A DDoS defense system and method

Abstract

The present invention belongs to the field of network security technology and specifically discloses a DDoS defense system and method, including: determining whether a client has a forged IP address; a server performing IP filtering on access requests from the client, classifying the client IP address into those with or without a history of access; and further determining whether the IP address is a trusted IP address, a whitelisted IP address, or a blacklisted IP address. The system then randomly retrieves a client from the trusted IP list in real time to determine whether communication between the client and the server is normal. The system can accurately detect DDoS attacks through multiple determinations and save the botnet IP addresses in an IP blacklist, effectively preventing further attacks from the same botnet.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a DDoS defense system and method. Background Art

[0002] With the increasing application of internet technologies, network security issues are becoming increasingly prominent. DDoS attacks, due to their simplicity and wide reach, have become a common attack method used by hackers. While DDoS attacks are technically low-tech, their wide reach can cause communication between clients and servers to become sluggish, and in severe cases, paralyze servers. Consequently, DDoS defenses are becoming increasingly common.

[0003] Chinese patent publication number CN105592070A discloses an application-layer DDoS defense method and system. This method uses client action information to determine whether a user is legitimate, then sends a key to the legitimate user for communication. This effectively defends against DDoS attacks without impacting web services. While this solution uses client action information to determine user legitimacy, it can eliminate botnets that could potentially cause DDoS attacks. However, this approach has the drawback of classifying a small number of legitimate users as botnets. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects in the prior art and provide a DDoS defense system and method.

[0005] A first aspect of the present invention provides a DDoS defense method, comprising:

[0006] Step 1: Determine whether the client has a fake IP; if so, block the IP access request and store the IP in the IP blacklist; if not, establish communication between the client and the server via the TCP protocol;

[0007] Step 2: The server performs IP filtering on access requests from the client, dividing the client's IP into IPs with no access history and IPs with access history. The server determines whether the access history of the IP with access history meets the trusted user conditions, and stores the IPs that meet the trusted user conditions in the IP trusted list. The IPs that do not meet the trusted user conditions are stored in the IP blacklist and the IP access request is blocked. The server determines whether the IP with no access history meets the blacklist user conditions, and stores the IPs that meet the blacklist user conditions in the IP blacklist. Otherwise, the IPs are stored in the IP whitelist.

[0008] Step 3: The server communicates with the IPs in the IP whitelist and the IP trusted list, and randomly retrieves a client from the IP trusted list in real time to determine whether the client and the server are communicating normally. If so, the server communication is maintained with the current domain name, and the IPs in the IP whitelist are transferred to the IP trusted list; if not, a dynamic domain name is used, which is bound to different IPs, and each IP is set with a different access port.

[0009] Step 4: The server sends the access port link corresponding to the dynamic domain name to the client in the IP trusted list.

[0010] A further solution is that in step 1, determining whether the IP is forged includes: connecting the client and the server through a router, using a routing device / routing gateway to detect the client's IP, and determining whether the client's source address IP belongs to the network segment where the routing device / routing gateway is located. If so, it is considered that the client's IP has not been forged; if not, it is considered that the client's IP is forged.

[0011] A further solution is that in step 2, the trusted user condition includes: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time. If the access frequency and communication speed are both greater than the set threshold, the access IP is considered to be a trusted user.

[0012] A further solution is to determine the blacklist user conditions including: the server obtains the access content of the client with no access history, and determines whether the access content is valid. If it is determined to be invalid content, the client is a blacklist IP, and the server refuses to respond to the current request.

[0013] A further solution is that the determination of invalid content includes at least the number of characters in the accessed content.

[0014] A further solution is that in step 3, the method for determining whether the communication between the client and the server is normal includes: obtaining the current communication speed between the client and the server, comparing it with the set communication speed threshold, and if it is greater than the communication speed threshold, it is considered that the communication between the client and the server is normal.

