CC (challenge collapsar) attack defending method, device and system

Abstract

The invention provides a CC (challenge collapsar) attack defending method for a reverse proxy server; the method includes: first, receiving an access request to access a target server sent by a client; second, making a statistic of access characteristic data of the client for the target server according to the access request; third, detecting whether the access characteristic data is normal or not by using preset attack detection rules; forth, judging whether the client is a CC attack client or not according to the detection results, and if not, forwarding the access request to the target server. Since the client and the target server are isolated by using the reverse proxy server and the target server is completely concealed out of a range of attack power of the CC attack client, good defense is provided; meanwhile, the method is executed by the reverse proxy server, no system resource of the target server is used, and it possible to ensure that the target server never experiences reduced system resources and reduced operation efficiency due to CC attack defending.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for defending against CC attacks, a device for defending against CC attacks and a device for defending against CC attacks. Background technique [0002] CC (Challenge Collapsar, literally translated as a challenge black hole, but usually directly expressed as a CC attack) attack is a DDoS (Distributed Denial of Service, distributed denial of service) attack on the application layer with the website page as the main attack target. The principle of CC attack It is the attacker who controls some hosts to continuously send a large number of data packets to the target server, causing the server resources to be exhausted and unable to continue normal services until it crashes. CC attack simulates that a large number of users keep visiting pages that consume a lot of server resources, exhausting server resources, making the server CPU at 100% for a long time, and there...

AI Technical Summary

Problems solved by technology

[0002] CC (Challenge Collapsar, literally translated as a challenge black hole, but usually directly expressed as a CC attack) attack is a DDoS (Distributed Denial of Service, distributed denial of service) attack on the application layer with the website page as the main attack target. The principle of CC attack It is the attacker who controls some hosts to continuously send a large number of data packets to the target server, causing the server resources to be exhausted and unable to continue normal services until it crashes

CC attack simulates that a large number of users keep visiting pages that consume a lot of server resources, exhausting server resources, making the server CPU at 100% for a long time, and there will always be endless requests, which makes the server unable to serve normal requests

[0003] CC attacks are highly camouflaged, and their access behavior simulates the characteristics of normal user access. A small number of zombie machines can cause the performance of the target server to be paralyzed and block normal user access. Therefore, CC attacks are difficult to detect. Traditional security defense methods Cannot effectively defend against CC attacks

Images