A method and apparatus for defending against DDoS attacks

Abstract

The application provides a DDOS attack defense method and device, the method acquires data flow flowing to the defense object device in several monitoring periods. In the case that the flow growth rate of the data flow is greater than a first preset threshold, the several pending attack data packets of the data packet preferentially queued LARS queue and the queue proportion of the pending attack data packets are determined. The decay value of the pending attack data packet meets a preset condition. The preset condition is used to screen data packets with decay values less than a second preset threshold. Based on the matching result of the queue proportion of the pending attack data packet and a third preset threshold, the corresponding abnormal data packet characteristics of the pending attack data packet are determined. The abnormal data packet characteristics at least include: data packet mean, data packet distribution interval. According to the abnormal data packet characteristics, each data packet in the data flow is subjected to corresponding data packet elimination.

Description

Technical Field

[0001] This application relates to the field of Internet security technology, and in particular to a method and device for defending against Distributed Denial of Service (DDoS) attacks. Background Technology

[0002] DDoS attacks are one of the major threats facing the cybersecurity field today. DDoS attackers typically use compromised or hired botnets to send large amounts of illegal data to the target, quickly exhausting server resources or network bandwidth, thereby achieving the goal of denying service to the attacked target.

[0003] During the forwarding of data packets from the forwarding device to the target device, existing forwarding devices using the classification-based size-based scheduling (CBSBS) algorithm prioritize the forwarding of data packets. When facing DDoS exhaustive attacks, attackers can forge source address fields in attack packets, causing them to be identified as entirely new packets and given higher forwarding priority. This amplifies the impact of DDoS exhaustive attacks on the forwarding device. Changing the forwarding scheduling algorithm would not only fail to address DDoS attacks promptly but would also disrupt the normal operation of subsequent forwarding devices. Temporarily changing the scheduling algorithm would also make the forwarding device overly cumbersome and unsuitable for industrial-scale application.

[0004] Therefore, there is an urgent need for a technical solution that can amplify the effects of DDoS attacks by forwarding devices and effectively and conveniently resolve DDoS attacks. Summary of the Invention

[0005] This application provides a DDoS attack defense method and device to prevent the effects of DDoS attacks from being amplified and to effectively and conveniently resolve DDoS attrition attacks.

[0006] On the one hand, embodiments of this application provide a DDoS attack defense method, which includes:

[0007] Data streams flowing to the target device are acquired over several monitoring periods. When the data stream's traffic growth rate exceeds a first preset threshold, several pending attack packets and their respective queue proportions are identified in the Least Attained Recent Service (LARS) queue. The attenuation value of these pending attack packets meets a preset condition. This preset condition filters packets with attenuation values ​​less than a second preset threshold. Based on the matching result between the queue proportion of pending attack packets and a third preset threshold, the corresponding abnormal packet characteristics are determined. These abnormal packet characteristics include at least: average packet value and packet distribution range. Based on these abnormal packet characteristics, packets in the data stream are removed accordingly.

[0008] In one implementation of this application, the traffic growth rate of monitoring periods adjacent in time is determined based on the data stream of each monitoring period. The traffic growth rate is compared with a first preset threshold, and if the traffic growth rate is greater than the first preset threshold, the attenuation value of each data packet in the LARS queue is determined. The LARS queue is arranged sequentially according to the attenuation value. The attenuation value is calculated using a preset attenuation value calculation formula. Using a binary search method, data packets in the LARS queue with attenuation values ​​less than a second preset threshold are identified as potential attack data packets.

[0009] In one implementation of this application, the number of data packets in the LARS queue is used as a first quantity. The number of data packets to be attacked is used as a second quantity. The proportion of the queue to be attacked is determined based on the ratio of the second quantity to the first quantity.

[0010] In one implementation of this application, it is determined whether the traffic growth rate of the LARS queue is greater than a fourth preset threshold within the corresponding monitoring period. If so, the matching result between the queue proportion of pending attack data packets and a third preset threshold is determined. Otherwise, it is re-determined whether the traffic growth rate of the corresponding data flow to the target device is greater than a first preset threshold, so as to update the pending attack data packets and queue proportion.