[0015] A second aspect of the present invention provides a DDoS protection system, comprising:

[0016] The first judgment module is used to determine whether the client has a forged IP; if so, block the IP access request and store the IP in the IP blacklist; if not, establish communication between the client and the server through the TCP protocol;

[0017] The IP filtering module is used to filter access requests from clients and classify client IPs into those with no access history and those with access history;

[0018] The second judgment module is used to judge whether the access history of the IP with access history meets the trusted user conditions, and store the IP that meets the trusted user conditions in the IP trusted list, and store the IP that does not meet the trusted user conditions in the IP blacklist and block the IP access request;

[0019] The third judgment module is used to judge whether the IP with no access history meets the blacklist user conditions, and store the IP that meets the blacklist user conditions in the IP blacklist, otherwise it is stored in the IP whitelist;

[0020] The communication speed detection module is used to randomly select a client from the IP trusted list and detect the communication speed between the selected client and the server;

[0021] a threshold comparison module, configured to compare the communication speed detected by the communication speed detection module with a communication speed threshold to determine whether the server is under a DDoS attack;

[0022] Dynamic domain name module is provided to change the server domain name and bind different IP addresses to the changed domain name. Each IP address has a different access port.

[0023] The sending module is used to send the link of the access port to the client in the IP trusted list.

[0024] A further solution is that the first judgment module includes a routing device / routing gateway, and the routing device / routing gateway detects the IP of the client and determines whether the source address IP of the client belongs to the network segment where the routing device / routing gateway is located.

[0025] A further solution is that when the second judgment module judges the trusted user conditions, it includes: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time. If the access frequency and communication speed are both greater than the set threshold, the access IP is considered to be a trusted user.

[0026] A further solution is that the third judgment module is further used to obtain the number of access characters of the client with no access history, and compare the number of characters with a character threshold to determine whether the accessed content is invalid content.

[0027] Compared with the prior art, the beneficial effect of the present invention is that: after multiple judgments, the present invention can accurately detect DDoS attacks and save the broiler IP in the IP blacklist, which can effectively prevent the same broiler from attacking again. Specifically, by judging whether there is a forged IP in the client, the broiler can be shielded at the transport layer; by judging whether the access history of the IP with access history meets the trusted user condition, the IP that meets the trusted user condition is stored in the IP trusted list, and the IP that does not meet the trusted user condition is stored in the IP blacklist and the IP access request is shielded; by judging whether the IP without access history meets the blacklist user condition, the IP that meets the blacklist user condition is stored in the IP blacklist, otherwise it is stored in the IP whitelist. Since all the users in the IP trusted list are legitimate users, the legitimate user is randomly called to detect the communication status between the legitimate user and the server to determine whether the server is under DDoS attack. When the server is under DDoS attack, the legitimate client uses the modified access port for normal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The following drawings are merely provided for illustrative purposes only and are not intended to limit the scope of the present invention.

[0029] Figure 1 : Flow chart of the method of the present invention;

[0030] Figure 2 : Schematic diagram of system connection of the present invention;

[0031] In the figure: 1. Client; 2. Intermediate processing component; 3. First judgment module; 4. IP filtering module; 5. Second judgment module; 6. Third judgment module; 7. Communication speed detection module; 8. Threshold comparison module; 9. Server; 10. Dynamic domain name provision module; 11. Sending module. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution, design method and advantages of the present invention more clear, the present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0033] DDoS attacks primarily monopolize the target server's bandwidth resources. However, the TCP protocol requires a three-way handshake for connection, so DDoS attacks also involve occupying the target server's connection resources. Each time a server establishes a TCP connection with a client, it stores the connection information in a connection table for maintenance. However, the connection information stored in the connection table is limited. Zombie servers can initiate a large number of TCP connections, filling up the server's connection table and making it unable to respond to subsequent TCP connection requests, a phenomenon known as a TCP flood. This directly impacts the transport layer between the client and the server. However, because of the three-way handshake, botnet servers cannot hide by forging IP addresses. In other words, if they forge an IP address, they will not be able to receive the second handshake from the server. In this embodiment, a routing device / routing gateway can detect whether a client has a forged IP address.

[0034] The process of a network access is as follows: the client sends a request to the remote server through the network line, the server calculates or queries the corresponding data according to the client's request, and then sends it to the client through the network line. After the bot establishes a TCP connection with the server, if a large number of invalid access requests are sent, it will still affect the usage experience of the legitimate client. Therefore, in this embodiment, the number of characters in the request content from the client is also judged to determine whether the request is an invalid request, thereby ensuring the normal experience of the legitimate client.

