WO2017088397A1 - 用于CDN服务器群组的DDoS攻击防护方法及系统 - Google Patents

用于CDN服务器群组的DDoS攻击防护方法及系统 Download PDF

Info

Publication number
WO2017088397A1
WO2017088397A1 PCT/CN2016/083250 CN2016083250W WO2017088397A1 WO 2017088397 A1 WO2017088397 A1 WO 2017088397A1 CN 2016083250 W CN2016083250 W CN 2016083250W WO 2017088397 A1 WO2017088397 A1 WO 2017088397A1
Authority
WO
WIPO (PCT)
Prior art keywords
cdn
server
ddos attack
blacklist
access
Prior art date
Application number
PCT/CN2016/083250
Other languages
English (en)
French (fr)
Inventor
李洪福
Original Assignee
乐视控股（北京）有限公司
乐视云计算有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 乐视控股（北京）有限公司, 乐视云计算有限公司 filed Critical 乐视控股（北京）有限公司
Priority to US15/252,953 priority Critical patent/US20170149821A1/en
Publication of WO2017088397A1 publication Critical patent/WO2017088397A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • the embodiments of the present invention relate to the field of network security technologies, and in particular, to a DDoS attack protection method and system for a CDN server group.
  • the CDN Content Delivery Network
  • the CDN can redirect the user's request to the nearest service node according to the network traffic and the connection of each node, the load status, and the distance to the user and the response time.
  • the purpose is to be able to select relatively close to the user.
  • the node sends the user the content required by the user, alleviates the network congestion and improves the response speed of the website.
  • DDoS Distributed Denial of Service
  • the cyber attack behavior which uses a large number of downtimes to simultaneously attack a server or system, so that the attacked system cannot support normal service access due to bandwidth congestion or server resource exhaustion; DDoS attacks are often taken legally.
  • the data request technology coupled with the help of the machine, has made DDoS attacks one of the most difficult defensive cyber attacks.
  • DDoS attacks are mainly prevented from two aspects: host setting and network setting.
  • the prior art prevents DDoS attacks from the aspect of host setting, and adopts settings related to all DDoS against all the servers in the host platform, for example, turning off unnecessary services and limiting the simultaneous opening of Syn half.
  • the number of connections shorten the time out time of the Syn half-connect, and update the system patches in time.
  • the prior art prevents DDoS attacks from the aspect of network setting, including setting of interface devices such as firewalls and routers to the outside world, for example, setting of the firewall includes prohibiting access to non-open services of the host, Limit the maximum number of SYN connections that can be opened at the same time, limit the access of specific IP addresses, enable the anti-DDoS attribute of the firewall, and strictly limit the outbound access of the open server; set the router to set the SYN packet traffic rate; upgrade version Low ISO and establish a log server for the router.
  • black hole technology, router filtering, speed limit and other means not only consume a lot of server resources, but also block some effective services, reducing the processing efficiency of the server to user access requests, seriously affecting the user experience;
  • deploying a large number of redundant devices ensures sufficient responsiveness to provide DDoS attack protection, but the cost of protecting DDoS attacks is too high.
  • DDoS attacks a CDN server.
  • This server uses a series of anti-DDoS attacks to identify and defend against this DDoS attack.
  • DDoS attacks multiple CDN servers in the CDN platform, multiple CDN platforms
  • the server needs to identify and defend the DDoS attack source.
  • the technical problem is: the processing efficiency of the DDoS attack on the CDN platform is seriously reduced, and the response speed of the website is slowed down. How to effectively and effectively defend against the attack on the CDN platform by the DDoS attack source is also At present, the industry needs to solve the problem.
  • the purpose of the embodiments of the present invention is to solve the above-mentioned at least one technical problem, and provide a DDoS attack protection method and system for a CDN server group, which can effectively protect a large-scale DDoS attack.
  • An embodiment of the present invention provides a DDoS attack protection method for a CDN server group, where the CDN server group includes a plurality of CDN servers and a central server, and the method includes:
  • Each CDN server sends access source information of the access request to the central server;
  • the central server counts the number of access requests corresponding to the same access source information under each CDN server in a period of time;
  • the plurality of CDN servers refuse to provide services to access sources that fall into the blacklist.
  • An embodiment of the present invention provides a DDoS attack protection system for a CDN server group, where the CDN server group includes a plurality of CDN servers and a central server, where:
  • Each CDN server includes:
  • An acquisition unit configured to collect access source information of the access request
  • a sending unit configured to send the access source information to a central server
  • a service control unit configured to be associated with the blacklist receiving unit, to refuse to provide a service to an access source that falls into the blacklist
  • the central server includes:
  • a statistical unit for counting the corresponding access sources under each CDN server for a period of time The number of access requests for information
  • a blacklist generating unit configured to determine, as a DDoS attack, an access request that is greater than a predetermined threshold for the number of access requests corresponding to the same access source information under each CDN server, and generate black based on the access source information of the access request, respectively.
  • a sending unit configured to send the blacklist to a blacklist receiving unit of the multiple CDN servers in the CDN server group.
  • the identification of the DDoS attack source for each CDN server is completed on the central server, which reduces the resource consumption of each CDN server, and each CDN server sends the access source information to the central server, thereby avoiding the DDoS attack source to the central server. Access, effectively hiding and protecting the central server;
  • the central server After identifying the DDoS attack suffered by one CDN server in the CDN server group, the central server records the DDoS attack source to the blacklist, and sends the blacklist to each CDN server under the CDN server group, and simultaneously updates the entire CDN.
  • the blacklist of each CDN server under the server group implements DDoS attack protection of the entire network of the CDN server group;
  • FIG. 1 is a flowchart of a DDoS attack protection method for a CDN server group according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a DDoS attack protection system for a CDN server group according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a CDN platform in which a plurality of CDN server groups shown in FIG. 2 are arranged according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of a terminal device or a server that can be applied to implement an embodiment of the present invention.