[0011] In one implementation of this application, when the matching result shows that the queue proportion is greater than a third preset threshold, corresponding abnormal data packet characteristics are generated based on each pending attack data packet. When the matching result shows that the queue proportion is less than or equal to the third preset threshold, the pending attack data packet is determined to be a non-attack data packet, and it is determined in real time whether the traffic growth rate of the LARS queue is greater than a fourth preset threshold within the corresponding monitoring period.

[0012] In one implementation of this application, the size of each pending attack data packet is determined. Based on the size of each pending attack data packet, the corresponding mean and variance of the data packets are determined. Based on the mean and variance of the data packets, the distribution range of the abnormal data packets is determined. The mean and distribution range of the data packets are used as characteristics of the abnormal data packets.

[0013] In one implementation of this application, the size of each data packet in the data stream is determined to determine whether it falls within the data packet distribution range corresponding to the characteristics of abnormal data packets. Data packets whose sizes fall within the data packet distribution range corresponding to the characteristics of abnormal data packets are discarded to remove abnormal data packets.

[0014] In one implementation of this application, the number of times the data stream's traffic growth rate exceeds a first preset threshold within a preset continuous monitoring period is determined. If the number of monitoring occurrences exceeds the first preset value, the corresponding pending attack data packets and their queue proportions are determined.

[0015] In one implementation of this application, a data stream after removing abnormal data packets is obtained, and the data traffic statistics of the abnormal data packets in the data stream are determined. If the data traffic statistics are less than a second preset value, a defense modification instruction is generated and sent to the forwarding device that forwards the data stream, so as to perform protection processing on the data stream flowing to the defense target device according to a preset data protection strategy.

[0016] On the other hand, embodiments of this application also provide a distributed denial-of-service (DDoS) attack defense device, which includes:

[0017] At least one processor; and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0018] Data streams flowing to the target device are acquired over several monitoring periods. When the data stream growth rate exceeds a first preset threshold, several pending attack data packets and their queue proportions are determined in the LARS (Laser Access Restriction) priority queuing queue. The attenuation value of these pending attack data packets meets a preset condition. This preset condition filters packets with attenuation values ​​less than a second preset threshold. Based on the matching result between the queue proportion of pending attack data packets and a third preset threshold, the characteristics of the corresponding abnormal data packets are determined. These abnormal data packet characteristics include at least: the average data packet value and the data packet distribution range. Based on these abnormal data packet characteristics, corresponding data packets are removed from the data stream.

[0019] When the data flow to the target device exceeds a first preset threshold, potential attack packets in the LARS queue can be identified and verified, such as by matching queue proportions, to obtain abnormal packet characteristics. Then, based on these abnormal packet characteristics, packets in the data flow are cleaned to defend against DDoS attacks, preventing forwarding devices from amplifying the effects of DDoS attacks, effectively mitigating DDoS attrition attacks, and without requiring changes to the forwarding device scheduling algorithm, thus conveniently resolving DDoS attrition attacks. Furthermore, this application effectively addresses the traditional security shortcomings of size-based scheduling algorithms through the above solution. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is a flowchart illustrating a DDoS attack defense method in an embodiment of this application.

[0022] Figure 2 This is a schematic diagram of another DDoS attack defense method in the embodiments of this application;

[0023] Figure 3 This is another flowchart illustrating a DDoS attack defense method according to an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of the structure of a DDoS attack defense device according to an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] Existing forwarding devices can classify packets using the Size-based scheduling algorithm CBSBS, which improves packet classification. By reducing the resource overhead of the classification scheduling algorithm and avoiding performance fluctuations caused by excessively frequent prioritization, this algorithm can be applied to the aggregation layer or higher-level networks, changing its primary application to end systems and providing better services for network information fusion. This algorithm can amplify the effects of DDoS exhaustive attacks when facing forwarding devices, causing the server resources or network bandwidth of the target device to be exhausted more quickly and easily.

[0027] Based on this, the present application provides a DDoS attack defense method and device to solve the problem that current DDoS exhaustive attacks can amplify the attack effect and easily exhaust the device's resources or network bandwidth, thus effectively resolving DDoS attacks.

[0028] The various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0029] This application provides a DDoS attack defense method, which is described using a DDoS attack defense detection device. This device can be a server or a server cluster, such as... Figure 1 As shown, the method may include steps S101-S104:

[0030] S101, the server acquires the data streams flowing to the target device within several monitoring periods.

