per unit time.

(4) Data storage module

In the steps (2) and (3), the obtained data is stored. Save as time as a keyword.

(5) Data analysis module.

The alarm threshold for each time period is calculated based on various data stored in (4) in the history (in the previous year, the first few months, the first few weeks, and the previous few days).

For example, to calculate the threshold of the UDP packet in the data packet as a percentage of the total packet at a certain time t:

First, you can go to the database to find the time before and after the time. (t-a, t+a) In this time period, the UDP packet accounts for the average value of the total packet ratio Fl.

The average value F2 of the proportion of UDP packets in the total packet is calculated in the same time period of the days before the (t-a, t+a) period.

A similar method is used to calculate the average value Fn of the ratio of the moments in the previous weeks and months.

Then, a series of weights kl, k2, ... kn are assigned to the respective average values.

The formula for calculating the threshold F _udp is:

Here, Q is a value greater than 1, and the threshold F is set to a multiple of the previously calculated average.

A similar method is used to calculate the alarm thresholds for other packets. These threshold data are updated in real time. Once a monitored value exceeds the set threshold, the information is submitted to the Attack Analysis Module.

(6) Attack analysis module It mainly analyzes various types of alarm information obtained from the "data analysis module", and judges the type of attack, the target of the attack, the source of the attack, and the scale of the attack.

a. Determine the type of attack.

(a) UDPfloor type attack identification:

Total network traffic, exceeding the total traffic threshold.

The traffic of the UDP packet exceeds the UDP packet traffic threshold.

The proportion of UDP packets in the entire network packet is increased to the UDP packet occupancy threshold.

The average packet length of the UDP packet is reduced to the UDP packet length threshold, which can be judged as a UDP packet attack.

(b) TCPsynfloor type attack identification

The total network traffic exceeds the total traffic threshold.

TCPsyn packet traffic exceeds the TCPsyn packet traffic threshold.

The ratio of TCPsyn packets to TCPsynack packets exceeds the TCPsyn-ACK packet occupancy threshold.

The ratio of TCPsyn packets to the total number of TCP packets exceeds the TCPsyn packet occupancy threshold.

The average length of TCP packets exceeds the TCP packet length threshold.

(c) TCPfloor type attack identification

The total network traffic exceeds the total traffic threshold.

TCP network traffic exceeds the TCP packet traffic threshold.

The proportion of TCP packets in the entire network packet exceeds the TCP packet occupancy threshold. Packet traffic for many identifiable application protocols using the TCP protocol does not exceed the threshold.

(d) DNS attack

DNS packet traffic exceeds the DNS packet traffic threshold.

DNS packet traffic, the proportion of total traffic exceeds the DNS traffic percentage threshold.

The total network traffic exceeds the total traffic threshold (which occurs when the attack is severe).

(e) Based on the statistics of the acquired network communications, other emerging types of attacks can also be analyzed in appropriate combinations. In addition, in the actual environment, an attack is often composed of several types of attacks, which is judged according to the above characteristics.

b. Determination of the scale of the attack

According to the attack type determined in a, obtain the current attack traffic of the corresponding type, and comprehensively compare the type of data packet. Threshold traffic, and historical normal traffic, to estimate the current attack size of the attack type.

c, attack target analysis

The destination IP of these abnormal data packets is counted, the number of data packets sent to the same destination IP address is counted, the destination IPs in the comparative set are ranked, and the top ranked IP is determined as the target of the attack.

d, attack source IP analysis

The source _IP address of the abnormal data packet is statistically analyzed, and the highest-to-lowest arrangement is performed according to the number of the transmitted data packets, and the top-ranked IP is determined as the attack source IP.

(7) Test report generation module

The main function is to automatically generate an analysis report based on the data obtained in the above module.

Specifically, two reports can be generated:

The first type, the network monitoring daily report, mainly includes a line graph of network traffic at different time points of the day; a line graph of the proportion of various types of data packets; a pie chart of the average of the proportions of various types of data packets on the day; A line chart of the average number of packets of each type in the network at a point in time. The main data source for these charts is the "Network Data Monitoring Module", which displays data in real time on the day. This test report is a routine test report.

