Device and method for defending prepositioned reconfigurable DDoS (distributed denial of service) attack

Abstract

The invention relates to a device and method for defending prepositioned reconfigurable DDoS (distributed denial of service) attack. The device comprises an access module which is connected to an external network and is used for receiving the dataflow from the network, wherein the access module is respectively connected to a detection module and a processing module; the detection module is connected to a control module; the control module is connected to the output port of a TCP (transmission control protocol) state monitoring module; the input port of the TCP state monitoring module is used for receiving the state information of an IP (internet protocol) protocol stack processing element; the TCP state monitoring module is used for monitoring the state of the IP protocol stack, so as to judge whether DDoS attack occurs and determine the degree of the attack; the processing module is respectively connected to the control module and the access module; the output port of the processing module is used for sending a processed packet to the IP protocol stack and the various-level DDoS defending function is achieved according to an instruction of the control module; and corresponding detecting and defending strategies are configured according to the classification of DDoS attack, thereby realizing the accurate efficient defense.

Description

technical field [0001] The invention relates to a computer network security technology, in particular to a pre-reconfigurable DDoS attack defense device and method for DDoS attacks. Background technique [0002] Denial of service attack (DoS) means that the attacker deliberately causes the computer or network to fail to operate normally through some means, so that the required service cannot be provided to legitimate users or the service quality is reduced. There are many types of DoS attacks. The most basic DoS attack is to use reasonable service requests to occupy too many service resources, so that the server cannot process the instructions of legitimate users. A single DoS attack generally adopts a one-to-one method, and its effect is obvious when the performance indicators such as low CPU speed, small memory or small network bandwidth of the attacked target are not high. With the development of computer and network technology, the processing power of the computer has i...

AI Technical Summary

Problems solved by technology

[0009] Aiming at the problem that existing mechanisms are difficult to effectively defend against various DDoS attacks, the present invention provides a pre-reconfigurable DDoS attack defense device and method, which configures corresponding detection and defense strategies according to DDoS attack types to achieve accurate and efficient protection

Images