A denial of service attack filtering method, device and equipment based on ip whitelist

Abstract

The invention discloses a denial of service attack filtering method, device and equipment based on an IP whitelist. The method includes: judging the status of the current protected network; Packets update the IP whitelist; update the TTL value of the IP whitelist based on updating the active bit and changing the stable bit; when the status is under attack, filter the attack traffic whose IP address or TTL value does not match according to the IP whitelist, and let the legal traffic , at the same time, based on the balance of the number of packets, the traffic status of the members of the IP whitelist is monitored, and the malicious members in the IP whitelist that launch flood attacks are deleted. The method of the invention has a white list member monitoring mechanism, can quickly find and eliminate malicious members in the white list who launch flood attacks, and improves the reliability of the filtering method.

Description

technical field [0001] The invention relates to the field of network security, in particular to a filtering method for denial of service attacks, in particular to a method, device and equipment for filtering denial of service attacks based on an IP whitelist. Background technique [0002] Denial of service attack (DoS) refers to a network attack method that makes the attack target unable to provide services, and flooding attacks are mostly used. To this day, denial-of-service attacks are still common forms of network attacks that are simple to launch and cause great harm. The identification and filtering of attack traffic is one of the important topics in the field of network security. [0003] The traditional method of learning and acquiring IP members of the three types of whitelists and their TTL values ​​has major flaws: the first method of counting packets based on the frequency of appearance of IP addresses and the number of days, the principle of this method is too si...

AI Technical Summary

Problems solved by technology

[0003] The traditional method of learning and acquiring IP members of the three types of whitelists and their TTL values ​​has major flaws: the first method of counting packets based on the frequency of appearance of IP addresses and the number of days, the principle of this method is too simple, and the whitelist is easily polluted by infiltration; Two kinds of session monitoring methods to screen successfully established connection IPs. This method needs to monitor the interaction status of each session. The maintenance cost of the session flow table is high, and the number of connections per second becomes a performance bottleneck. The third mining classification method based on traffic characteristics, the The method has high requirements for the design of traffic characteristic rules, the time and space cost of model training is high, and it contradicts the suddenness and variability of network traffic

This method must rewrite the server kernel, frequently requests server TCP session table information, occupies server performance, and has a narrow application range. Even if it is changed to an off-machine deployment method of monitoring server traffic, a network session flow table needs to be established, and the processing performance is weak.

In addition, the information such as IP address and TTL value in the whitelist is static, and there is no dynamic update and maintenance mechanism, and there is no monitoring mechanism for whitelist members.

[0006] The aforementioned methods and patents have large loopholes and deficiencies in the acquisition and update of whitelist IP members and their TTL values, and whitelist member monitoring issues, and are difficult to be widely applied to real-time production applications

Images