Second, the cyber attack analysis report. Once the system detects that the network is under attack, the system generates the report by analyzing the attack data at that time.

The main contents are: The scale of the attack

Changes in the attack (increased speed, duration, etc. of the attack traffic)

Attack type: May be a single attack type, or multiple comprehensive attack types

Attack target information: including IP address, physical location information, etc.

Attack source information: including IP address and physical location information. There may be many source IPs in a distributed attack. The IP addresses are sorted according to the attack size of different IP addresses.

2, network data display subsystem

The data statistically analyzed and saved in the network data detection subsystem is displayed in real time.

The form of the display is mainly in the form of a linear graph or a pie chart.

The granularity of the display time can be adjusted according to specific conditions, and the granularity can be displayed in minutes or in days and weeks. The display range can also be adjusted according to the actual situation. It can display the data within the current hour or the data of the most recent week or month.

The main display contents are: (1) Real-time display of total traffic of network data, in the form of a linear table.

(2) Real-time display of TCP data traffic in network data, in the form of a linear table.

(3) Real-time display of TCP-syn data traffic in network data, in the form of a linear table.

(4) Real-time display of TCP-syn-ack data traffic in network data, in the form of a linear table.

(5) Real-time display of UDP data traffic in network data, in the form of a linear table.

(6) Real-time display of DNS data traffic in network data, in the form of a linear table.

(7) Real-time display of HTTP data traffic in network data, in the form of a linear table.

(8) In the network data, the real-time display of other application layer data traffic is in the form of a linear table. The system can select the traffic of various protocols in the network application layer that needs to be monitored in a focused manner according to the specific needs of the user.

(9) The linear table of the average length of UDP packets is displayed in real time.

(10) Real-time display of the linear table of the average length of TCP packets.

(11) Pie chart of how much UDP and TCP account for the entire network traffic

(12) TCP-syn, a pie chart of TCP-syn-ack packets accounting for the total traffic of TCP data.

(13) Pie chart of the proportion of application layer protocols of interest.

3, attack alarm subsystem

When the network data detection subsystem detects that one or more of the various data indicators of the network exceeds the threshold, the alarm subsystem is activated, and the relevant personnel are reported through the display image, sound, etc., and the monitored network receives the attack at the moment. . At the same time, the detection report generation module of the network data detection subsystem generates an attack report and submits it to the user. Advantages and positive effects of the present invention:

The distributed attack detection method of the present invention is characterized by:

1. Comprehensively consider the characteristics of various network data to identify ddos attacks.

2. Comprehensive data transmission of the network, in-depth analysis of the current network data, and ultimately judge whether the network is attacked. DRAWINGS

Figure 1. Location map of the detection system deployment;

Figure 2. Equipment structure;

Figure 3 is a flow chart of the detection method of the present invention. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

1. Connect network traffic to the monitoring device in bypass mode.

Depending on the target of protection, there are two options for accessing the location.

(1) Bypassing the network data at the protected LAN and the external Internet connection.

(2) At the exit of the inter-provincial network, the bypass detection device detects the network traffic. At this time, due to the large amount of network data, multiple detection devices can be used for distributed detection.

2. First, the network data stream flows into the "network data detection subsystem". The processing method for the network data stream is shown in Figure 3.

(1) The packet accessed by the bypass is parsed by the "packet intercept module" subsystem of the "network data detection subsystem".

(2) Statistics of each protocol data index parsed by the "packet feature statistics module".

(3) Further processing of statistical data.

(4) Store the obtained data as historical data of the network.

(5) Further analyzing the network data based on the accumulated historical data, and calculating the thresholds of various network data.

(6) Monitor each type of network monitoring data with the threshold of each network data as the coordinate.

(7) Generate a network detection analysis report based on the monitored network data.

