Defense method and defense device for SSDP reflection attack based on multi-point defense in Internet of things

Abstract

The invention provides a defense method for the SSDP reflection attack based on multi-point defense in the Internet of things. According to the defense method, the defense mechanism is deployed in multiple network positions such as a zombie, a service provider and a victim, as shown in a Figure 1. The time interval at which the zombie sends the same SSDP request message is set to reduce the message sending number per unit time; the time interval for the service provider to respond to the same message is set to reduce the response number per unit time; a reasonable TTL value of the SSDP serviceresponse report is set to limit transmission of the SSDP service response messages over long distances; the time interval at which the victim receives the same message is set to discard the same service response message. The defense method is advantaged in that the network flow is reduced without affecting network service efficiency, so detecting occurrence of the SSDP reflection attack in advance is not needed. The invention further provides a defense device for the SSDP reflection attack based on multi-point defense in the Internet of things.

Description

technical field [0001] The present invention relates to a SSDP protocol-based reflection attack defense method and defense device, in particular to a SSDP reflection attack defense method and defense device based on multi-point defense existing in the Internet of Things environment. Background technique [0002] DDoS attack is a commonly used and effective attack method in cyberspace. This attack method can send various requests to the victim continuously by controlling a large number of zombie machines in a short period of time, resulting in a surge in the network traffic of the victim until it cannot serve the outside world. Provide normal service. [0003] SSDP, namely Simple Service Discovery Protocol (SSDP, Simple Service Discovery Protocol), is an application layer protocol and one of the core protocols constituting the Universal Plug and Play (UPnP) technology. When the SSDP protocol-based smart device receives the SSDP request data message, if the device can provide...

AI Technical Summary

Problems solved by technology

[0017] The above methods first identify DDoS attacks and then defend them. The identification process requires a lot of time and space overhead. More importantly, the identification accuracy is not high, resulting in poor defense effects.

In addition, restricting network traffic and network resources will affect the normal network services of service providers and victim nodes

Images