Lightweight DDoS attack detection device and method on high-speed network

Abstract

The invention discloses a lightweight DDoS attack detection device and method on a high-speed network. The device comprises a CBFSketch module and a DDoS attack detection module. The method comprisesthe following steps: S1, acquiring network flow, and recording and storing data flow information; S2, according to the recorded data flow information, inquiring the flow size or occurrence frequency of a specific data flow, and judging whether the data flow is DDoS attack flow or not according to an inquiry result; and S3, setting a threshold value, detecting the data flow exceeding the thresholdvalue according to the recorded data flow information, and completing DDoS attack detection. The multi-level Sketch structure is adopted to store the data flow, the space can be dynamically applied, the space overhead upper limit can be effectively controlled, the flow exceeding the threshold value can be rapidly detected to detect the DDoS attack, misinformation is reduced, and the detection accuracy is improved.

Description

technical field [0001] The invention relates to a detection device and a corresponding detection method, in particular to a lightweight DDoS attack detection device and detection method on a high-speed network, belonging to the technical fields of high-speed network flow measurement and network security. Background technique [0002] With the development and popularization of the Internet, information security has gradually become a serious problem faced by the country's political, economic, military, cultural and ideological fields. How to ensure information security has gradually become a common appeal of all industries. [0003] Specifically, network security is an important part of information security, and among many factors affecting network performance, network traffic is the most important. With the development of Internet technology, network traffic analysis technology emerges as the times require. This technology captures the data packets flowing in the network, ch...

AI Technical Summary

Problems solved by technology

First, in network traffic, large traffic is very important. When detecting DDoS attacks, the main purpose is to detect traffic exceeding the threshold. However, the number of large traffic in the network is relatively small, and most of them are small traffic. Traffic and small traffic conflict when stored, and many small traffic will be overestimated when querying, resulting in false positives

Second, due to the need to store all traffic in the network, the number of counters in Sketch is relatively large, resulting in a large space occupation, but only a small number of large traffic requires relatively large counters, and a lot of space is wasted

Images