  • the CDN server group includes a plurality of CDN servers and a central server, and the method includes:
  • Each CDN server sends access source information of the access request to the central server;
  • S102 The central server counts the number of access requests corresponding to the same access source information under each CDN server in a period of time;
  • the central server determines, as a DDoS attack, an access request that is greater than a predetermined threshold for the number of access requests corresponding to the same access source information under each CDN server, and correspondingly Generating a blacklist for the access source information of the access request;
  • S104 The central server sends the blacklist to the multiple CDN servers in the CDN server group.
  • S105 The plurality of CDN servers refuse to provide a service to an access source that falls into the blacklist.
  • the DDoS attack source is marked by the blacklist, and all the marked DDoS attack sources are denied access to the CDN server, which effectively protects the DDoS attack.
  • the DDoS attack source for each CDN server is identified in the center. The completion of the server reduces the resource consumption of each CDN server, and each CDN server sends the access source information to the central server, thereby avoiding the access of the DDoS attack source to the central server, effectively hiding and protecting the central server;
  • the central server After identifying the DDoS attack suffered by a CDN server, the central server records the DDoS attack source to the blacklist, and sends the blacklist to each CDN server under the CDN server group, and simultaneously updates each CDN server under the entire CDN server group.
  • the blacklist implements the DDoS attack protection of the CDN server group.
  • the central server does not need to attack the DDoS attack source again. Identification, saving the central server in DDoS attack protection Source consumption.
  • the access source information includes an IP, a URL, and/or a Refer information of the access request source; more specifically, the method includes:
  • Each CDN server sends access source information of the access request to the central server.
  • the central server counts the number of access requests corresponding to the same access source information under each CDN server for a period of time. For example, statistically accessing one of the CDN servers to access the one of the CDN servers for a period of time; and counting one of the URLs of one of the CDN servers to the one of the CDNs for a period of time Total number of visits to the server; one of the Refers to one of the CDN servers is visited for a period of time. The total number of accesses of one of the CDN servers; and so on, the number of accesses for access requests corresponding to the same IP, URL, and/or Refer under each CDN server.
  • the central server determines, as a DDoS attack, an access request that is greater than a predetermined threshold for the number of access requests corresponding to the same access source information under each CDN server, and generates a blacklist based on the access source information of the access request. For example, the central server compares the number of accesses of the access request corresponding to the same IP, URL, and/or Refer under a single CDN server with a predetermined threshold, and the access times of the access requests of the same IP, URL, and/or Refer are greater than The IP, URL, and/or Refer access request for the predetermined threshold is determined to be a DDoS attack. For more specific implementation of this step, the following sub-steps may be included: I.
  • Pre-set IP normal threshold compare the number of access requests of the access request corresponding to the same IP with the IP normal threshold, and access the access request corresponding to the same IP. If the number of times exceeds the threshold, it is determined that the access request corresponding to the same IP is a DDoS attack; II.
  • the default threshold of the default URL, and the number of access requests corresponding to the same URL is compared with the normal threshold of the URL, when the same URL is used. When the number of accesses of the corresponding access request exceeds the threshold, the access request corresponding to the same URL is determined to be a DDoS attack; III.
  • the preset normal threshold of the Refer when the number of access requests corresponding to the same Refer exceeds the threshold, then Determining that the access request corresponding to the same Refer is a DDoS attack; the DDoS attack identification of the sub-steps I, II, and III of the step is independent of each other, and the sub-steps I, II, and III may be synchronously executed. , can also be progressively executed; the threshold setting in this step can be a reference determined by experience or multiple experiments. ; Blacklisted by generating DDoS attack has been identified as a source IP and / or the URL and / or Refer.
  • the central server delivers the blacklist to the plurality of CDN servers in the CDN server group.
  • the central server sends the blacklist generated according to the access request of one CDN server to multiple CDN servers in the CDN server group.
  • the central server sends the blacklist generated according to the access request of one CDN server to the blacklist.
  • Each CDN server in the CDN server group is a CDN server in the CDN server group.
  • the plurality of CDN servers refuse to provide services to access sources that fall into the blacklist.
  • multiple CDN servers in a CDN server group refuse to provide services for IP, URL, and/or Referr that fall into the blacklist.
  • each CDN server pair in the CDN server group falls into the blacklist.
  • the IP, URL, and/or Refer are denied service.
  • the CDN server group is a plurality of CDN server groups that are arranged on the CDN platform according to different network types.
  • the CDN platform is divided into a plurality of the CDN server groups according to the network type.
  • the CDN platform includes multiple telecommunication network types: the first network type is “China Telecom” and the second network type is “China Unicom”.
  • the CDN platform is divided into a plurality of CDN server groups according to multiple network types such as the first network type "China Unicom” and the second network type "China Telecom”.
  • the DDoS attack source attacks the server under a specific type of network; the CDN platform is divided into a plurality of the CDN server groups according to multiple network types of the CDN platform, and the CDN platform is implemented in the CDN platform.
  • the CDN server of the group is attacked, the servers in the other CDN groups are called to replace the attacked CDN server, so that the CDN platform performs CDN server scheduling according to the DDoS attack monitoring, thereby ensuring the normal operation of the website.
  • the central server of any one of the plurality of CDN server groups delivers the blacklist to the plurality of CDN servers in the CDN server group, optionally Blacklist sharing with the central server of other CDN server groups.
