Reflection attack defending method, device and system

Abstract

The invention discloses a reflection attack defending method, device and system. The method comprises the steps of receiving a response message; searching, according to the response message, whether a session matched with the response message exists; and determining, based on a searching result, whether the response message is an attack message. In the prior art, when deployment is carried out at a bypath of a cleaning device, the existing reflection attack defending method has the defects of package leakage and killing mistakes. Through adoption of the reflection attack defending method, device and system, the technical problems in the prior art are solved.

Description

technical field [0001] The invention relates to the field of Internet security, in particular to a method, device and system for defending reflection attacks. Background technique [0002] DNS reflection attack has become the mainstream DDoS attack type in the current network, such as figure 1 As shown, the principle is that the attacker uses a large number of zombie hosts controlled by the attacker to send DNS requests to many open DNS servers in the Internet, but the source IP address in the request is the IP of the victim, so with the help of the rebound of the open DNS server, a DNS reflection attack. Due to the characteristics of easy implementation, large traffic, and difficult to track, DNS reflection attacks have become the preferred means of launching large traffic attacks, which bring great harm to user services and their networks. Therefore, effective methods are needed to defend and clean DNS reflection attacks, so as to alleviate the impact on services or netw...

AI Technical Summary

Problems solved by technology

However, there are several problems with in-line deployment: first, deployment is difficult, and redundancy needs to be considered to avoid introducing a single point of failure; second, deployment costs are high, and in-line deployment requires that the processing capacity of the cleaning device and the link bandwidth exactly match , thus increasing the user's cost; third, the deployment scenarios are limited, such as MAN protection and other situations where the entire network traffic needs to be protected, and direct deployment cannot be achieved

At the same time, the session check itself also needs to be enhanced for DNS reflection. The current session information only records quintuple information, and cannot check the unique information of DNS packets.

[0005] Since the session inspection method needs to deploy the cleaning device directly, when the cleaning device is deployed in a bypass, this method will leak packets or kill by mistake, and cannot effectively defend against DNS reflection attacks

[0006] Aiming at the scenario where the existing technology is deployed in the bypass of the cleaning device, the current technology has the problems of packet leakage and manslaughter in the process of defending against reflection attacks, and no effective solution has been proposed so far

Images