Method and device for detecting traffic hijacking

Abstract

The invention provides a traffic hijacking detection method and device, and relates to the technical field of data processing. Wherein, the method includes: acquiring request data packets and response data packets for analyzing traffic hijacking within a preset period of time in an interface of the network; processing the response data packets to obtain TTLs corresponding to multiple IP addresses in the network respectively The standard deviation of the return value; if the standard deviation of the TTL return value corresponding to the IP address is greater than or equal to the jitter threshold of the TLL return value in the preset network, it is determined that the IP address is the first IP address suspected of traffic hijacking; according to The first IP address determines the number of response packets corresponding to the first request packet in which the destination IP address in the request packet is the first IP address; when judging that the number of response packets corresponding to the first request packet is greater than or equal to the preset If the number is smaller than the number, it is determined that the first IP address corresponding to the first request data packet is an IP address with traffic hijacking.

Description

technical field [0001] The present invention relates to the technical field of data processing, in particular to a method and device for detecting traffic hijacking. Background technique [0002] With the rapid development of broadband, while the number of Internet users and traffic is increasing sharply, the number of user clicks and traffic guidance has important value. For this reason, there are a large number of traffic anomalies in the network, such as DNS (domain name service, domain name service) hijacking, HTTP (Hyper Text Transport Protocol, hypertext transfer protocol) link hijacking, etc., maliciously modify the returned content of the user's access to the website, This leads to a decline in the quality of users' perception of use, which is likely to cause batch complaints and pose a security risk to the operator's network. In order to purify the network environment, improve user awareness, stabilize the user group, and also respond to the 315 special activity of...

AI Technical Summary

Problems solved by technology

The disadvantage of the second scheme is that it is difficult to find the hijacking phenomenon of forged packets for the first time, and changing the routing table of each hop route requires the in-depth support of other departments. If the router is outside the province or outside the network, the coordination is more difficult

Furthermore, there is a certain risk in changing the routing table, which will have a certain impact on the network

This program is not recommended to use

Images