3. The Network Data Display Subsystem displays real-time screens of various data obtained from the Network Data Detection Subsystem to monitor the latest network conditions.

4. Once it is found that some network data exceeds the previously calculated corresponding network data threshold, this message will be passed to the "Attack Alarm Subsystem".

The subsystem sends out an alarm message, and at the same time, the "detection report generation module" module generates a network attack analysis report.

Claims

Claim

1. A DDOS attack detection method, the steps are:

3) The statistical data processing module calculates the proportion distribution of each type of data packet per unit time in the total number of data packets;

4) The data analysis module calculates the alarm threshold of the network data according to the historical data calculated in steps 2) and 3) of the storage;

5) The data analysis module determines whether the network data value in the current unit time exceeds the alarm threshold of the corresponding network data, and if so, submits the network data value to the attack analysis module;

2. The method according to claim 1, wherein the network packet information further includes a packet length of each type of data packet; and the data packet feature statistics module parses the data of each type of data packet. The packet length is counted.

3. The method of claim 2, wherein the statistical data processing module calculates an average length of each type of data packet per unit time.

4. The method according to claim 1, wherein the data analysis module updates an alarm threshold of each type of data packet in real time; the calculation method of the alarm threshold is: first calculating a time before and after a certain type of data packet The average value of this type of data packet in the segment as the average packet ratio F1; then calculate the average of the ratio of the type of data packet to the total data packet at the same time in the first few days, the first few weeks and the previous months of the time. Fn; finally according to

k F + k F - k F

Formula _{F =} il 2 - t L _X Q calculates the alarm threshold F for this type of packet; where _n times,

n

Kn is the weight corresponding to Fn, Q is a multiple factor, and 0>1.

The method according to claim 4, wherein the data packet type of the network layer comprises: an IP data packet, an ICMP data packet, and an ARP data packet; and the data packet type of the transport layer includes: a TCP data packet, TCPsyn packet, TCPsyn-ack packet, UDP packet; the packet type of the application layer includes: DNS number According to the package, RTP packets, QQ packets, HTTP packets.

6. The method according to claim 1, wherein the detection report is a network attack report, and includes: an attack type, an attack target, an attack source, and an attack scale.

7. The method of claim 6 wherein the attack type comprises:

2) The TCPsynfloor attack type is identified as follows: The total network traffic exceeds the total traffic alarm threshold, and the TCPsyn packet traffic exceeds the TCPsyn packet traffic alarm threshold, and the proportion of TCPsyn packets and TCPsynack packets exceeds the TCPsyn-ACK packet ratio. The alarm threshold, and the ratio of the TCPsyn packet to the total amount of the TCP packet exceeds the TCPsyn packet occupancy alarm threshold, and the average length of the TCP packet exceeds the TCP packet length alarm threshold;

3) The TCPfloor attack type is identified as follows: The total network traffic exceeds the total traffic alarm threshold, and the TCP network traffic exceeds the TCP packet traffic alarm threshold, and the proportion of TCP packets occupying the total number of network packets exceeds the TCP packet occupancy alarm threshold. ;

The method according to claim 6, wherein the method for determining the attack size is: first obtaining the current attack traffic of the corresponding type according to the determined attack type; and then comprehensively comparing the traffic alarm threshold of the type of the packet and Historical normal traffic, to assess the current size of the attack type of attack.

9. The method according to claim 6, wherein the method for determining the attack target is: first, counting the number of data packets sent to the same destination IP address; and then ranking the destination IPs in the comparison set, The top IP is determined as the target to be attacked; the attack source IP is determined by: counting the source IP address of the data packet, and ranking from high to low according to the number of sent data packets, ranking the ranking The previous IP is determined as the attack source IP.

10. The method according to claim 1, wherein the detection report is a network monitoring daily report, comprising: a line chart of network traffic at different time points on the day; a line chart of proportions of various types of data packets on the day; Each A pie chart of the average of the proportions of type packets; a line chart of the average length of each type of packet in the network at different points in the day.