[0031] In this application embodiment, the defense target device can be a website, server, data center, or other object used to receive data streams. The data stream is sent from the source device (data traffic source device) to the defense target device (destination device). During the process of the source device sending the data stream to the defense target device, the server of this application can collect the data traffic corresponding to the data stream. The server can collect the data stream through a set forwarding device, such as a router or switch.

[0032] After collecting the data stream, the forwarding device sends it to the DDoS attack detection device. The forwarding device can be a router, switch, or a server that receives the data stream split by devices such as routers and switches and extracts the sampled data stream.

[0033] It should be noted that the server, as the executor of the DDoS attack defense method, exists only as an example, and the executor is not limited to the server. This application does not make any specific limitation on this.

[0034] The monitoring cycle can be understood as a pre-set, cyclical monitoring period for whether the target device is under DDoS attack from other host devices. Each monitoring cycle continuously acquires data traffic flowing to the target device. For example, a monitoring cycle might be 1 minute. During a DDoS attack, data flow can change abruptly within different monitoring cycles; this monitoring cycle is set to facilitate monitoring of attack events. The user can be understood as the user of the target device performing DDoS attack defense, or the equipment maintenance personnel or organization providing services to the target device.

[0035] S102, when the data flow growth rate is greater than a first preset threshold, the server determines a number of pending attack data packets and the queue proportion of pending attack data packets in the LARS priority queuing queue.

[0036] Specifically, the attenuation value of the pending attack data packets must meet a preset condition. This preset condition is used to filter data packets whose attenuation value is less than a second preset threshold.

[0037] The first and second preset thresholds are values ​​preset by the user based on actual attack and defense needs. The LARS queue is a data packet queue obtained from the LARS algorithm. Data packets in the queue can be sorted according to their attenuation values, which are calculated using a preset attenuation value calculation formula, as follows:

[0038]

[0039] Among them, v j (t) represents the packet attenuation value in the j-th data stream at deadline t, S j (t) represents the data flow of the j-th data stream at the deadline t, S j (nτ) represents the data flow rate of the j-th data stream at the end time node nτ of the previous monitoring cycle, and μ is a preset attenuation factor with a value of (0,1). j (nτ) represents the packet attenuation value of the j-th data stream at the end time nτ of the previous monitoring period. The attenuation value table, which records the packet attenuation values ​​of the data streams, can be obtained using the above formula. This table is calculated by the Classification Based Size-Based Scheduling (CBSBS) algorithm using the above formula.

[0040] In the embodiments of this application, the data stream contains several data packets, and its traffic growth rate can be obtained by comparing the traffic size of adjacent monitoring periods. For example, if the traffic size of the data stream in the first monitoring period is a and the traffic size of the data stream in the second monitoring period is b, then the traffic growth rate can be (ba) / a.

[0041] If the data flow growth rate exceeds the first preset threshold mentioned above, several pending attack packets are identified and prioritized for queuing in the LARS queue, specifically including:

[0042] First, the server determines the traffic growth rate of monitoring periods that are adjacent in time based on the data stream of each monitoring period.

[0043] That is, the server can calculate the traffic growth rate of the acquired data streams sequentially, and time adjacency means that the monitoring period is time-continuous.

[0044] Next, the server compares the traffic growth rate with a first preset threshold, and if the traffic growth rate is greater than the first preset threshold, it determines the attenuation value of each data packet in the LARS queue.

[0045] The LARS queues are arranged sequentially according to their attenuation values. These attenuation values ​​are calculated using a preset formula, as shown above. The LARS queues can be arranged based on the attenuation values ​​of each data packet.

[0046] Then, the server uses a binary search method to determine the data packets in the LARS queue that have a decay value less than the second preset threshold as pending attack data packets.

[0047] The binary search method compares the attenuation values ​​of two data packets with a second preset threshold to determine the attenuation value corresponding to the second preset threshold in the LARS queue. Data packets with attenuation values ​​after that queue position are considered as potential attack packets. In other words, data packets with attenuation values ​​less than the second preset threshold are considered as potential attack packets.

[0048] In addition, the server can also determine the queue percentage of pending attack packets, specifically including:

[0049] The server uses the number of packets in the LARS queue as the first quantity and the number of packets suspected of being attack packets as the second quantity. Then, it determines the proportion of packets suspected of being attack packets in the queue based on the ratio of the second quantity to the first quantity.

