Method and device for defending network attack, and router

Abstract

The embodiment of the invention discloses a method and device for defending network attack, and a router. The method comprises the steps of: carrying out local attack detection and filtration on flow of a distributed port board by the distributed port board, carrying out mode statistic analysis based on three- to seven-layer application or content and reporting statistic information for a service board; and carrying out global attack judgment and management on the statistic information reported by the distributed port board by the service board. Therefore, attack detection and defense effects, especially attack to an application layer, can be better achieved.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, device and router for protecting against network attacks. Background technique [0002] With the continuous enrichment of various network applications, network security has become an increasingly urgent need. As attackers use more advanced technical means and more advanced equipment, the attack behavior is more concealed and the attack capability is stronger. Traditional firewall equipment has been Gradually difficult to meet the requirements. In recent years, attacks on application layer (such as games) protocols, DDoS attacks using botnets, and super-large traffic attacks (sending super-large traffic to occupy network and server bandwidth) have become the main forms of attacks. However, it cannot effectively protect against such attacks. [0003] The integrated firewall and anti-DDoS feature of the router can better prevent such large-scale attacks, and can s...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the present invention, the inventor found that there are at least the following problems in the prior art: due to the limitation of the processing capacity of the service single board, it cannot satisfy the processing of the traffic of multiple forwarding single boards, and it is difficult to carry out comprehensive distribution in the network. Department, so can not really meet customer requirements

In the prior art, the method of pattern statistical analysis to identify DDoS attack traffic also has many defects in the analysis statistics, which cannot more accurately discover the attack behavior of specific applications or content

Images