Distributed denial of service attack detection method and detection device

Abstract

The invention provides a detection method for a distributed denial of service attack, which includes the steps of: counting the number of packets of the source IP address or the destination IP address received per unit time, and comparing the number of packets with the preset Threshold; when the number of messages is greater than the preset threshold, extract the fingerprint of one of the messages as a template fingerprint; determine whether a source IP address or a destination IP matching the template fingerprint is received within a subsequent unit of time Whether the number of packets of the address is greater than the threshold, if so, it is judged that it is under attack, otherwise it is judged that it is not under attack. The application of the invention can improve the response speed and detection performance while ensuring the detection accuracy.

Description

technical field [0001] The invention relates to the technical field of communications, in particular to a detection method and detection device for a distributed denial-of-service attack. Background technique [0002] One of the existing ways of remotely attacking the server through the network is Denial of Service attack (Denial of Service, DoS for short). The attacker sends a request with a false address to the server, and the server sends a reply message to the false address, and then the server keeps Wait for the required reply message. Denial of service attacks will occupy too many resources of the server, so that legitimate users cannot get the server's response. Because the processing capacity of the server is generally high, using a single computer to carry out DoS attacks often cannot achieve the desired effect, so there has been a distributed denial of service attack (Distributed Denial of Service, referred to as DDoS). The attacker first controls a large number ...

AI Technical Summary

Problems solved by technology

[0007] The accuracy of the first detection method is low, and the probability of accidental damage to normal messages is high;

[0008] In the second detection method, since the signature involves the reorganization of the transport layer and all protocols above it, as well as the matching of regular expressions, the response speed of this detection method is slow and the detection performance is poor.

The slow response speed means that after the attack, the business cannot work normally for a long time, and the loss is very large

However, the problem of poor detection performance leads to an increase in investment costs. To purchase more firewall equipment, the investment cost usually needs to be increased by more than ten times.

Images