Method for defensing transmission control protocol synchronous flooding attack and transmission control protocol agent

Abstract

The invention discloses a method for defensing a transmission control protocol synchronous flooding attack and a transmission control protocol agent. The method comprises that: FPGA on a TCP agent and a client perform TCP three-way handshake to verify the legality of the client; after the client passes the legality verification, a software module on the TCP agent begins establishing TCP connection between the client and a server, and transmits a session table to the FPGA; and the FPGA forwards data messages interacted between the client and the server according to the session table. The method improves the effect of defensing the TCP synchronous flooding attack.

Description

technical field [0001] The invention relates to the technical field of synchronous flooding attacks, in particular to a method for defending against transmission control protocol (TCP, Transferring Control Protocol) synchronous flooding attacks and a TCP agent. Background technique [0002] Denial of Service (DoS, Denial of Service) attack is a common security threat faced by the network at present. This attack uses a large number of data packets to attack the target system and consumes the target system resources to prevent legitimate users from using network services normally. The main DoS attacks include synchronous flooding (SYNFlood), Fraggle, etc., and the most typical and frequently used DoS attack is the SYN Flood attack. [0003] SYN Flood attacks use the asymmetric relationship between the server and the client in the Transmission Control Protocol (TCP) connection to allocate TCB resources, aiming at the server system that does not limit connection requests, making...

AI Technical Summary

Problems solved by technology

All SYN packets will be sent to the CPU and processed by the software TCP agent. It is also implemented by software to verify whether the client’s request is a SYN Flood attack. SYN Flood attack packets will occupy CPU resources. When the SYN Flood attack packets are fast enough , most of the CPU resources are occupied by attack packets, affecting normal packet forwarding, affecting the establishment of normal connections, and the effect of preventing SYN Flood attacks is not good enough

[0026] In addition, in the two-way proxy mode, the TCP proxy processes 4 more messages, and it takes longer to establish a TCP connection, which affects the speed of establishing a normal connection.

Images