Method and device for cleaning forged source IP in DDOS (Distributed Denial of Service) defense system

Abstract

The invention discloses a method and a device for cleaning a forged source IP in a DDOS (Distributed Denial of Service) defense system. The method comprises steps: a message flow with an access address to be a target server is detected; when the message flow exceeds a set threshold, a preset number of messages are intercepted from the flow as to-be-detected messages; the source IP address and the survival time value of one to-be-detected message are acquired, and according to the survival time value, the hop number when the to-be-detected message passes through a network node is calculated; and a hop set corresponding to the source IP address is queried in a local data sheet, when the hop number does not belong to the hop set, the to-be-detected message is discarded, and thus, the to-be-detected message can be prevented from arriving at the target server. Thus, the forged flow can be effectively and accurately cleaned.

Description

technical field [0001] The present invention relates to the technical field of network security, more specifically, to a method and device for cleaning counterfeit source IP in a DDOS defense system. Background technique [0002] Distributed Denial of Service (DDoS, Distributed Denial of Service) attack is that the attacker makes a large amount of network traffic flow to the attack target at the same time, causing network congestion, resource exhaustion or even downtime of the target host to achieve the purpose of denial of service on the target host. [0003] DDOS attacks are usually realized by various attack software and application software on botnets and proxy servers generating a large amount of traffic. In the attack, forging the source IP attack is a very common way, the reasons are as follows: (1) can avoid supervision and traceability; (2) avoid the response of the target host to the attack data to bring pressure on the attacking host; (3) through the forged source...

AI Technical Summary

Problems solved by technology

[0005] In the above DDOS defense process, if there are a large number of forged source IP attacks, the attack traffic will bypass the defense system or bring huge pressure to the defense system:

[0006] (1) If the fake source IP hits the whitelist, it may directly penetrate the DDOS defense system without being blocked;

[0007] (2) The attack characteristic of forging source IP is that there are many attack packets, but the number of packets belongi

Images