Detection and defense method for SYN Flood attack

Abstract

The invention provides a method for detecting and defending SYNFwood attacks, which comprises the following steps of: S1, attack detection: performing SYNFwood attack monitoring on a system, judging whether the current system is attacked or not, and if the current system is attacked, turning to step S2; s2, attack defense: TCP source detection is performed on the message received by the system, and whether the IP of the message is a legal IP is judged; if yes, adding the IP into a white list; and if not, discarding the message. According to the method, the SYN Flood attack can be efficiently and accurately defended on the premise of not increasing the load of the network and the host.

Description

technical field [0001] This application relates to the field of system network security, in particular to a method for detecting and defending against SYN Flood attacks. Background technique [0002] SYN Flood attack is a typical Dos (Denial of Service, denial of service) attack. By sending a large number of SYN messages or SYN and ACK mixed messages, the tcp connection resources of the server are consumed, causing the server to fail to respond to normal tcp connection requests, resulting in failure to Provide normal service. At present, the commonly used defense methods of SYN Flood can be roughly divided into two categories. The first category is to add proxy in the tcp communication stage, such as: SYN cookie, SYN Cache, SYN Proxy; the second category is TCP source detection to judge whether the IP is legal, right? Legal ip filtering, these methods can resist small-scale SYN Flood attacks. However, when there is a large traffic attack, the above method cannot be effecti...

AI Technical Summary

Problems solved by technology

However, when there is a large traffic attack, the above method cannot be effectively defended. In addition, SYN Cache, etc. need to maintain the connection state table, which will take up a lot of memory space, and SYN Cookie, which needs to calculate the cookie value, will take up a lot of CPU computing resources. If the value is too large, the CPU resources of the system will be consumed quickly, causing the system to fail to respond normally, and it will not be able to play a protective role; TCP source detection has two SYN-ACK packets that return correct confirmation numbers and SYN-ACK packets that return incorrect confirmation numbers. However, they all have the problem of increasing the network load, and need to send response messages to a large number of SYN messages, which will increase the network load additionally in the event of a large traffic attack.

Images