A method and system for shunting reflective ddos ​​traffic

Abstract

A method for shunting reflective DDOS traffic, comprising: acquiring and detecting the data flow of a network node A, obtaining an attack source SIP and an attack type set T; sending the attack source SIP and attack type T to a drainage device; the drainage The device sends all requests of the attack type set T to the attack source SIP; the attack traffic sent by the attack source SIP is diverted to network node B, and the attack traffic of type T generated by the attack type set T is cleaned , normal flow is reinjected. A system for shunting reflective DDOS traffic, including detection equipment, drainage equipment and cleaning equipment, wherein the attack source SIP is the IP of the basic server used by hackers; the invention actively sends requests to the basic server used to drain and Attract the traffic of the basic server, reduce the number of processed attack requests sent by the attacker to the basic server, and then indirectly reduce the traffic sent by the basic server to the attacked target.

Description

technical field [0001] The invention relates to network technology, in particular to a method and system for diverting reflective DDOS traffic. Background technique [0002] At present, whether it is to deal with ordinary DDOS attacks or reflective DDOS attacks, traffic cleaning equipment is deployed in front of the protected end, and the method of active detection and passive pulling and cleaning is used. This method has a very big defect, that is, once the traffic has formed , to the transmission link at the protected end, cleaning can only play a considerable role. If the traffic is not enough to congest the transmission, this cleaning method is still relatively effective, but once the traffic is large enough to congest the transmission, this The effect of this cleaning solution is quite limited, and the reflective DDOS attack traffic can generally reach tens of Gbps or more, and general data centers and small operators may not have sufficient bandwidth to transmit Such ...

AI Technical Summary

Problems solved by technology

[0002] At present, whether it is to deal with ordinary DDOS attacks or reflective DDOS attacks, traffic cleaning equipment is deployed in front of the protected end, and the method of active detection and passive pulling and cleaning is used. This method has a very big defect, that is, once the traffic has formed , to the transmission link at the protected end, cleaning can only play a considerable role. If the traffic is not enough to congest the transmission, this cleaning method is still relatively effective, but once the traffic is large enough to congest the transmission, this The effect of this cleaning solution is quite limited, and the reflective DDOS attack traffic can generally reach tens of Gbps or more, and general data centers and small operators may not have sufficient bandwidth to transmit such a huge traffic

[0003] There is also a relatively new cleaning solution. Cleaning devices are deployed at the transmission source of each network to clean the attack traffic sent by each source. This method of cleaning the source can clean the attack traffic at the point where it is sent. It has a very obvious effect on preventing the formation of large attack traffic, but it also has a big disadvantage. The deployment cost of this cleaning method is very high, and the complexity of network construction is relatively large.

Images