Distributed multi-level cooperation-based distributed denial of service attack monitoring system and method

Abstract

The invention discloses a distributed multistage cooperation-based distributed denial of service attack monitoring system and method, the system comprises one or more aggregation controllers and service nodes, the aggregation controllers manage the one or more service nodes connected with the aggregation controllers, propose data requirements to the service nodes connected with the aggregation controllers, receive the data feedback of the service nodes in real time, and perform information aggregation processing in combination with the network topology information to obtain an attack detectionresult, wherein the plurality of service nodes are respectively deployed and installed on each network device, the network device comprises a gateway device, a programmable switch, a network securityall-in-one machine and a computer system, each service node is used for establishing a communication channel with the aggregation controller, each service node registers and connects with one or moreaggregation controllers, and receives the control of the convergence controller. According to the invention, local analysis can be carried out according to the content gathered in the local network,and the execution efficiency and the denial of service attack monitoring effect of the whole system are improved.

Description

technical field [0001] The invention relates to the technical field of computer network communication, in particular to a distributed denial-of-service attack monitoring system and method based on distributed multi-level coordination. Background technique [0002] The current monitoring and detection methods for DoS attacks (especially DDoS (distributed denial of service attack) attacks) in computer network communication are mainly through in-band or The out-of-band (direction) method analyzes the network traffic and compares it with the known network traffic model (normal traffic or attack traffic) to find out whether there is a DoS or DDoS attack occurring. And based on this result, suppress the traffic that is considered to be an attack, so as to mitigate the attack. [0003] Existing detection technologies are mainly based on single-point detection technology, or detection technology based on gateway and cloud collaboration. The above-mentioned detection technology: lac...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to overcome the problem that the prior art has great limitations in the way of monitoring and detecting denial of service attacks

Images