Method and device for defending against cc attack

Abstract

The invention provides a method and device for defensing a CC (Challenge Collapsar) attack. The method comprises the steps of carrying out statistics on accumulated accessed quantity of a URL address in a preset statistic period, and accumulated access quantity of a source IP address in an HTTP request message to the URL address in the preset statistic period when the HTTP request message requesting to access the URL (Uniform Resource Locator) address is received, wherein the preset statistic period is not smaller than a preset lowest threshold value; and affirming that there is the CC attack, and discarding the HTTP request message when it is determined that the amplitude of the accumulated accessed quantity exceeding the maximum accessed quantity of the URL address in the corresponding time period satisfies a first fluctuation relationship, and the amplitude of the accumulated access quantity exceeding the maximum access quantity of the source IP address to the URL address in the corresponding time period satisfies a second fluctuation relationship. Through application of the method, the CC attack can be effectively avoided without participation of a user, and the user experience is not influenced.

Description

technical field [0001] The present application relates to the technical field of network communication, in particular to a method and device for defending against CC (Challenge Collapsar, challenge black hole) attacks. Background technique [0002] CC attack is a page-based DDoS (Distributed Denial of Service, distributed denial of service) attack. The principle of CC attack is: the attacking machine can use multiple proxy servers to send a large number of request packets to the target server, causing the target server to perform a large number of calculations, consuming a large amount of its own performance and resources, and affecting the experience of normal users. In the prior art, in order to defend against CC attacks, there are generally two solutions. Solution 1: When the security device receives the request message, it redirects the requested URL (UniformResource Locator, Uniform Resource Locator) address, and the redirection address carries a cookie value. When the...

AI Technical Summary

Problems solved by technology

[0003] However, both of the above two schemes require user participation, and the user needs to re-authenticate every once in a while, and can continue to visit the target page only after the re-authentication is passed, thereby affecting the user experience; Some mobile terminals do not support redirection technology and verification code technology, so that when users use these mobile terminals, they will not be able to access the target page normally, which affects the user experience

Images