  • the blacklist of each CDN group on the CDN platform is updated synchronously, and the DDoS attack protection of the CDN platform is realized. Further, when the blacklisted DDoS attack source attempts to attack each CDN server under the CDN server group, the central server does not need to identify the DDoS attack source again, thereby saving the central server's DDoS attack protection. LF.
  • a DDoS attack protection system for a CDN server group is shown. include:
  • Each CDN server includes:
  • An acquisition unit configured to collect access source information of the access request
  • a sending unit configured to send the access source information collected by the collecting unit to a central server
  • a service control unit configured to be associated with the blacklist receiving unit, to refuse to provide a service to an access source that falls into the blacklist
  • the central server includes:
  • a statistical unit configured to count the number of access requests corresponding to the same access source information under each CDN server in a period of time
  • a blacklist generating unit configured to determine, by the statistical unit, an access request corresponding to the same access source information under each CDN server that is greater than a predetermined threshold as a DDoS attack, and correspondingly based on the access request Access source information to generate a blacklist;
  • a sending unit configured to send the blacklist generated by the blacklist generating unit to a blacklist receiving unit of the plurality of CDN servers in the CDN server group.
  • the DDoS attack defense system for the CDN server group in this embodiment is a server or a server cluster, wherein each unit may be a separate server or a server cluster.
  • the interaction between the units is represented by each unit.
  • the collecting unit, the sending unit, the blacklist receiving unit, and the service control unit together form a first server or a first server cluster
  • the statistical unit, the blacklist generating unit, and the sending unit constitute a second server or a second server cluster.
  • the interaction between the above units is represented by the interaction between the first server and the second server.
  • the interaction between the first server cluster and the second server cluster, the first server and the second server or the first server cluster and the second server cluster together constitute the DDoS attack protection system for the CDN server group of the present invention.
  • the DDoS attack source is marked by the blacklist, and all the marked DDoS attack sources are denied access to the CDN server, which effectively protects the DDoS attack.
  • the DDoS attack source for each CDN server is identified in the center. The completion of the server reduces the resource consumption of each CDN server, and each CDN server sends the access source information to the central server, thereby avoiding the access of the DDoS attack source to the central server, effectively hiding and protecting the central server;
  • the central server After identifying the DDoS attack suffered by a CDN server, the central server records the DDoS attack source to the blacklist, and sends the blacklist to each CDN server under the CDN server group, and simultaneously updates each CDN server under the entire CDN server group.
  • the blacklist implements the DDoS attack protection of the CDN server group.
  • the central server does not need to attack the DDoS attack source again. Identification, saving the central server in DDoS attack protection Source consumption.
  • the embodiment of the present invention may also implement a related unit by using a hardware processor.
  • the access source information comprises IP, URL and/or Refer information.
  • the acquisition unit is an nginx module.
  • FIG. 3 there is shown a CDN platform in which a plurality of CDN server groups shown in FIG. 2 are arranged, wherein the CDN server group is a plurality of CDNs arranged on a CDN platform according to different network types. Server group.
  • the DDoS attack source attacks the server under a specific type of network; the CDN platform is divided into a plurality of the CDN server groups according to multiple network types of the CDN platform, and the CDN platform is implemented in the CDN platform.
  • the group's CDN server is under attack, it is adjusted in time.
  • the server in the other CDN group is used to replace the attacked CDN server, so that the CDN platform implements CDN server scheduling according to the DDoS attack monitoring condition, thereby ensuring the normal operation of the website.
  • a central server of any one of the plurality of CDN server groups is configured to selectively blacklist share with a central server of other CDN server groups.
  • the blacklist of each CDN group on the CDN platform is updated synchronously, and the DDoS attack protection of the CDN platform is realized. Further, when the blacklisted DDoS attack source attempts to attack each CDN server under the CDN server group, the central server does not need to identify the DDoS attack source again, thereby saving the central server's DDoS attack protection. LF.
  • FIG. 4 is a block diagram showing a computer system suitable for implementing a terminal device or a server of an embodiment of the present application, wherein the computer system includes a central processing unit (CPU) 401, which can be stored in a read only memory (ROM) according to The program in 402 or the program loaded from the storage portion 408 into the random access memory (RAM) 403 performs various appropriate operations and processes. In the RAM 403, various programs and data required for system operation are also stored.
  • the CPU 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404.
  • An input/output (I/O) interface 405 is also coupled to bus 404.
  • the following components are connected to the I/O interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 408 including a hard disk or the like. And a communication portion 409 including a network interface card such as a LAN card, a modem, or the like. The communication section 409 performs communication processing via a network such as the Internet.
  • Driver 410 is also coupled to I/O interface 405 as needed.
  • Removable medium 411 such as a disk, light A disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 410 as needed so that a computer program read therefrom is installed into the storage portion 408 as needed.
  • an embodiment of the invention includes a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart.
  • the computer program can be downloaded and installed from the network via the communication portion 409, and/or installed from the removable medium 411.
  • the DDoS attack protection system of the CDN server group in the embodiment of the present invention may be embedded in a central server and a CDN server of a CDN server group as a functional component.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without deliberate labor.
  • the points may be embodied in the form of a software product, which may be stored in a computer readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer)
  • the server, or network device, etc. performs the methods described in various embodiments or portions of the embodiments.

