Low-speed DDoS attack defense method and system

Abstract

The invention discloses a low-speed DDoS attack defense method and system based on a compact data structure. The method comprises an on-line coding step, an off-line decoding step and an attack defense step, wherein the on-line coding step is that an SRAM records a data packet into a continuous memory space opened by an access server by using k hash functions when the data packet arrives, and at the end of each measurement period, the SRAM stores a data packet record of the period to a server for off-line analysis; the off-line decoding step is that the server performs off-line decoding on theobtained data packet record, and uploads an obtained result to a central router for judging whether a user in the next period is an attacker or not; the attack defense step is that when the data packet arrives, the data packet is mapped to the result of the off-line decoding by using the k hash functions, so that whether the data packet is from the attacker or not is judged. According to the method and the system, the low-speed DDoS attacker can be quickly and accurately found, the defense measures can be provided in a targeted mode, and the network safety is improved.

Description

technical field [0001] The invention relates to a low-speed distributed denial-of-service attack defense method and system, belonging to the field of network attack defense. Background technique [0002] Distributed Denial of Service (DDoS) attack, referred to as DDoS attack, refers to the use of client / server technology to combine a large number of computers as an attack platform to launch an attack on one or more targets, occupying a large number of legitimate requests through a large number of resources, bringing down the attacked server or degrading its performance. When a large number of DDoS attackers access the attacked server at a rate much greater than the rate at which legitimate users send packets, the server will be paralyzed, and legitimate users cannot access the server normally. There are a large number of DDoS attack detectors that can judge whether a user is a DDoS attacker by detecting the packet sending rate. However, when these illegal users reduce the ...

AI Technical Summary

Problems solved by technology

However, the designed estimator can only detect the number of users who continuously access the server, but cannot judge which users

Therefore, low-speed DDoS estimation techniques based on continuous traffic estimation cannot achieve attack defense

Images