[0050] Based on the above description, it can be determined that when the number of data packets in the LARS queue is n and the number of pending attack data packets is m, m / n will be used as the queue proportion of pending attack data packets.

[0051] In another embodiment of this application, the server can verify the existence of a DDoS attack from multiple perspectives to further determine whether a DDoS attack has occurred, specifically including:

[0052] First, the server determines whether the traffic growth rate of the LARS queue is greater than the fourth preset threshold within the corresponding monitoring period.

[0053] The corresponding monitoring period refers to the same monitoring period used to determine the pending attack packets and calculate the proportion of the queue. At this point, the server determines that the data traffic growth rate is greater than the first preset threshold, but this may not have occurred in the LARS queue. Further determining the traffic growth rate of the LARS queue can ensure the existence of a DDoS attack. The fourth preset threshold is a pre-set value, and this application does not specifically limit its value.

[0054] If the traffic growth rate of the LARS queue is greater than the fourth preset threshold, the server determines the matching result between the queue proportion of pending attack packets and the third preset threshold.

[0055] In other words, the matching result between the queue percentage and the third preset threshold will only be determined when the traffic growth rate of the LARS queue exceeds the fourth preset threshold.

[0056] Otherwise, re-determine whether the growth rate of the data flow to the target device is greater than the first preset threshold, in order to update the pending attack data packets and queue proportions.

[0057] By combining attenuation value analysis with LARS queue traffic growth rate analysis, the existence of a DDoS attack can be accurately determined, ensuring the accuracy of attack defense and preventing the server from mistakenly identifying a DDoS attack and resulting in data loss.

[0058] S103, the server determines the abnormal data packet characteristics of the pending attack data packets based on the matching result of the queue ratio of pending attack data packets and the third preset threshold.

[0059] The characteristics of abnormal data packets include at least: the average value of the data packets and the distribution range of the data packets.

[0060] In this embodiment of the application, the server determines the abnormal data packet characteristics corresponding to the pending attack data packets based on the matching result between the queue proportion of pending attack data packets and a third preset threshold, specifically including:

[0061] The matching results include queue proportions greater than the third preset threshold and queue proportions less than or equal to the third preset threshold.

[0062] If the matching result shows that the proportion of the queue is greater than the third preset threshold, the server generates corresponding abnormal data packet characteristics based on each pending attack data packet.

[0063] Specifically, the server can determine the size of each potential attack data packet. Based on the size of each potential attack data packet, it determines the corresponding mean and variance of the data packets. Then, based on the mean and variance, it determines the distribution range of the abnormal data packets. Finally, the mean and distribution range of the data packets are used as characteristics of the abnormal data packets.

[0064] In other words, the server can determine the average value (avg) of multiple pending attack packets based on their size. For example, if the packet size sequence is {1,2,3,4}, the average value (avg) is (1+2+3+4) / 4 = 2.5, and the variance is calculated using the following variance formula, which is 1.67.

[0065]

[0066] Where, σ 2 Let x be the variance, n be the number of attack packets to be determined, and x be the variance. i Let i be the size of the i-th data packet. The average value (avg) of the above data packets.

[0067] The data packet distribution range is the mean value of the data packets ± the variance of the data packets, such as [2.5-1.67, 2.5+1.67]. Data packets whose size falls within this distribution range can be identified as abnormal data packets.

[0068] If the matching result shows that the queue percentage is less than or equal to the third preset threshold, the server determines that the pending attack data packet is a non-attack data packet, and determines in real time whether the traffic growth rate of the LARS queue is greater than the fourth preset threshold within the corresponding monitoring period.

[0069] In other words, when the matching result is that the queue proportion is less than or equal to the third preset threshold, the server can obtain whether the data packet traffic growth rate in the LARS queue is greater than the fourth preset threshold, so as to perform the operation of verifying whether there is a DDoS attack behavior in multiple aspects in the above step S102.

[0070] S104, the server removes data packets from the data stream based on the characteristics of the abnormal data packets.

[0071] The corresponding data packet refers to the abnormal data packet that matches the characteristics of the abnormal data packet.

