Attack monitoring system and attack monitoring method

Abstract

The invention provides an attack monitoring system and an attack monitoring method, the method is applied to a monitoring server, and the method comprises the following steps: sending a monitoring instruction to each first monitoring device, the monitoring instruction carrying a first address of a target server to be monitored, the first monitoring equipment is used for monitoring area equipment in a corresponding monitoring area; receiving traffic statistical information sent by each first monitoring device; and if it is determined that the traffic sent to the target server is abnormal according to each piece of traffic statistical information, determining that the target server is attacked. Therefore, the monitoring server can effectively identify whether the server is attacked or not, that is, the traffic sent to the target server is identified at the regional equipment side, then countermeasures are taken in time when the attack is identified, and attack defense is realized to a certain extent.

Description

technical field [0001] The present application relates to the field of security technologies, and in particular, to an attack monitoring system and an attack monitoring method. Background technique [0002] Distributed Denial of Service (DDoS) attack is a network attack method commonly used by hackers at present. One or more target computers launch an attack, causing the attacked computer to fail to provide normal services. [0003] The SYN-Flood attack is the most common DDoS attack and the most classic denial of service attack. It takes advantage of the flaws in the implementation of the TCP protocol and sends a large number of attack packets with forged source addresses to the port where the network service is located. It will cause the half-open connection queue in the target computer to be full, thereby preventing other legitimate users from accessing. [0004] The currently provided DDOS attack is designed to protect against the attack received by the server. However...

AI Technical Summary

Problems solved by technology

[0002] Distributed Denial of Service attack (Distributed Denial of Service, DDoS) is a network attack method commonly used by hackers. It refers to the use of a sufficient number of puppet computers distributed in different places to generate a large number of attack packets, One or more target computers launch an attack, causing the attacked computer to fail to provide normal services

[0003] The SYN-Flood attack is the most common DDoS attack, and it is also the most classic denial of service attack method. It takes advantage of the defects in the implementation of the TCP protocol to send a large number of attack messages with forged source addresses to the port where the network service is located. Can cause the half-open connection queue on the target computer to fill up, preventing access by other legitimate users

[0004] The DDOS attack currently provided is designed to protect against the attack received by the server. However, when the traffic of the DDOS attack is too large, the existing protection scheme basically does not work, and it is impossible to locate the source of the attack. That is to say, there is no There are recognized methods for effectively identifying DDOS attacks

Images