Distributed denial of service DDOS attack resisting method and device for firewall

Abstract

The invention discloses a DDOS attack resisting method and device for a firewall and is aimed to overcome the problem of the prior art that all the transmitted data packets should be performed with DDOS detection because the DDOS attack resisting service needs to locate at an on state all the time. The DDOS attack resisting method includes that detecting the current usage rate of the firewall CPU; judging whether the current usage rate is larger than a preset safe critical value of the CPU usage rate; when the current usage rate is larger than the safe critical value, starting the DDOS attack resisting service; when the current usage rate is smaller than or equal to the safe critical value, closing the DDOS attack resisting service. By means of the DDOS attack resisting method, the DDOS attack resisting service is not started until there is DDOS attack threat, and the data transmitting speed rate is effectively guaranteed based on preventing the DDOS attack.

Description

technical field [0001] The invention belongs to the technical field of network communication security, and in particular relates to a method and a device for a firewall to resist distributed denial of service (Distributed Denial Of Service, DDOS) attacks. Background technique [0002] Denial of Service (Denial Of Service, DOS) attack is one of the most threatening attacks in the current network. DOS attacks mainly use malicious means to make the CPU of the target server fully loaded, exhausting the resources of the server, so that users cannot achieve normal access to the server. Distributed Denial of Service (Distributed Denial Of Service, DDOS) attack refers to the use of client / server technology to combine multiple computers as an attack platform to launch attacks on one or more targets, thereby multiplying the power of DOS attacks. [0003] At present, most firewall devices provide anti-DDOS attack services. In order to prevent DDOS attacks, firewall devices generally e...

AI Technical Summary

Problems solved by technology

However, if the firewall has been turned on the anti-DDOS attack service, it is necessary to perform attack detection on all data packets passing through the firewall. This increases the detection burden of the firewall, which leads to a decrease in the rate of forwarding data packets by the firewall and reduces the performance of the firewall.

Images