[0072] In this embodiment of the application, the server performs corresponding packet removal on each data packet in the data stream based on the characteristics of abnormal data packets, specifically including:

[0073] First, the server determines the size of each data packet in the data traffic and whether it falls within the data packet distribution range corresponding to the characteristics of abnormal data packets. Data packets whose size falls within this range are then discarded to remove the abnormal packets.

[0074] In other words, after the server obtains the abnormal data packet characteristics from S103, it matches each data packet in the data stream that meets the criteria for a DDoS attack based on these characteristics. Data packets matching the abnormal data packet characteristics are then discarded by the server as abnormal data packets to clean the data stream. The criteria for a DDoS attack include a data stream traffic growth rate greater than a first preset threshold, the presence of pending attack data packets, and a LARS queue traffic growth rate greater than a fourth preset threshold.

[0075] Furthermore, the server in this application can determine the number of times the data stream's traffic growth rate exceeds a first preset threshold within a preset continuous monitoring period. When the number of monitoring occurrences exceeds the first preset value, the corresponding pending attack data packets and their queue proportions are determined.

[0076] The preset continuous monitoring period is set by the user and is used to monitor the number of abnormal increases in the attenuation value table within the preset continuous monitoring period, i.e., the number of monitoring times exceeds a first preset value. The first preset value is set by the user, and this application does not impose specific limitations on it. If the number of monitoring times exceeds the first preset value, then steps S102-S104 described above can be executed.

[0077] In this embodiment of the application, after the server performs corresponding packet removal on each data packet in the data stream based on the characteristics of abnormal data packets, the method further includes:

[0078] First, the server obtains the data stream after removing abnormal data packets and determines the data traffic statistics of the abnormal data packets in the data stream.

[0079] The data traffic statistics value is the number of abnormal data packets flowing to the device being defended in the data stream.

[0080] If the data traffic statistics value is less than the second preset value, a defense change instruction is generated and sent to the forwarding device that forwards the data flow, so as to protect the data flow to the defense target device according to the preset data protection strategy.

[0081] The data protection strategy can be pre-stored in a preset database. When the server determines that the data traffic statistics value is less than a second preset value, it sends a strategy retrieval message to the preset database to obtain the data protection strategy and sends the data protection strategy to the forwarding device. The forwarding device changes its current data protection strategy according to the defense change instruction. Alternatively, the data protection strategy can be pre-set in the forwarding device. The server uses the defense change instruction to make the forwarding device select the data protection strategy and then perform data flow protection processing. The data protection strategy is the data packet dropping rule of the data flow.

[0082] Data protection strategies can include any of the following DDoS response strategies: black hole routing response strategy, rate limiting response strategy, speed limiting response strategy, drop response strategy, local cleaning response strategy, and dynamic traffic diversion cleaning response strategy.

[0083] Among them, the black hole routing response policy is used to instruct forwarding devices to drop data packets flowing to the target device by configuring black hole routing.

[0084] The rate limiting response policy is used to instruct forwarding devices to rate limit the data flow to the target device.

[0085] The rate-limiting response strategy instructs forwarding devices to rate-limit data streams destined for the target device.

[0086] The drop response policy is used to instruct forwarding devices to drop packets in data streams destined for the target device.

[0087] The local scrubbing response policy is used to instruct forwarding devices to scrub data streams destined for the target device.

[0088] The dynamic diversion and cleaning response strategy is used to instruct forwarding devices to send data streams destined for the target device to the cleaning device for cleaning processing.

[0089] This application, through the aforementioned scheme, can identify potential attack packets in the LARS queue and verify them when the data flow to the target device exceeds a first preset threshold. This verification includes matching queue proportions to obtain abnormal packet characteristics. Based on these abnormal packet characteristics, packets in the data flow are then cleaned, thereby defending against DDoS attacks, preventing forwarding devices from amplifying the effects of DDoS attacks, effectively mitigating the destructive nature of DDoS attacks, and conveniently resolving DDoS destructive attacks without requiring changes to the forwarding device scheduling algorithm.

[0090] Meanwhile, this application leverages the characteristics of CBSBS (Category-Based Scheduler-Based Scheduler), where attack packets have higher scheduling priority during DDoS attacks. This application employs a "drop head" strategy to remove high-priority abnormal packets from the queue, effectively addressing the traditional security shortcomings of size-based scheduling algorithms. Furthermore, it allows for changes to the data protection strategy after the DDoS attack ends, implementing different data discarding methods.

