Method for identifying DDoS (distributed denial of service) attack flow

Abstract

The invention discloses a method for identifying DDoS (distributed denial of service) attack flow. In the method, a distributed three-level architecture is adopted. The method comprises: carrying out source-end host detection until achieving the number change of arrival target address packets by setting an aggregation tree server in each autonomous system; once a suspicious situation is found, sending an alarm packet to a router connected with the source-end host; detecting whether attack or attack spreading exists, simultaneously determining the number of attacked hosts according to the number of received local alarm packets, and sending the alarm packet containing a weight as the number of hosts to the local aggregation tree server after the attack is detected; constructing a weighted aggregation tree sub-tree by each aggregation tree server according to the alarm packet; and constructing the whole weighted aggregation domain-tree by the suffered-terminal aggregation tree server to identify DDoS attack flow according to set conditions. The experiments show that by utilizing the method, the processing and storage cost of the DDoS attack suffered-terminal can be greatly reduced, and the attack situation of the source-end host connected with the router end is also considered at the router end, therefore, a large amount of undetected attacks due to fewer router can be prevented.

Description

technical field [0001] The invention belongs to the field of network information security, and in particular relates to a distributed DDoS attack flow identification method based on an aggregation tree structure. Background technique [0002] DDoS attacks usually use hundreds or even thousands of distributed hosts to attack single or multiple targets concurrently, consuming the resources of the target host or the target network, thereby interfering or completely preventing services for legitimate users. DDoS attacks are easy to launch and difficult to track, leading to the widespread occurrence of DDoS attacks and becoming a serious threat on the Internet. The economic losses caused by them rank second among the losses caused by various network security problems. Second to the number one computer virus. [0003] The defense against DDoS attacks in the current environment can be broadly divided into: pre-event defense methods based on DDoS detection, mid-event defense method...

AI Technical Summary

Problems solved by technology

[0013] Most of these defense methods are deployed on the victim end, because on the network nodes close to the victim end, the attack data traffic is very large, and DDoS can still block the network outside the defense system or even the defense system itself, so the deployment of the victim end cannot realize the protection against DDoS attacks Effective Defense and Quick Response

Images