Abstract

本发明提供一种用于CDN服务器群组的DDoS攻击防护方法，所述CDN服务器群组包括多个CDN服务器和中心服务器，所述方法包括：每个CDN服务器将访问请求的访问源信息发送至中心服务器；所述中心服务器统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；所述中心服务器将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并基于所述访问请求的访问源信息生成黑名单；所述中心服务器将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器；所述多个CDN服务器对落入所述黑名单的访问源拒绝提供服务。本发明还提供一种用于CDN服务器群组的DDoS攻击防护系统，实现了CDN服务器群组的全网DDoS攻击防护。

Description

用于CDN服务器群组的DDoS攻击防护方法及系统 技术领域
本发明实施例涉及网络安全技术领域，尤其涉及一种用于CDN服务器群组的DDoS攻击防护方法及系统。
背景技术
随着互联网的发展，用户在使用网络时对网站的浏览速度和效果愈加重视，但由于网民数量激增，网络访问路径过长，从而使用户的访问质量受到严重影响。特别是当用户与网站之间的链路被突发的大流量数据拥塞时，对于异地互联网用户急速增加的地区来说，访问质量不良更是一个急待解决的问题。
CDN(Content Delivery Network，内容分发网络)是一种通过在网络各处放置CDN服务器所构成的在现有的互联网基础之上的一层智能虚拟网络。CDN能够实时地根据网络流量和各节点的连接、负载状况以及到用户的距离和响应时间等综合信息将用户的请求重新导向离用户最近的服务节点上，其目的是能够选择离用户相对较近的节点向用户发送用户所需的内容，缓解网络拥挤的状况，提高网站的响应速度。
可是随着互联网技术的发展与应用普及，网络上的服务器或系统面临着更多、更复杂的网络攻击行为，其中，DDoS(Distributed Denial of Service，分布式拒绝服务)便是一种较为严重的网络攻击行为，它利用大量的傀儡机对某个服务器或系统同时发起攻击，使得受攻击的该系统因带宽拥塞或服务器资源耗尽等原因而无法支持正常的业务访问；由于DDoS攻击往往采取合法的数据请求技术，再加上傀儡机器的辅助，导致DDoS攻击成为目前最难防御的网络攻击之一。
现有技术中主要从主机设置、网络设置两方面来防止DDoS攻击。
其一方面，现有技术从主机设置方面来防止DDoS攻击，采取对将所有的主机平台中所有的服务器都进行进行抵御DDoS的相关设置，例如：关闭不必要的服务，限制同时打开的Syn半连接数目，缩短Syn半连接的time out时间，及时更新系统补丁等。
其另一方面，现有技术从网络设置方面来防止DDoS攻击，包括对防火墙与路由器这两类到外界的接口设备的设置，例如：对防火墙的设置包括禁止对主机的非开放服务的访问，限制同时打开的SYN最大连接数，限制特定IP地址的访问，启用防火墙的防DDoS的属性，严格限制对外开放的服务器的向外访问；对路由器的设置包括设置SYN数据包流量速率；升级版本过低的ISO以及为路由器建立log server。
使用上述技术方案来防止DDoS攻击的技术问题在于：
其一方面，采用黑洞技术和路由器过滤、限速等手段，不仅大量消耗了服务器的资源，同时也阻断了部分有效业务，降低了服务器对用户访问请求的处理效率，严重影响了用户体验；其另一方面，部署大量的冗余设备，保证足够的响应能力来提供DDoS攻击防护，但又使得防护DDoS攻击的代价过于高昂。
更进一步地，随着互联网技术的发展与应用普及，存在不法分子利用大量的傀儡机对CDN平台的各个CDN服务器发起DDoS攻击，进而攻击CDN平台的中心服务器；现有技术采用的技术方案是：DDoS攻击某一CDN服务器，此服务器采取一系列的防DDoS攻击的技术手段识别并防御此DDoS攻击，当同样的DDoS攻击源DDoS攻击CDN平台中的多个CDN服务器时，CDN平台中的多个服务器均需要对DDoS攻击源进行识别并防御；技术问题在于：严重降低了CDN平台对DDoS攻击的处理效率，并拖慢了网站的响应速度；如何简单有效防御DDoS攻击源对CDN平台的攻击也是目前业界亟待解决的需要课题。
发明内容
本发明实施例的目的在于解决上述至少一个技术问题，提供一种CDN服务器群组的DDoS攻击防护方法及系统，可以有效防护大规模DDoS攻击。
本发明一实施例提供一种用于CDN服务器群组的DDoS攻击防护方法，所述CDN服务器群组包括多个CDN服务器和中心服务器，所述方法包括：
每个CDN服务器将访问请求的访问源信息发送至所述中心服务器；
所述中心服务器统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；
所述中心服务器将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单；
所述中心服务器将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器；
所述多个CDN服务器对落入所述黑名单的访问源拒绝提供服务。
本发明一实施例提供一种用于CDN服务器群组的DDoS攻击防护系统，所述CDN服务器群组包括多个CDN服务器和中心服务器，其中：
每个CDN服务器包括：
采集单元，用于采集访问请求的访问源信息；
发送单元，用于将所述访问源信息发送至中心服务器；
黑名单接收单元；
服务控制单元，配置与所述黑名单接收单元关联，以对落入黑名单的访问源拒绝提供服务，
所述中心服务器包括：
统计单元，用于统计一段时间内每个CDN服务器下对应于同一访问源 信息的访问请求的数量；
黑名单生成单元，用于将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单；
下发单元，用于将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器的黑名单接收单元。
通过本发明一实施例提供的用于CDN平台的DDoS攻击防护方法及系统，实现了：
一、通过黑名单来标记DDoS攻击的攻击源，并拒绝所有已被标记的DDoS攻击源对CDN服务器的访问，实现了针对DDoS攻击的有效防护；
二、针对各个CDN服务器访问的DDoS攻击源的识别工作是在中心服务器上完成的，降低了各个CDN服务器资源消耗，且各个CDN服务器向中心服务器发送访问源信息，避免了DDoS攻击源对中心服务器的访问，有效隐藏和保护了中心服务器；
三、对CDN服务器群组其中一个CDN服务器遭受的DDoS攻击进行识别后，中心服务器记录DDoS攻击源至黑名单，并将黑名单发送至CDN服务器群组下的各个CDN服务器，同步更新了整个CDN服务器群组下的各个CDN服务器的黑名单，实现了CDN服务器群组的全网DDoS攻击防护；