[0091] Figure 2 This is a schematic diagram of a processing flow for a DDoS attack defense method provided in an embodiment of this application, as shown below. Figure 2 As shown, it includes:

[0092] S201, Data Traffic Detection;

[0093] That is, to obtain the data flow to the target device within several monitoring periods and determine the flow rate growth rate.

[0094] S202, Attenuation value analysis;

[0095] That is, calculate the data packet attenuation value and filter data packets whose attenuation value is less than a second preset threshold according to preset conditions.

[0096] S203, LARS Traffic Growth Rate Analysis;

[0097] That is, determining whether the traffic growth rate of the LARS queue is greater than the fourth preset threshold.

[0098] S204, Data packet size characteristic calculation;

[0099] S205, Calculation of data packet distribution characteristics;

[0100] S206, Abnormal data packet filtering;

[0101] That is, abnormal data packets are matched using abnormal data packet characteristics obtained from data packet size characteristics and data packet distribution characteristics.

[0102] S207, Abnormal data packet cleaning.

[0103] Figure 3 This is another schematic diagram of the processing flow of the DDoS attack defense method provided in the embodiments of this application, as shown below. Figure 3 As shown, it includes:

[0104] S301, monitor device flow starting from time tn;

[0105] S302, calculate the device flow rate growth rate f of △t=t-tn and compare it with the flow rate growth threshold (first preset threshold) f0;

[0106] S303, determine if f > f0; if satisfied, execute S303; if not satisfied, execute S301.

[0107] S304, calculate the flow growth l of the LARS queue in time Δt and compare it with the flow growth threshold (fourth preset threshold) l0;

[0108] S305, determine if l>l0; if satisfied, execute S306; otherwise, execute S301.

[0109] S306, Locate the position of the low attenuation threshold (second preset threshold) s in the LARS queue and determine the proportion of low attenuation data packets r;

[0110] S307, Determine if r > the third preset threshold; if satisfied, proceed to S308; otherwise, proceed to S304.

[0111] S308, calculate the average (avg) size of low-attenuation data packets;

[0112] S309, Calculate the variance var of the low-attenuation data packet size;

[0113] S3010, iterate through the size L of low attenuation value data packets and determine whether they are abnormal data packets;

[0114] S3011, determine whether L belongs to the data packet distribution range (avg-var, avg+var); if it is, discard the abnormal data packet; otherwise, do not process the data packet.

[0115] Figure 4 A distributed denial-of-service (DDoS) attack defense device provided in this application embodiment includes:

[0116] At least one processor; and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0117] Data streams flowing to the target device are acquired over several monitoring periods. When the data stream growth rate exceeds a first preset threshold, several pending attack data packets and their queue proportions are determined in the LARS (Laser Access Restriction) priority queuing queue. The attenuation value of these pending attack data packets meets a preset condition. This preset condition filters packets with attenuation values ​​less than a second preset threshold. Based on the matching result between the queue proportion of pending attack data packets and a third preset threshold, the characteristics of the corresponding abnormal data packets are determined. These abnormal data packet characteristics include at least: the average data packet value and the data packet distribution range. Based on these abnormal data packet characteristics, corresponding data packets are removed from the data stream.

[0118] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0119] The devices and methods provided in this application are one-to-one correspondences. Therefore, the devices also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices will not be repeated here.

[0120] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0121] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for defending against distributed denial-of-service (DDoS) attacks, characterized in that, The method includes: Acquire data streams flowing to the target devices within several monitoring periods; When the data flow growth rate exceeds a first preset threshold, a number of pending attack data packets and their respective queue proportions are determined in the LARS priority queuing queue. The attenuation value of these pending attack data packets satisfies a preset condition. This preset condition is used to filter data packets with attenuation values ​​less than a second preset threshold. The attenuation value is calculated using a preset attenuation value calculation formula. ;in, Deadline The The packet attenuation value in each data stream Deadline The Data flow of each data stream The end time of the previous monitoring cycle The Data flow of each data stream This is a preset attenuation factor, with a value of (0,1]. End time of the previous monitoring cycle The The packet attenuation value of each data stream; Based on the matching result between the queue proportion of the pending attack data packets and the third preset threshold, the abnormal data packet characteristics of the pending attack data packets are determined; the abnormal data packet characteristics include at least: the average value of the data packets and the distribution range of the data packets. Based on the characteristics of the abnormal data packets, each data packet in the data stream is removed accordingly.