[0035] For actual DDoS attacks, if a large number of zombie computers flood in at once, existing servers can quickly determine whether they are under DDoS attack. However, for DDoS attacks in batches or small batches, the server cannot quickly determine whether it is under DDoS attack, and these batches and small batches of DDoS attacks will still affect the normal use of legitimate clients. Therefore, in order to quickly determine whether the current server is under DDoS attack, in this embodiment, the communication speed between trusted users (i.e., legitimate clients) and the server is also monitored in real time to determine whether it is under DDoS attack, so that when it is attacked, a backup plan can be quickly activated.

[0036] Example 1

[0037] This embodiment provides a DDoS defense method, wherein the server and the client are connected in a network environment, wherein the client is a variety of electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, portable computers and desktop computers, etc. Figure 1 As shown, the method includes:

[0038] A client connects to a server. During the connection, a determination is made as to whether the client has a forged IP address. If so, the IP access request is blocked and the IP address is stored in an IP blacklist. If not, communication is established between the client and the server via the TCP protocol. The method for determining whether a forged IP address exists is as follows: the client and the server are connected via a router, a routing device / routing gateway is used to detect the client's IP address, and a determination is made as to whether the client's source IP address belongs to the network segment of the routing device / routing gateway. If so, the client's IP address is deemed to be unforged; if not, the client's IP address is deemed to be forged. In this embodiment, the method for determining whether a forged IP address exists is not limited to the above method. Alternatively, the routing device / routing gateway may be used to obtain the path of the IP address and determine whether a forged IP address exists based on path logic.

[0039] In a network access request, the client and server are connected through a routing device or routing gateway. At the user device's access point, the device connects to the Internet Service Provider (ISP) through a router. Therefore, if the routing device detects the IP address and filters out data whose source IP address does not belong to the network segment of the router, traffic with forged IP addresses cannot be sent. Different network segments on the Internet are connected by multiple routers. A piece of data sent from user a to a server may pass through multiple routes, i.e., traffic paths. While the IP address of user a can be forged during data transmission, the path from user a to the server cannot be changed. Therefore, if the routing device or routing gateway detects a problem with the path based on the IP address path logic, it can also filter out the problematic IP traffic.

[0040] The server performs IP filtering on access requests from clients. Specifically, before the IP request reaches the server, the client's IP is first filtered, and the client's IP is divided into IPs with no access history and IPs with access history; it is determined whether the access history of the IP with access history meets the trusted user conditions, and the IPs that meet the trusted user conditions are stored in the IP trusted list, and the IPs that do not meet the trusted user conditions are stored in the IP blacklist and the IP access request is blocked; it is determined whether the IP with no access history meets the blacklist user conditions, and the IPs that meet the blacklist user conditions are stored in the IP blacklist, otherwise they are stored in the IP whitelist. Among them, the conditions for judging trusted users include: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time. If the access frequency and communication speed are both greater than the set threshold, the access IP is considered to be a trusted user. Generally speaking, after the client selects a server, it will use the server for a long time, and its usage frequency should be at least greater than 1. If the communication speed is fast or normal during use, it can be said that the server has not been attacked by DDoS during the client's previous access process. Therefore, these clients can be judged as trusted users; conversely, if the access frequency of an IP with a history of access is small, and similar problems such as network lag or server crash occur during the access process, then the IP is considered to not meet the trusted user conditions. The conditions for judging blacklist users include: the server obtains the access content of the client without a history of access, and determines whether the access content is valid. If it is determined to be invalid content, the client is a blacklisted IP, and the server refuses to respond to the current request. The determination of invalid content at least includes the number of characters in the access content. During a DDoS attack, a large number of zombie machines are remotely controlled by the attacker to send requests to the server. Therefore, the content of the request sent is generally meaningless or has very few characters, or the content of the request sent is the same. Therefore, in this embodiment, a character count threshold for access content can be pre-set. If the number of characters accessed is less than the character count threshold, the content of the access request can be considered invalid. If a large amount of request information has no specific meaning, the content of the request is also considered invalid. Or if a large number of identical request contents are received within a period of time, the content of the request is also considered invalid. In order to ensure normal communication of legitimate clients, in this embodiment, the server does not respond to invalid content.