四、当已被列入黑名单的DDoS攻击源尝试攻击CDN服务器群组下的各个CDN服务器时，中心服务器不需要再次对DDoS攻击源进行识别，节约了中心服务器在DDoS攻击防护方面的资源消耗。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下 面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一实施例的用于CDN服务器群组的DDoS攻击防护方法流程图；
图2为本发明一实施例的用于CDN服务器群组的DDoS攻击防护系统的结构示意图；
图3为本发明一实施例的布置有多个图2所示的CDN服务器群组的CDN平台的结构示意图；
图4为可以应用于实现本发明实施例的终端设备或服务器的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参见图1，示出的是本发明一具体实施例的CDN服务器群组的DDoS攻击防护方法，所述CDN服务器群组包括多个CDN服务器和中心服务器，所述方法包括：
S101：每个CDN服务器将访问请求的访问源信息发送至所述中心服务器；
S102：所述中心服务器统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；
S103：所述中心服务器将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基 于所述访问请求的访问源信息生成黑名单；
S104：所述中心服务器将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器；
S105：所述多个CDN服务器对落入所述黑名单的访问源拒绝提供服务。
通过本发明实施例方法，实现了：
通过黑名单来标记DDoS攻击的攻击源，并拒绝所有已被标记的DDoS攻击源对CDN服务器的访问，实现了DDoS攻击的有效防护；针对各个CDN服务器访问的DDoS攻击源的识别工作是在中心服务器上完成的，降低了各个CDN服务器资源消耗，且各个CDN服务器向中心服务器发送访问源信息，避免了DDoS攻击源对中心服务器的访问，有效隐藏和保护了中心服务器；对CDN服务器群组其中一个CDN服务器遭受的DDoS攻击进行识别后，中心服务器记录DDoS攻击源至黑名单，并将黑名单发送至CDN服务器群组下的各个CDN服务器，同步更新了整个CDN服务器群组下的各个CDN服务器的黑名单，实现了CDN服务器群组的全网DDoS攻击防护；当已被列入黑名单的DDoS攻击源尝试攻击CDN服务器群组下的各个CDN服务器时，中心服务器不需要再次对DDoS攻击源进行识别，节约了中心服务器在DDoS攻击防护方面的资源消耗。
在本发明方法的一种实施方式中，所述访问源信息包含访问请求源的IP、URL和/或Refer信息；更具体地，包括：
每个CDN服务器将访问请求的访问源信息发送至所述中心服务器。
所述中心服务器统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量。例如：统计访问其中一台CDN服务器的其中一个IP在一段时间内对所述其中一台CDN服务器访问次数；统计访问其中一台CDN服务器的其中一个URL在一段时间内对所述其中一台CDN服务器总访问次数；统计访问其中一台CDN服务器的其中一个Refer在一段时间内对所 述其中一台CDN服务器总访问次数；以此类推，获取每个CDN服务器下对应于同一IP、URL和/或Refer的访问请求的访问次数。
所述中心服务器将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单。例如：所述中心服务器将单个CDN服务器下的对应于同一IP、URL和/或Refer的访问请求的访问次数与预定阈值进行对比，将同一IP、URL和/或Refer的访问请求的访问次数大于预定阈值的IP、URL和/或Refer的访问请求确定为DDoS攻击。关于本步骤更具体的执行，可以包括如下子步骤：Ⅰ、预设IP正常阈值，将同一IP所对应的访问请求的访问次数与IP正常阈值进行对比，当同一IP所对应的访问请求的访问次数超过阈值时，则确定所述同一IP所对应的访问请求为DDoS攻击；Ⅱ、预设URL正常阈值，将同一URL所对应的访问请求的访问次数与URL正常阈值进行对比，当同一URL所对应的访问请求的访问次数超过阈值时，则确定所述同一URL所对应的访问请求为DDoS攻击；Ⅲ、预设Refer正常阈值，当同一Refer所对应的访问请求的访问次数超过阈值时，则确定所述同一Refer所对应的访问请求为DDoS攻击；关于本步骤的第Ⅰ、Ⅱ、Ⅲ子步骤的DDoS攻击识别是彼此独立的，同时第Ⅰ、Ⅱ、Ⅲ子步骤可以是同步式执行的，也可以是渐进式执行的；关于本步骤中的阈值的设定，可以是依据经验或多次实验所确定的参考值；根据已确定为DDoS攻击源的IP和/或URL和/或Refer生成黑名单。
所述中心服务器将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器。例如：中心服务器将根据一个CDN服务器的访问请求所生成的黑名单发送至CDN服务器群组中的多个CDN服务器，优选地，中心服务器将根据一个CDN服务器的访问请求所生成的黑名单发送至CDN服务器群组中的各个CDN服务器。
所述多个CDN服务器对落入所述黑名单的访问源拒绝提供服务。例 如：CDN服务器群组中的多个CDN服务器对落入所述黑名单的IP、URL和/或Refer拒绝提供服务，优选地，CDN服务器群组中的各个CDN服务器对落入所述黑名单的IP、URL和/或Refer均拒绝提供服务。
作为本发明方法实施例的进一步优化，所述CDN服务器群组为布置在CDN平台上的根据网络类型的不同而划分的多个CDN服务器群组。
由此根据网络类型将CDN平台划分为多个所述CDN服务器群组，例如：CDN平台包含有第一网络类型为“中国电信”和第二网络类型为“中国联通”等多个电信网络类型，根据第一网络类型“中国联通”、第二网络类型“中国电信”等多个网络类型将CDN平台划分成多个CDN服务器群组。
通常情况下，DDoS攻击源会针对某一特定类型网络下的服务器进行攻击；根据CDN平台的多个网络类型将CDN平台划分为多个所述CDN服务器群组，实现了在CDN平台中某一群组的CDN服务器遭受攻击时，及时调用其他CDN群组中的服务器来接替被攻击的CDN服务器，使得CDN平台实现了根据DDoS攻击监测的情况进行CDN服务器调度，保障了网站的正常运营。
作为本发明方法实施例的进一步优化，所述多个CDN服务器群组中的任一个CDN服务器群组的中心服务器将黑名单下发至该CDN服务器群组中的多个CDN服务器之后，选择性地与其他CDN服务器群组的中心服务器进行黑名单共享。