2. The method according to claim 1, characterized in that, If the data flow growth rate exceeds a first preset threshold, several pending attack data packets are identified and prioritized for queuing in the LARS queue, specifically including: Based on the data stream of each monitoring period, determine the flow rate growth rate of the monitoring periods that are adjacent in time; The traffic growth rate is compared with the first preset threshold, and if the traffic growth rate is greater than the first preset threshold, the attenuation value of each data packet in the LARS queue is determined; wherein, the LARS queue is arranged in order of attenuation value. By using a binary search method, each data packet in the LARS queue that corresponds to an attenuation value less than the second preset threshold is identified as the pending attack data packet.

3. The method according to claim 2, characterized in that, Determining the queue proportion of the pending attack data packets specifically includes: The number of data packets in the LARS queue is taken as the first quantity; The number of packets in the pending attack data packet is taken as the second quantity; The queue proportion of the pending attack data packets is determined based on the ratio of the second quantity to the first quantity.

4. The method according to claim 1, characterized in that, Before determining the abnormal data packet characteristics corresponding to the pending attack data packets based on the matching result between the queue proportion of the pending attack data packets and the third preset threshold, the method further includes: Determine whether the traffic growth rate of the LARS queue is greater than the fourth preset threshold within the corresponding monitoring period; If so, determine the matching result between the queue proportion of the pending attack data packets and the third preset threshold; Otherwise, the traffic growth rate of the corresponding data flow to the target device is re-determined to see if it is greater than the first preset threshold, so as to update the pending attack data packets and the queue proportion.

5. The method according to claim 4, characterized in that, Based on the matching result between the queue proportion of the pending attack data packets and the third preset threshold, the abnormal data packet characteristics corresponding to the pending attack data packets are determined, specifically including: If the matching result is that the proportion of the queue is greater than the third preset threshold, corresponding abnormal data packet characteristics are generated according to each pending attack data packet; If the matching result is that the proportion of the queue is less than or equal to the third preset threshold, the pending attack data packet is determined to be a non-attack data packet, and it is determined in real time whether the traffic growth rate of the LARS queue is greater than the fourth preset threshold within the corresponding monitoring period.

6. The method according to claim 5, characterized in that, Based on the pending attack data packets, corresponding abnormal data packet characteristics are generated, specifically including: Determine the size of each of the proposed attack packets; Based on the size of each of the pending attack data packets, determine the corresponding mean and variance of the data packets; Based on the mean and variance of the data packets, determine the distribution range of the abnormal data packets; The average value of the data packets and the distribution range of the data packets are used as the characteristics of the abnormal data packets.

7. The method according to claim 1, characterized in that, Based on the characteristics of the abnormal data packets, corresponding data packet removal is performed on each data packet in the data stream, specifically including: Determine whether the size of each data packet in the data stream falls within the data packet distribution range corresponding to the abnormal data packet characteristics; Data packets whose size falls within the data packet distribution range corresponding to the abnormal data packet characteristics in the data stream are discarded to eliminate abnormal data packets.

8. The method according to claim 1, characterized in that, The method further includes: The number of times the data stream's traffic growth rate exceeds the first preset threshold is determined within a preset continuous monitoring period; If the number of monitoring sessions exceeds a first preset value, the corresponding pending attack data packets and their queue proportions are determined.

9. The method according to claim 1, characterized in that, Based on the characteristics of the abnormal data packets, after removing the corresponding data packets from the data stream, the method further includes: Obtain the data stream after removing abnormal data packets, and determine the data traffic statistics of the abnormal data packets in the data stream; If the data traffic statistics value is less than a second preset value, a defense change instruction is generated and sent to the forwarding device that forwards the data flow, so as to protect the data flow to the defense target device according to the preset data protection strategy.

10. A distributed denial-of-service (DDoS) attack defense device, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform a distributed denial-of-service (DDoS) attack defense method according to any one of claims 1-9.

Images