Network safety protective method for preventing reject service attack event

Abstract

A network security protection method withstanding denial of service attack event designs defence module in data link layer. Said method judges TCP request packet received from different kinds of IP address to realize to denial of service offensive filtering. Said method includes following steps : fire wall capturing outer network client-side sent TCP data package to inner network server, to realize first layer protective treatment, the TCP data package passing first layer protection entering second layer protective treatment, checking whether said received TCP categorical data having matched item in legal IP address chaining recording list, if having matched item, then regarding as normal data package capable of directly handing inner core processing, otherwise to proceed package flow rate statistics in period of time. Said invention can active defense denial of service attack from any kind of attack tool and realize inner core active defense protection effect.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method for preventing the network from collapsing due to denial of service attacks. Background technique [0002] DDoS (Distributed Denial of Service) distributed denial of service attacks on the Internet may even cause some large websites to be completely paralyzed due to intrusion. Many government websites, ISP information service providers, IDC hosting computer rooms, commercial sites, game servers, chat networks and other network service providers have been plagued by DDOS attacks for a long time. The main impact is that the database cannot be used normally, and the server is invaded and confidential information is lost. , and some associated problems. But at present, there is no breakthrough in the research work on the prevention, prediction and counterattack of DDoS attacks in the world. [0003] SYN / ACK Flood attack is one of the most typical denial-of-service attacks. ...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is: when attacked by TCP, the number of connection queues will increase, but the number of connections that the general server can bear is much larger than the number of half-connections

The disadvantage of this method is: here, the role of the relay firewall is equivalent to a TCP proxy, which replaces the server to handle TCP attacks. The TCP proxy program works in the user layer, and the number of semi-connections processed is also limited, which is easy to be broken

The disadvantage of this method is: some TCP options must be disabled, such as large windows, etc. In addition, the calculation of cookies is costly, which seriously consumes CPU resources when attacked, and even causes a crash

Images