Flow detection method and equipment in unidirectional flow detection mode

Abstract

The invention discloses a flow detection method and equipment in the unidirectional flow detection mode. The bidirectional flow can be detected under unidirectional flow environment according to the message sequence number and the acknowledgment number in the unidirectional flow, thereby providing analysis basis for effectively identifying attack occurrence under unidirectional flow environment. The technical scheme has simple implementation method and low cost, has no need for changing network topology and better improves the effect of preventing DDoS attack under unidirectional flow environment.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a flow detection method and equipment in a unidirectional flow detection mode. Background technique [0002] Distributed denial of service attack (Distribution Denial of Service, DDoS) generally has the characteristics of large attack traffic, many attack sources, difficult to filter, difficult to distinguish the true and false attack source IP, and concealment of attacker's indirect attack identity. [0003] Currently, there are two common attack detection modes: unidirectional flow detection and bidirectional flow detection. [0004] Unidirectional flow detection only detects the traffic whose destination IP address is the protected IP, and does not detect the traffic sent by the protected IP. But because this mode can only see the flow in one direction, it is difficult to judge whether there is an attack in some cases. [0005] Bi-directional flow detection detects bo...

AI Technical Summary

Problems solved by technology

However, when the attack source IP is legal, this detection mechanism is difficult to work

[0013] An attacker can initiate a connection request to a protected Hypertext Transfer Protocol (HyperText Transfer Protocol, HTTP) server through a legal source IP, and recursively obtain all image or page resources on the HTTP server at a lower rate. Specifically, It can be easily implemented by writing page scripts, which may lead to a decrease in server processing performance, and cannot normally process legitimate user connection requests, resulting in DDoS attacks

[0014] It is difficult to effectively identify the above attack methods in a one-way flow environment. At this time, if the threshold packet loss is simply performed by limiting the flow rate and other methods, it will easily affect normal applications on the one hand, and may cause did not achieve the expected preventive effect

Images