[0041] The server communicates data with the IPs in the IP whitelist and the IP trusted list, and randomly retrieves a client from the IP trusted list in real time to determine whether the client and the server are communicating normally. If so, the current domain name is maintained to run the server communication, and the IPs in the IP whitelist are transferred to the IP trusted list; if not, a dynamic domain name is used, and the dynamic domain name is bound to different IPs, and each IP is correspondingly set with a different access port; wherein, in step 3, the method for determining whether the client and the server are communicating normally includes: obtaining the current communication speed between the client and the server, and comparing it with a set communication speed threshold. If it is greater than the communication speed threshold, it is considered that the client and the server are communicating normally.

[0042] Since users on the trusted IP list are legitimate, real-time network communication speeds can be used to determine whether a server is under a DDoS attack. To prevent the server from mistakenly believing it is under a DDoS attack due to slow communication speeds caused by legitimate users' own network issues, the selection process for legitimate users should avoid selecting the same user for a long period of time and instead adopt a random selection strategy. Immediately after selection, the user's communication speed is tested and compared with a pre-set communication speed threshold. If the speed falls below the threshold, it can be preliminarily determined that the server is under a DDoS attack. To ensure normal use for legitimate users, in this embodiment, the server uses dynamic domain names. Each dynamic domain name is bound to an IP address, and each IP address is assigned a different access port. This prevents botnet users from determining the server's new IP address, thus preventing the DDoS attack from affecting the user experience of trusted users. When the server is determined to be under DDoS attack, for example, multiple zombies simultaneously attack port 8080, then port 8080 is stopped and the backend interface is changed to 8081. Therefore, the DDoS attack on port 8080 becomes an invalid attack. If the attack on port 8081 is carried out again, port 8081 is also stopped and the backend interface is changed to 8082 to provide services for the front-end trusted users.

[0043] The server sends the access port link corresponding to the dynamic domain name to the clients in the IP trusted list. It should be noted that the IP trusted list here is updated in real time, so the server will send the access port link to the updated IP trusted list to ensure that legitimate clients are not affected.

[0044] Example 2

[0045] This embodiment provides a DDoS defense system, such as Figure 2 Shown, including:

[0046] The first judgment module 3 is used to determine whether the client 1 has a forged IP; if so, the IP access request is blocked and the IP is stored in the IP blacklist; if not, the client 1 establishes communication with the server 9 via the TCP protocol;

[0047] The IP filtering module 4 is used to filter the access request from the client 1 and classify the IP of the client 1 into IP with no access history and IP with access history;

[0048] The second judgment module 5 is used to judge whether the access history of the IP with access history meets the trusted user condition, and store the IP that meets the trusted user condition in the IP trusted list, and store the IP that does not meet the trusted user condition in the IP blacklist and block the IP access request;

[0049] The third judgment module 6 is used to judge whether the IP with no access history meets the blacklist user conditions, and store the IP that meets the blacklist user conditions in the IP blacklist, otherwise store it in the IP whitelist;

[0050] The communication speed detection module 7 is used to randomly select a client 1 from the IP trusted list and detect the communication speed between the selected client 1 and the server 9;

[0051] a threshold comparison module 8, which compares the communication speed detected by the communication speed detection module with a communication speed threshold to determine whether the server 9 is under DDoS attack;

[0052] Dynamic domain name providing module 10, used to change the domain name of server 9 and bind different IP addresses to the changed domain name, each IP address is set with a different access port;

[0053] The sending module 11 is used to send the link of the access port to the client 1 in the IP trusted list.

[0054] In the above, the first judgment module 3 includes a routing device / routing gateway, which detects the IP of the client 1 and determines whether the source IP address of the client 1 belongs to the network segment where the routing device / routing gateway is located.

[0055] In the above, when judging the trusted user condition, the second judgment module 5 includes: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time. If the access frequency and the communication speed are both greater than the set threshold, the access IP is considered to be a trusted user.

[0056] In the above, the third judgment module 6 is further configured to obtain the number of access characters of the client 1 with no access history, and compare the number of characters with the character threshold to determine whether the accessed content is invalid. The server 9 sends the access port link to the updated IP trusted list to ensure that the legitimate client 1 is not affected.

