Method and device for detecting and disposing abnormal traffic attack

Abstract

The invention provides a method for detecting and disposing an abnormal traffic attack, comprising the following steps: 1) filtering known abnormal traffic and normal traffic of a visitor IP address; 2) according to a current traffic numerical value of the traffic passing the filtration of the visitor IP address and a corresponding traffic template numerical value in a TOPN dynamic filtering table, distinguishing the abnormal traffic and the normal traffic passing the filtration in the visitor IP address; 3) discarding the abnormal traffic, and forwarding the normal traffic. The invention also provides a device for detecting and disposing the abnormal traffic attack, comprising a traffic receiving unit, a static filtering unit, a dynamic detection filtering unit and a self-learning unit connected orderly, wherein the dynamic detection filtering unit is connected with an operation and deciding unit and the self-learning unit. The method and the device provided by the invention can improve disposal efficiency and detection accuracy for abnormal behaviors, and can quickly detect and dispose the abnormal attack traffic without influencing normal traffic access.

Description

technical field [0001] The invention relates to a network attack detection and protection technology, in particular to a method and device for detecting and handling abnormal flow attacks of low-flow application-type DDOS. Background technique [0002] With the rapid development of Internet technology, there are more and more attacks using the Internet. Among them, distributed denial of service (DDOS) attack is a common attack method, and its common feature is the use of protocol loopholes, and through many The fake "zombie host" sends a large number of seemingly legitimate network packets to the victimized target host, resulting in network congestion or resource exhaustion of the target server, resulting in service unavailability. There are many means and manifestations of DDOS attacks, which are mainly divided into traffic type and application type. Among them, traffic type DDOS attacks (TCPFlood for transmission control protocol, UDPFlood for user datagram protocol, ICMPF...

AI Technical Summary

Problems solved by technology

[0004] At present, there are few abnormal traffic detection technologies for application-type DDOS attacks and the implementation is complex, which has one or more shortcomings: the detection and defense attacks based on traffic FLOW statistics are not accurate enough, and cannot penetrate into the application protocol itself ; Only for single IP attack detection and filtering method, it will be seriously ineffective in a large number of new forged visiting IPs; the currently commonly used detection and filtering method for judging abnormal attacks purely for IP traffic area will not work in normal application behaviors with large traffic (such as DNS query, WEB access, etc.) exist, the method of increasing false positives will fail; while the behavior recognition method for DNS server query logs requires additional information exchanged with the DNS server, which is inconvenient to implement and deploy, and is not real-time enough

Images