Method and device for automatic defense distributed denial of service attack of firewall

Abstract

Embodiments of the invention disclose a method and a device for automatic defense distributed denial of service attack of a firewall. The method comprises: performing FLOW analysis on data traffic passing through and reaching a firewall device; according to the result of the FLOW analysis, if the result is detected to conform to attack characteristics of a certain distributed denial of service (DDOS) attack type, and the data traffic conforming the attack characteristics is DDOS attack flow, according to correspondence between DDOS attack types and protection security strategy arranged in advance, automatically generating protection security strategy holding up DDOS attack flow, and configuring the generated protection security strategy on the firewall device; and responding to disappearing of the attack characteristics which conform to a certain DDOS attack type, deleting the protection security strategy from the firewall device, the strategy holds up the DDOS attack flow. The method does not need to configure the protection security strategy in a safety regulation base of the firewall device in advance, and automatic defense of DDOS attack can be realized on a universal firewall device.

Description

technical field [0001] The invention relates to network and information security technology, in particular to a method and device for a firewall to automatically defend against distributed denial of service (Distributed Denial of Service, DDOS) attacks. Background technique [0002] At present, the security rules of firewall devices are usually issued by administrators who are familiar with the network environment and devices. When the firewall is in the state of allowing traffic, and when a DDOS attack occurs and there is no matching entry in the security rule base to prevent the DDOS attack, DDOS attacks can successfully pass through firewall devices. At present, the firewall device has certain protection capabilities against common DDOS attacks, but it is necessary to configure security policies and rules in the security rule base of the firewall device in advance. The more policies and rules are configured, the higher the resource usage of the firewall device will be. ....

AI Technical Summary

Problems solved by technology

At present, the firewall device has certain protection capabilities against common DDOS attacks, but it is necessary to configure security policies and rules in the security rule base of the firewall device in advance. The more policies and rules are configured, the higher the resource usage of the firewall device will be.

The defense against DDOS attacks can also be completed through the abnormal traffic cleaning center, but the cost of this technology is relatively high

Images