[0057] While various embodiments of the present invention have been described above, the above descriptions are intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A DDoS defense method, characterized in that: include: Step 1: Determine whether the client has a fake IP; If yes, block the IP access request and store the IP in the IP blacklist; If not, establish communication between the client and the server through the TCP protocol; Step 2: The server performs IP filtering on access requests from the client, classifying the client's IP into those with and without access history. The server then determines whether the access history of the IP with access history meets the trusted user criteria, stores the IPs that meet the trusted user criteria in the IP trusted list, and stores the IPs that do not meet the trusted user criteria in the IP blacklist, blocking the IP access request. Determine whether the IP with no access history meets the blacklist user conditions, and store the IP that meets the blacklist user conditions in the IP blacklist, otherwise store it in the IP whitelist; The conditions for determining a trusted user include: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time. If the access frequency and the communication speed are both greater than a set threshold, the access IP is considered to be a trusted user; Step 3: The server communicates with the IPs in the IP whitelist and the IP trusted list, and randomly retrieves a client from the IP trusted list in real time to determine whether the client and the server are communicating normally. If so, the server communication is maintained with the current domain name, and the IPs in the IP whitelist are transferred to the IP trusted list; if not, a dynamic domain name is used, which is bound to different IPs, and each IP is set with a different access port. Step 4: The server sends the access port link corresponding to the dynamic domain name to the client in the IP trusted list.

2. A DDoS defense method according to claim 1, characterized in that: In step 1, determining whether the IP is forged includes: connecting the client and the server through a router, using a routing device / routing gateway to detect the client's IP, and determining whether the client's source address IP belongs to the network segment where the routing device / routing gateway is located. If so, it is considered that the client's IP has not been forged; if not, it is considered that the client's IP is forged.

3. A DDoS defense method according to claim 2, characterized in that: The conditions for determining blacklist users include: the server obtains the access content of the client with no access history, and determines whether the access content is valid. If it is determined to be invalid content, the client is a blacklist IP, and the server refuses to respond to the current request.

4. A DDoS defense method according to claim 3, characterized in that: The determination of invalid content includes at least the number of characters of the accessed content.

5. A DDoS defense method according to claim 1, characterized in that: In step 3, the method for determining whether the communication between the client and the server is normal includes: obtaining the current communication speed between the client and the server, comparing it with a set communication speed threshold, and if it is greater than the communication speed threshold, it is considered that the communication between the client and the server is normal.

6. A DDoS defense system, characterized in that: include: The first judgment module is used to judge whether the client has a forged IP; If yes, block the IP access request and store the IP in the IP blacklist; If not, establish communication between the client and the server through the TCP protocol; The IP filtering module is used to filter access requests from clients and classify client IPs into those with no access history and those with access history; The second judgment module is used to judge whether the access history of the IP with access history meets the trusted user conditions, and store the IP that meets the trusted user conditions in the IP trusted list, and store the IP that does not meet the trusted user conditions in the IP blacklist and block the IP access request; When determining the trusted user condition, the second judgment module includes: obtaining the access frequency of the access IP and the communication speed of the access history within a unit time, and if the access frequency and the communication speed are both greater than a set threshold, then the access IP is considered to be a trusted user; The third judgment module is used to judge whether the IP with no access history meets the blacklist user conditions, and store the IP that meets the blacklist user conditions in the IP blacklist, otherwise it is stored in the IP whitelist; The communication speed detection module is used to randomly select a client from the IP trusted list and detect the communication speed between the selected client and the server; a threshold comparison module, which compares the communication speed detected by the communication speed detection module with a communication speed threshold to determine whether the server is under DDoS attack; Dynamic domain name module is provided to change the server domain name and bind different IP addresses to the changed domain name. Each IP address has a different access port. The sending module is used to send the link of the access port to the client in the IP trusted list.

7. A DDoS defense system according to claim 6, characterized in that: The first judgment module includes a routing device / routing gateway, which detects the IP address of the client and determines whether the source address IP address of the client belongs to the network segment where the routing device / routing gateway is located.

8. A DDoS defense system according to claim 7, characterized in that: The third judgment module is further configured to obtain the number of access characters of the client with no access history, and compare the number of characters with a character threshold to determine whether the accessed content is invalid content.

Images