Method for identifying DDoS (Distributed Denial of Service) reflection amplification attack

Abstract

The invention discloses a method for identifying a DDoS (Distributed Denial of Service) reflection amplification attack. The method comprises the steps of extracting a source IP address and a TTL value in an IP head of a message after an amplifier receives a request message; judging extracted IP address, and directly discarding the request if the IP address is in a blacklist; storing the TTL and request content to a cache in an HASH mode by taking the IP address as a keyword if the extracted IP address is not in the blacklist; sending a TCP connection request message to any port of the addressby taking the extracted IP address as a destination address; and waiting for a response message, carrying out processing and comparison according to the response message, and identifying the DDoS reflection amplification attack. According to the method, the request message is verified through the amplifier and an abnormal request is identified and filtered, so a victim is protected.

Description

technical field [0001] The invention relates to the field of DDoS attack protection, in particular to a method for identifying DDoS reflection amplification attacks. Background technique [0002] Reflection attack is a DDoS attack. The attacker (broiler) does not directly attack the victim (target host), but sends a request message with a forged source IP (forged as the victim’s IP) to an open server (amplifier), and then reflected back to the victim through the amplifier. Generally speaking, the amount of data requested is much smaller than the amount of data that the amplifier responds to, resulting in an amplification effect. [0003] Existing technologies for reflection attacks are mainly limited by the request threshold per unit time. It has the following deficiencies: 1. The identification is inaccurate, and it is impossible to distinguish between normal requests and illegal requests. 2. The defense cost is high. When the victim is identified, the traffic has alread...

AI Technical Summary

Problems solved by technology

[0003] Existing technologies for reflection attacks are mainly limited by the request threshold per unit time

It has the following deficiencies: 1. The identification is not accurate, and it is impossible to distinguish between normal requests and illegal requests

2. The defense cost is high. When the victim is identified, the traffic has already reached the victim, which has already caused the impact of the attack. Sufficient bandwidth resources are needed to fight against it.