DDoS(Distributed Denial of Service)attack defensive system for application layer based on multiple feature recognition

Abstract

The invention discloses a DDoS(Distributed Denial of Service) attack defensive system for an application layer based on multiple feature recognition. When a user initiates a request, the system stores information of a user data packet in a net-node network flow table, analyzes the user data packet, and judges whether the source of the user data packet is real and reliable or not; verification data is inserted when data is returned to the user; whether the source is real and reliable or not is detected again; afterthe fact that the source is real is determined, the credibility of the user is a threshold value credibility; the system distributes a cookie identity identifier to the source; then, a data database for recording the cookie identity identifier is established; access information of the cookie identity identifier within a certain time period is recorded and stored; the access information is used as the basis of identity verification management; and corresponding dispatching is carried out through analysis and treatment of a feature library. According to the invention, whether the long-term access behaviour of the user is normal or illegal can be analyzed and judged by establishing a blacklist and a whitelist ofaccess feature detection analysis; and the normal flow of the user cannot be intercepted when a DDoS attack occurs.

Description

technical field [0001] The invention relates to a comprehensive DDoS defense algorithm, in particular to an application layer DDoS attack defense system based on multiple feature recognition. Background technique [0002] The detection mechanism of the traditional firewall is relatively simple, and the attack detection ability of the upper layer protocol is insufficient, and it cannot prevent the attack from the application layer. Its computing resources are limited, the detection depth is insufficient, and the detection efficiency is slow. Diversified, fully simulating the access of normal browsers and real business users, which cannot be detected by traditional firewalls, so it will become a network bottleneck. [0003] With the complex and changeable characteristics of Internet applications, more complex attack methods are derived, and users can only upgrade with manufacturers; the traditional firewall interception strategy still adopts a relatively crude one-size-fits-al...

AI Technical Summary

Problems solved by technology

[0002] The detection mechanism of the traditional firewall is relatively simple, and the attack detection ability of the upper layer protocol is insufficient, and it cannot prevent the attack from the application layer. Its computing resources are limited, the detection depth is insufficient, and the detection efficiency is slow. Diversified, fully simulating normal browser access by real business users, which cannot be detected by traditional firewalls, so it will become a network bottleneck

[0003] With the complex and changeable characteristics of Internet applications, more complex attack methods are derived, and users can only upgrade with manufacturers; the traditional firewall interception strategy still adopts a relatively crude one-size-fits-all approach or an isolation network mechanism, such as attached figure 2 As shown, there is a serious deficiency in the detection and analysis of upper-layer traffic, the false positive rate is too high, and the normal access of users is often filtered and intercepted, and users are interrupted, which is unacceptable to enterprises and users.

Images