Large-scale DDoS (Distributed Denial of Service) attack defense system and method based on two-level linkage mechanism

Abstract

The invention discloses large-scale DDoS (Distributed Denial of Service) attack defense system and method based on a two-level linkage mechanism. The method comprises the following steps of: monitoring the flow of a total network by a flow monitoring subsystem in real time, and searching and confirming a DDoS attack behavior; sending an alarm message for triggering a cleaning operation to a flow cleaning subsystem, and guiding the abnormal flow of the DDoS attach behavior to the flow cleaning subsystem; receiving the abnormal flow guided by the flow monitoring subsystem by the flow cleaning subsystem, cleaning the abnormal flow according to the cleaning operation triggered by the alarm message, (wherein the flow cleaning subsystem adopts the two-level architecture of a backbone network plus a local network defense system, and the two levels of cleaning system work cooperatively and clean synchronously), and injecting the cleaned cleaning flow back to a target customer network. The large-scale DDoS attack defense system and method based on the two-level linkage mechanism solve the problems of cleaning capacity, cleaning precision, and the like existing in the traditional DDoS defense technology; and on the basis of reducing the deployment cost of service scale, the large-scale DDoS attach defense capability of the total network is greatly improved, and the cleaning precision ofthe attack flow is increased.

Description

technical field [0001] The invention relates to the field of network security, in particular to a large-scale DDoS attack defense system and method based on a two-level linkage mechanism. Background technique [0002] With the continuous improvement of the informatization level of various industries, the normal business operations of more and more enterprise users are increasingly dependent on the Internet. At present, due to the deteriorating Internet network security environment, the Internet business of such customers is facing great threats and risks. [0003] Among them, Distributed Denial of Service (DDoS, Distributed Denial of Service) attack is one of the most common and most harmful attack forms existing in the Internet at present. DDoS attack refers to the use of client / server technology to combine multiple computers as an attack platform to launch a DoS attack on one or more targets. DDoS attacks are becoming more and more common attack methods due to their simp...

AI Technical Summary

Problems solved by technology

However, since this mechanism is mainly for cleaning at the backbone network level, it is difficult to defend against internal mutual attacks such as the MAN and Internet Data Center (IDC, Internet Data Center). At the same time, due to the high deployment level of the cleaning system, it is difficult to deploy refined protection strategy; the above two factors may cause some attack traffic to avoid the protection system, making it difficult to provide customers with refined DDoS attack protection

Images