Method and system for monitoring DDOS (distributed denial of service) attacks in small flow

Abstract

The invention discloses a method and a system for monitoring DDOS (distributed denial of service) attacks in small flow, solves the problems that the existing DDOS attack detection technology is high in cost, complex to implement and high in misjudgment rate, cannot respond to DDOS attacks aiming at an application layer and the like, and provides the monitoring scheme of an integrated DPI (dots per inch) technology. A baseline analysis, component analysis and similarity analysis method is used to establish a normal use model, characteristics are accurately matched to detect the attacks in small flow and the application layer attacks, deployment at one point of an operator network and complete coverage of the operator network are achieved, and detection accuracy is increased.

Description

technical field

[0001] The invention belongs to the technical field of mobile Internet security, and in particular relates to a method and a system for monitoring small flow DDOS attacks. Background technique

[0002] Distributed denial of service attack (distributed denial of service attack, referred to as DDOS) is to attack the target system at the same time by controlling multiple machines with relatively weak security defenses on the Internet, causing the victim host system or network to be overloaded and unable to receive or respond to external requests in a timely manner. , so as to achieve the purpose of denial of service attack.

[0003] Generally, on broadband networks, the specific form of DDOS attack is to create high-flow useless data, causing network congestion and interrupting network services. At present, most of the websites on the Internet are hosts with high bandwidth. In principle, it is almost impossible to cause any blockage simply by directly sending p...

Examples

Embodiment Construction

[0029] The present invention performs baseline analysis, component analysis, and traffic similarity analysis, and once a threshold alarm occurs after matching the above three models, it is determined that a DDOS attack has occurred. After a DDOS attack occurs, AAA can also perform PPP disconnection on the mobile terminal with the corresponding IMSI number according to the source address, so as to prevent the attack in a timely and effective manner and release the resources on the wireless side. A detailed description will be given below in conjunction with the accompanying drawings.

[0030] figure 1 It is a schematic structural diagram of a system for monitoring small traffic DDOS attacks in the present invention, and the DDOS monitoring system is deployed at the egress of a metropolitan area network.

[0031] The specific structure of the system is as follows figure 2 Shown, including baseline analysis filter, component analysis filter and similarity analysis filter. in:...

technical field

[0001] The invention belongs to the technical field of mobile Internet security, and in particular relates to a method and a system for monitoring small flow DDOS attacks. Background technique

[0002] Distributed denial of service attack (distributed denial of service attack, referred to as DDOS) is to attack the target system at the same time by controlling multiple machines with relatively weak security defenses on the Internet, causing the victim host system or network to be overloaded and unable to receive or respond to external requests in a timely manner. , so as to achieve the purpose of denial of service attack.

[0003] Generally, on broadband networks, the specific form of DDOS attack is to create high-flow useless data, causing network congestion and interrupting network services. At present, most of the websites on the Internet are hosts with high bandwidth. In principle, it is almost impossible to cause any blockage simply by directly sending p...

Examples

Embodiment Construction

[0029] The present invention performs baseline analysis, component analysis, and traffic similarity analysis, and once a threshold alarm occurs after matching the above three models, it is determined that a DDOS attack has occurred. After a DDOS attack occurs, AAA can also perform PPP disconnection on the mobile terminal with the corresponding IMSI number according to the source address, so as to prevent the attack in a timely and effective manner and release the resources on the wireless side. A detailed description will be given below in conjunction with the accompanying drawings.

[0030] figure 1 It is a schematic structural diagram of a system for monitoring small traffic DDOS attacks in the present invention, and the DDOS monitoring system is deployed at the egress of a metropolitan area network.

[0031] The specific structure of the system is as follows figure 2 Shown, including baseline analysis filter, component analysis filter and similarity analysis filter. in:...

Images