通过将CDN平台中的一个CDN群组的黑名单发送至CDN平台中的另一个CDN群组，实现了CDN平台各个CDN群组的黑名单的同步更新，实现了CDN平台的全网DDoS攻击防护；进一步地，当已被列入黑名单的DDoS攻击源尝试攻击CDN服务器群组下的各个CDN服务器时，中心服务器不需要再次对DDoS攻击源进行识别，节约了中心服务器在DDoS攻击防护方面的资源消耗。
参见图2示出的是一种用于CDN服务器群组的DDoS攻击防护系统，包 括：
每个CDN服务器包括：
采集单元，用于采集访问请求的访问源信息；
发送单元，用于将所述采集单元所采集的访问源信息发送至中心服务器；
黑名单接收单元；
服务控制单元，配置与所述黑名单接收单元关联，以对落入黑名单的访问源拒绝提供服务，
所述中心服务器包括：
统计单元，用于统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；
黑名单生成单元，用于将统计单元所统计的每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单；
下发单元，用于将所述黑名单生成单元所生成的所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器的黑名单接收单元。
本实施例中的用于CDN服务器群组的DDoS攻击防护系统为一个服务器或者服务器集群，其中每个单元可以是单独的服务器或者服务器集群，此时，上述单元之间的交互表现为各单元所对应的服务器或者服务器集群之间的交互，所述多个服务器或服务器集群共同构成本发明的用于CDN服务器群组的DDoS攻击防护系统。
在一种替代实施例中，可以是上述多个单元中的几个单元共同组成一个服务器或者服务器集群。例如：采集单元、发送单元、黑名单接收单元和服务控制单元共同组成第一服务器或者第一服务器集群，统计单元、黑名单生成单元和下发单元构成第二服务器或者第二服务器集群。
此时，上述单元之间的交互表现为第一服务器和第二服务器之间的交互 或者第一服务器集群和第二服务器集群之间的交互，所述第一服务器和第二服务器或第一服务器集群和第二服务器集群共同构成本发明的用于CDN服务器群组的DDoS攻击防护系统。
通过本发明实施例系统实现了：
通过黑名单来标记DDoS攻击的攻击源，并拒绝所有已被标记的DDoS攻击源对CDN服务器的访问，实现了DDoS攻击的有效防护；针对各个CDN服务器访问的DDoS攻击源的识别工作是在中心服务器上完成的，降低了各个CDN服务器资源消耗，且各个CDN服务器向中心服务器发送访问源信息，避免了DDoS攻击源对中心服务器的访问，有效隐藏和保护了中心服务器；对CDN服务器群组其中一个CDN服务器遭受的DDoS攻击进行识别后，中心服务器记录DDoS攻击源至黑名单，并将黑名单发送至CDN服务器群组下的各个CDN服务器，同步更新了整个CDN服务器群组下的各个CDN服务器的黑名单，实现了CDN服务器群组的全网DDoS攻击防护；当已被列入黑名单的DDoS攻击源尝试攻击CDN服务器群组下的各个CDN服务器时，中心服务器不需要再次对DDoS攻击源进行识别，节约了中心服务器在DDoS攻击防护方面的资源消耗。
需要说明的是，本发明实施例也可以通过硬件处理器来实现相关单元。
在本发明系统的一种实施方式中，所述访问源信息包含IP、URL和/或Refer信息。
作为图2所示实施例系统的进一步优化，所述采集单元为nginx模块。
参见图3示出的是布置有多个图2所示的CDN服务器群组的CDN平台，其中，所述CDN服务器群组为布置在CDN平台上的根据网络类型的不同而划分的多个CDN服务器群组。
通常情况下，DDoS攻击源会针对某一特定类型网络下的服务器进行攻击；根据CDN平台的多个网络类型将CDN平台划分为多个所述CDN服务器群组，实现了在CDN平台中某一群组的CDN服务器遭受攻击时，及时调 用其他CDN群组中的服务器来接替被攻击的CDN服务器，使得CDN平台实现了根据DDoS攻击监测的情况进行CDN服务器调度，保障了网站的正常运营。
图3作为进一步的优化，所述多个CDN服务器群组中的任一个CDN服务器群组的中心服务器配置成选择性地与其他CDN服务器群组的中心服务器进行黑名单共享。
通过将CDN平台中的一个CDN群组的黑名单发送至CDN平台中的另一个CDN群组，实现了CDN平台各个CDN群组的黑名单的同步更新，实现了CDN平台的全网DDoS攻击防护；进一步地，当已被列入黑名单的DDoS攻击源尝试攻击CDN服务器群组下的各个CDN服务器时，中心服务器不需要再次对DDoS攻击源进行识别，节约了中心服务器在DDoS攻击防护方面的资源消耗。
参见图4示出了适于用来实现本申请实施例的终端设备或服务器的计算机系统的结构示意图，其中计算机系统包括中央处理单元(CPU)401，其可以根据存储在只读存储器(ROM)402中的程序或者从存储部分408加载到随机访问存储器(RAM)403中的程序而执行各种适当的动作和处理。在RAM403中，还存储有系统操作所需的各种程序和数据。CPU 401、ROM 402以及RAM403通过总线404彼此相连。输入/输出(I/O)接口405也连接至总线404。
以下部件连接至I/O接口405：包括键盘、鼠标等的输入部分406；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分407；包括硬盘等的存储部分408；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分409。通信部分409经由诸如因特网的网络执行通信处理。驱动器410也根据需要连接至I/O接口405。可拆卸介质411，诸如磁盘、光 盘、磁光盘、半导体存储器等等，根据需要安装在驱动器410上，以便于从其上读出的计算机程序根据需要被安装入存储部分408。
特别地，根据本发明的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本发明的实施例包括一种计算机程序产品，其包括有形地包含在机器可读介质上的计算机程序，上述计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分409从网络上被下载和安装，和/或从可拆卸介质411被安装。
在本发明一方面的应用上，本发明实施例中的CDN服务器群组的DDoS攻击防护系统可以是作为功能元件的形式内嵌于CDN服务器群组的中心服务器和CDN服务器中。
需要说明的是，在不冲突的情况下，本发明中的实施例及优选实施例中所涉及到的技术特征彼此之间可以相互组合；术语“包括”、“包含”，不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部 分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (9)

