Method and system for actively defending distributed denial of service attacks

Abstract

The invention discloses a method and system for actively defending distributed denial of service attacks; wherein an abnormal traffic monitoring device monitors the DDoS (distributed denial of service) attacks appearing in a network, generates a real-time attack list and sends the attack list to a centralized analysis platform; wherein the real-time attack list comprises the IP (Internet Protocol) addresses of DDoS attack sources; a DPI (Deep Packet Inspection) device tracks Botnets, generates a Botnet history list and sends the history list to the centralized analysis platform; wherein the Botnet history list comprises Botnet identifiers and Botnet controlled end IP addresses associated with the Botnet identifiers; the centralized analysis platform determines the Botnets to which the DDoS attack sources belong according to the real-time attack list and the Botnet history list; and the DDoS attacks from the Botnets are warned early, thus actively defending the DDoS attacks. According to the method and the system, the Botnets to which the DDoS attack sources belong can be located rapidly and accurately, thus actively defending the DDoS attacks.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a method and system for actively defending against distributed denial-of-service attacks. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, referred to as: DDoS) attack is a common attack method on the Internet. Hackers use multiple puppet machines to send a large number of "legal" requests to the attack target, resulting in network congestion or server resource exhaustion and denial of service. . [0003] At present, methods for defending against DDoS attacks mainly include traffic restriction technology and traffic sampling and analysis technology. These two methods have the problems of slow response and high cost of traceability. Only when a large-scale DDoS attack occurs, can we discover and take defensive measures, which is a passive defense; at the same time, since the source IP (Internet Protocol, the protocol for inter...

AI Technical Summary

Problems solved by technology

These two methods have the problems of slow response and high cost of traceability

Only when a large-scale DDoS attack occurs, can we discover and take defensive measures, which is a passive defense; at the same time, because the source IP (Internet Protocol, the protocol for interconnection between networks) addresses of the attack data packets are usually forged, sending attack data packets The host is usually a puppet machine, so it is difficult to achieve real traceability by analyzing attack data packets

Images