Flow detection method and equipment in unidirectional flow detection mode

Abstract

The invention discloses a flow detection method and equipment in the unidirectional flow detection mode. The bidirectional flow can be detected under unidirectional flow environment according to the message sequence number and the acknowledgment number in the unidirectional flow, thereby providing analysis basis for effectively identifying attack occurrence under unidirectional flow environment. The technical scheme has simple implementation method and low cost, has no need for changing network topology and better improves the effect of preventing DDoS attack under unidirectional flow environment.

Description

Technical field [0001] The present invention relates to the field of communication technology, in particular to a flow detection method and equipment in a unidirectional flow detection mode. Background technique [0002] Distribution Denial of Service (DDoS) attacks generally have the characteristics of large attack traffic, multiple attack sources, difficult to filter, difficult to distinguish the authenticity of the attack source IP, and the attacker's indirect attack on identity concealment. [0003] At present, common attack detection modes include one-way flow detection and two-way flow detection. [0004] One-way flow detection only detects the traffic whose destination IP address is the protected IP, and does not detect the traffic sent by the protected IP. However, since this mode can only see the flow in one direction, it is difficult to determine whether an attack has occurred in some cases. [0005] The two-way flow detection detects the traffic sent to the protected IP an...

AI Technical Summary

Problems solved by technology

However, when the attack source IP is legal, this detection mechanism is difficult to work

[0013] An attacker can initiate a connection request to a protected Hypertext Transfer Protocol (HyperText Transfer Protocol, HTTP) server through a legal source IP, and recursively obtain all image or page resources on the HTTP server at a lower rate. Specifically, It can be easily implemented by writing page scripts, which may lead to a decrease in server processing performance, and cannot normally process legitimate user connection requests, resulting in DDoS attacks

[0014] It is difficult to effectively identify the above attack methods in a one-way flow environment. At this time, if the threshold packet loss is simply performed by limiting the flow rate and other methods, it will easily affect normal applications on the one hand, and may cause did not achieve the expected preventive effect

Images