  1. 一种用于CDN服务器群组的DDoS攻击防护方法，所述CDN服务器群组包括多个CDN服务器和中心服务器，所述方法包括：
    每个CDN服务器将访问请求的访问源信息发送至所述中心服务器；
    所述中心服务器统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；
    所述中心服务器将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单；
    所述中心服务器将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器；
    所述多个CDN服务器对落入所述黑名单的访问源拒绝提供服务。
  2. 根据权利要求1所述的DDoS攻击防护方法，其特征在于，所述访问源信息包含IP、URL和/或Refer信息。
  3. 根据权利要求1或2所述的DDoS攻击防护方法，其特征在于，所述CDN服务器群组为布置在CDN平台上的根据网络类型的不同而划分的多个CDN服务器群组。
  4. 根据权利要求3所述的DDoS攻击防护方法，其中，所述多个CDN服务器群组中的任一个CDN服务器群组的中心服务器将黑名单下发至该CDN服务器群组中的多个CDN服务器之后，选择性地与其他CDN服务器群 组的中心服务器进行黑名单共享。
  5. 一种用于CDN服务器群组的DDoS攻击防护系统，所述CDN服务器群组包括多个CDN服务器和中心服务器，其中：
    每个CDN服务器包括：
    采集单元，用于采集访问请求的访问源信息；
    发送单元，用于将所述访问源信息发送至中心服务器；
    黑名单接收单元；
    服务控制单元，配置与所述黑名单接收单元关联，以对落入黑名单的访问源拒绝提供服务，
    所述中心服务器包括：
    统计单元，用于统计一段时间内每个CDN服务器下对应于同一访问源信息的访问请求的数量；
    黑名单生成单元，用于将每个CDN服务器下的对应于同一访问源信息的访问请求的数量大于预定阈值的访问请求确定为DDoS攻击，并相应地基于所述访问请求的访问源信息生成黑名单；
    下发单元，用于将所述黑名单下发至所述CDN服务器群组中的所述多个CDN服务器的黑名单接收单元。
  6. 根据权利要求5所述的DDoS攻击防护系统，其特征在于，所述采集单元为nginx模块。
  7. 根据权利要求6所述的DDoS攻击防护系统，其特征在于，所述访问 源信息包含IP、URL和/或Refer信息。
  8. 根据权利要求5-7中任一项所述的DDoS攻击防护系统，其中，所述CDN服务器群组为布置在CDN平台上的根据网络类型的不同而划分的多个CDN服务器群组。
  9. 根据权利要求8所述的DDoS攻击防护系统，其中，所述多个CDN服务器群组中的任一个CDN服务器群组的中心服务器配置成选择性地与其他CDN服务器群组的中心服务器进行黑名单共享。
PCT/CN2016/083250 2015-11-25 2016-05-25 用于CDN服务器群组的DDoS攻击防护方法及系统 WO2017088397A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/252,953 US20170149821A1 (en) 2015-11-25 2016-08-31 Method And System For Protection From DDoS Attack For CDN Server Group

