DDoS attack defense system and method based on dynamic transformation

Abstract

The invention provides a DDoS attack defense system and method based on dynamic transformation, which break through the characteristics of traditional passive defense and static defense. The method has the basic thought that: under normal flow, a small number of proxy nodes are adopted to transmit communication between a user and an application server, so that normal communication requirements aremet, and resources are saved; and when a DDoS attack is received, a large number of dynamic proxy nodes are started to transmit communication between the user and the application server, the standbyproxy node is continuously used for replacing the attacked proxy node, the user flow is migrated to the new proxy node, and the attacked proxy node is closed, so that the DDoS attack strength is rapidly reduced, and the purpose of defending against large-flow attacks with small bandwidth is achieved. In addition, the dynamic change of the proxy node enables the attacker not to obtain the internalnetwork topology structure of the system, so that the scanning detection of the attacker on the system can be effectively blocked. The system does not increase user load, is transparent to users, andprovides continuous and stable service for the users.

Description

technical field [0001] The invention relates to the field of network security, in particular to a DDoS attack defense system and method based on dynamic transformation. Background technique [0002] Distributed Denial of Service (Distributed Denial of Service, DDoS) attack refers to the use of client / server technology, by controlling multiple hosts as an attack platform, sending a large number of data packets to one or more victim hosts, so that the resources of the victim host are excessively consumed services cannot be provided normally. With the increase of Internet bandwidth and the continuous release of various DDoS hacking tools, the implementation of DDoS attacks is becoming easier and easier. DDoS attack incidents are on the rise and become an important source of threats to network security. Due to various factors such as business competition, retaliation, and network extortion, many network service providers such as IDC hosting rooms, commercial sites, game servers...

AI Technical Summary

Problems solved by technology

[0010] 2. Slow DDoS attack defense effect is poor

Pulse DDoS attacks use the protocol defect of the TCP congestion control mechanism to cause instantaneous network congestion, so that the TCP sliding window is rapidly reduced

Slow DDoS attacks are highly concealed, and the existing detection and defense methods have poor defense effects

[0012] 3. The cost of DDoS attack defense is high

[0013] Since most of the DDoS attack defense measures and methods currently used require a large amount of hardware and bandwidth investment, whether users build their own DDoS attack defense systems or rent DDoS attack defense services, resources will be wasted under normal traffic and costs will be increased.

Images