Indirect distributed denial of service attack defense method and system based on Web agency

Abstract

The invention relates to an indirect distributed denial of service attack defense method and an indirect distributed denial of service attack defense system based on a Web agency. A behavior characteristic of a proxy-to-server network flow is described by extracting the space-time local property of the proxy-to-server network flow; the interference of a small-probability large value on an available signal is restrained by a nonlinear mapping function; a normal behavior model of the proxy-to-server network is constructed through a hidden semi-markov model (HsMM); normal degree estimation, namely long-time behavior estimation and short-time behavior estimation, under different time scales is performed by using behavior indexes acquired by the model; as to an abnormal behavior sequence (HTTP request sequence), an attack response is implemented by adopting a soft control method; and the basis of the soft control represents an HsMM model parameter and a structure index which are used for performing a normal behavior. The parameter for describing the proxy-to-server network is the space-time local property which is irrelevant to the change of the Web content on a target server; and the detection property of the method is the nature property based on the agent network flow and irrelevant to the size of the attack flow. By the method, the attack response can be realized before the resources of the target server are used by the attack flow, so that early detection can be realized effectively.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a Web proxy-based indirect distributed denial-of-service attack defense method and system. Background technique [0002] Distributed Denial of Service (DDoS) attack is a constantly evolving attack method. [0003] The invention provides an effective server-side defense method for a novel DDoS attack mode. This new type of DDoS attack that the present invention pays attention to is different from the traditional direct attack behavior, and it adopts the Web proxy widely distributed on the Internet as the springboard of the attack. Because this attack method utilizes the characteristics of the HTTP protocol to achieve the purpose of supply, in this invention, we call this type of attack "DDoS attack based on Web proxy". [0004] Such as figure 1 As shown, the DDoS attack mode based on Web proxy includes the following two steps: (1) The attacker generates HTTP reque...

AI Technical Summary

Problems solved by technology

[0006] Second, because the existing Internet lacks an effective cooperation mechanism, it is difficult for the victim server to rely on the security settings of the intermediate Web proxy to avoid being attacked

These proxy servers can be abused by attackers

[0007] Third, for the server at the victim end, this type of attack is difficult to be discovered and filtered by the existing DDoS defense system

However, due to the existence of a large number of web proxies (including official and unofficial ones) in the Internet, the victim server cannot establish a cooperative relationship with these servers one by one

Images