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510828940.4A CN105897674A (zh) 2015-11-25 2015-11-25 用于CDN服务器群组的DDoS攻击防护方法及系统
CN201510828940.4 2015-11-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/252,953 Continuation US20170149821A1 (en) 2015-11-25 2016-08-31 Method And System For Protection From DDoS Attack For CDN Server Group

Publications (1)

Publication Number Publication Date
WO2017088397A1 true WO2017088397A1 (zh) 2017-06-01

Family

ID=57002825

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/083250 WO2017088397A1 (zh) 2015-11-25 2016-05-25 用于CDN服务器群组的DDoS攻击防护方法及系统

Country Status (2)

Country Link
CN (1) CN105897674A (zh)
WO (1) WO2017088397A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112825517A (zh) * 2019-11-21 2021-05-21 上海云盾信息技术有限公司 安全加速风控调度方法及设备
CN113765913A (zh) * 2021-09-02 2021-12-07 云宏信息科技股份有限公司 Tomcat服务器配置访问黑名单的方法、存储介质和Tomcat服务器

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106506547B (zh) * 2016-12-23 2020-07-10 北京奇虎科技有限公司 针对拒绝服务攻击的处理方法、waf、路由器及系统
CN108040039A (zh) * 2017-11-28 2018-05-15 深信服科技股份有限公司 一种识别攻击源信息的方法、装置、设备及系统
CN108322463A (zh) * 2018-01-31 2018-07-24 平安科技（深圳）有限公司 DDoS攻击检测方法、装置、计算机设备和存储介质
CN108471428B (zh) * 2018-06-27 2021-05-28 北京云端智度科技有限公司 应用于CDN系统内的DDoS攻击主动防御技术及装备
CN109361779A (zh) * 2018-10-22 2019-02-19 江苏满运软件科技有限公司 分布式系统中域名的管理方法及系统、节点服务器
CN111193692A (zh) * 2018-11-15 2020-05-22 北京金山云网络技术有限公司 请求响应方法、装置、边缘节点和鉴权系统
CN109617913B (zh) * 2019-01-15 2021-04-27 成都知道创宇信息技术有限公司 一种快速定位多用户共享节点DDoS攻击的管理方法
CN110365712A (zh) * 2019-08-22 2019-10-22 中国工商银行股份有限公司 一种分布式拒绝服务攻击的防御方法及系统
CN111181911B (zh) * 2019-08-23 2022-04-01 腾讯科技（深圳）有限公司 一种口令爆破攻击的防护方法、服务器、设备及介质
CN110535857B (zh) * 2019-08-29 2022-07-22 中国工商银行股份有限公司 防护网络攻击的方法和装置
CN112019533A (zh) * 2020-08-20 2020-12-01 紫光云(南京)数字技术有限公司 一种缓解CDN系统被DDoS攻击的方法及系统
CN116708013A (zh) * 2023-07-25 2023-09-05 深圳市锐速云计算有限公司 一种DDoS防护方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010064799A2 (en) * 2008-12-02 2010-06-10 Cdnetworks Co., Ltd. Countering against distributed denial-of-service (ddos) attack using content delivery network
CN102137111A (zh) * 2011-04-20 2011-07-27 北京蓝汛通信技术有限责任公司 一种防御cc攻击的方法、装置和内容分发网络服务器
CN103442018A (zh) * 2013-09-17 2013-12-11 网宿科技股份有限公司 Cc攻击的动态防御方法和系统
CN104065644A (zh) * 2014-05-28 2014-09-24 北京知道创宇信息技术有限公司 基于日志分析的cc攻击识别方法和设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7836295B2 (en) * 2002-07-29 2010-11-16 International Business Machines Corporation Method and apparatus for improving the resilience of content distribution networks to distributed denial of service attacks
CN102916959B (zh) * 2012-10-16 2015-05-06 百度在线网络技术（北京）有限公司 云环境中的黑名单同步方法和装置
CN103023924B (zh) * 2012-12-31 2015-10-14 网宿科技股份有限公司 基于内容分发网络的云分发平台的DDoS攻击防护方法和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010064799A2 (en) * 2008-12-02 2010-06-10 Cdnetworks Co., Ltd. Countering against distributed denial-of-service (ddos) attack using content delivery network
CN102137111A (zh) * 2011-04-20 2011-07-27 北京蓝汛通信技术有限责任公司 一种防御cc攻击的方法、装置和内容分发网络服务器
CN103442018A (zh) * 2013-09-17 2013-12-11 网宿科技股份有限公司 Cc攻击的动态防御方法和系统
CN104065644A (zh) * 2014-05-28 2014-09-24 北京知道创宇信息技术有限公司 基于日志分析的cc攻击识别方法和设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112825517A (zh) * 2019-11-21 2021-05-21 上海云盾信息技术有限公司 安全加速风控调度方法及设备
CN112825517B (zh) * 2019-11-21 2023-01-03 上海云盾信息技术有限公司 安全加速风控调度方法及设备
CN113765913A (zh) * 2021-09-02 2021-12-07 云宏信息科技股份有限公司 Tomcat服务器配置访问黑名单的方法、存储介质和Tomcat服务器

Also Published As

Publication number Publication date
CN105897674A (zh) 2016-08-24

Similar Documents

Publication Publication Date Title
WO2017088397A1 (zh) 用于CDN服务器群组的DDoS攻击防护方法及系统
US9794282B1 (en) Server with queuing layer mechanism for changing treatment of client connections
US7039721B1 (en) System and method for protecting internet protocol addresses
US20150067764A1 (en) Whitelist-based network switch
US20060230444A1 (en) Method and apparatus for traffic control of dynamic denial of service attacks within a communications network
EP2164228A1 (en) Hierarchical application of security services with a computer network
JP6937372B2 (ja) ホスト上のコンテキスト属性の収集と処理
US9462001B2 (en) Computer network access control
JP2005318578A (ja) ネットワーク増幅攻撃の軽減
CN105282169A (zh) 基于SDN控制器阈值的DDoS攻击预警方法及其系统
US20150150079A1 (en) Methods, systems and devices for network security
TWI492090B (zh) 分散式阻斷攻擊防護系統及其方法
KR101200906B1 (ko) 네트워크 기반 고성능 유해사이트 차단 시스템 및 방법
US20170149821A1 (en) Method And System For Protection From DDoS Attack For CDN Server Group
CN105187380A (zh) 一种安全访问方法及系统
US10771499B2 (en) Automatic handling of device group oversubscription using stateless upstream network devices
JP4550145B2 (ja) アクセス制御のための方法、装置、およびコンピュータ・プログラム
US10021070B2 (en) Method and apparatus for federated firewall security
CN110995586B (zh) 一种bgp报文的处理方法、装置、电子设备及存储介质
US11115435B2 (en) Local DDOS mitigation announcements in a telecommunications network
JP6310822B2 (ja) 仮想マシンのリソース管理システム、方法及びプログラム
CN110581843B (zh) 一种拟态Web网关多应用流量定向分配方法
TWM504990U (zh) 網路防護系統
CN116170389B (zh) 业务容器引流方法、系统及计算机集群
EP3016472B1 (en) User management device to select a broadband network gateway, method and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16867625

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16867625

Country of ref document: EP

Kind code of ref document: A1