A method, system and device for defending against SIP flooding attacks based on feedback algorithm

Abstract

The application discloses a SIP Flooding attack defense method, system and device based on a feedback algorithm, relates to the fields of VOIP network security and IP communication technology, and comprises the following steps: S01, monitoring is carried out at an application layer, and INVITE data packets initiated by a user are acquired; S02, a corresponding access rate of the INVITE data packets is calculated before the INVITE data packets enter a processing flow; S03, a feedback rate is calculated in combination with a CPU occupancy rate corresponding to the INVITE data packets and a user access number; and S04, when the access rate is greater than the feedback rate, flow limiting on the corresponding user is started. According to the application, monitoring is carried out at the application layer instead of the network layer, so that the situation that a call with relatively large flow is mistakenly killed can be prevented, the SIP Flooding attack can be prevented, and normal client use is not affected.

Description

Technical Field

[0001] This invention belongs to the fields of VoIP network security and IP communication technology, and in particular relates to a SIP Flooding attack defense method, system and device based on feedback algorithm. Background Technology

[0002] With the maturity of VoIP technology, SIP (Session Initiation Protocol) is being used more and more widely in networks. The call setup process based on SIP is shown in the attached manual. Figure 2 As shown, DoS attacks targeting SIP are increasing, and DoS attacks have become the primary security concern for converged networks.

[0003] For example, Chinese patent CN103166926B provides a distributed defense system for SIP DDoS attacks and its load balancing method, including a defense detection node connected to a load balancer, used to report load information to the load balancer in real time and share a rule base; and a load balancer connected to multiple defense detection nodes, used to distribute SIP messages to each defense detection node and update the load table of the defense node according to the load information sent by the defense detection node. The distributed structure offers high message processing capabilities and good scalability; the load balancing method based on detection algorithms achieves a high attack detection rate and a low false positive rate; the load distribution algorithm ensures good load balancing characteristics for each node; and Chinese patent CN112910927A provides a SIP registration method for defending against external network attacks, including static and dynamic defense rules. The static defense rules restrict the allowed IP addresses for registration; the dynamic defense rules determine whether the password verification during the SIP registration request is successful. If unsuccessful, the error count for the extension number under the IP address is increased. When the error count exceeds a threshold, the IP address is restricted from registering extension numbers; when the number of extension numbers restricted from registration under an IP address exceeds a threshold for the number of extensions not allowed to be registered, the IP address is restricted from registering any extension number.

[0004] However, if a hacker sends a large number of forged INVITE packets to the SIP proxy server in a short period, the SIP proxy server's resources will be consumed rapidly, causing it to crash. Current defenses against SIP attacks rely on network layer analysis of IP traffic. If IP traffic exceeds a threshold, the corresponding IP is blacklisted. This method is simple, requiring only basic IP traffic statistics for defense, with no additional hardware or software overhead. However, its drawbacks cannot be ignored, such as:

[0005] 1. Due to the limited number of public IP addresses in the public network environment, many devices share a single public IP address through NAT technology. Traditional technology can cause other normal devices in the same NAT environment to be "falsely blocked" and unable to use services normally.

[0006] 2. SIP is an application layer streaming media protocol. Media packets may have a large amount of traffic, which may accidentally trigger the blacklist mechanism. Summary of the Invention

[0007] The purpose of this invention is to provide a SIP Flooding attack defense method, system, and device based on a feedback algorithm. By limiting the rate of specific packets rather than IP addresses, and by monitoring at the application layer rather than the network layer, it can prevent false positives from being triggered when there is a large amount of traffic during a call, thus solving the existing problems.

[0008] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0009] As a first aspect of the present invention, the present invention is a SIP Flooding attack defense method based on a feedback algorithm, comprising the following steps:

[0010] Step SS01: Monitor at the application layer and obtain the INVITE data packet initiated by the user;

[0011] Step SS02: Calculate the corresponding access rate of the INVITE data packet before it enters the processing flow;

[0012] Step SS03: Calculate the feedback rate by combining the CPU utilization and user access count corresponding to the INVITE data packet. The calculation method for the feedback rate is as follows:

[0013]

[0014] Among them, V ref The feedback rate is given by k, a constant is given by n, the number of user accesses is given by x, the CPU utilization rate is given by e, and the natural constant is given by e.

[0015] Step SS04: When the access rate is greater than the feedback rate, rate limiting is started for the corresponding user.

[0016] As a second aspect of the present invention, the present invention provides a SIP Flooding attack defense system based on a feedback algorithm, the system being used to implement the method described in the first aspect, the system comprising:

[0017] Monitoring module: It is used to monitor user behavior at the application layer and obtain INVITE data packets initiated by each user;

[0018] Rate conversion module: It calculates the corresponding access rate of the INVITE data packet before it enters the processing flow;

[0019] Feedback calculation module: It is used to calculate the feedback rate based on CPU utilization and the number of user accesses;

[0020] The judgment module compares the access rate and the feedback rate, and transmits the comparison result to the traffic balancing module.

[0021] Traffic balancing module: Based on the access rate and feedback rate, it limits the traffic for the corresponding user when the access rate is greater than the feedback rate.

[0022] As a third aspect of the present invention, the present invention provides a SIP Flooding attack defense device based on a feedback algorithm, the device comprising:

[0023] A memory and a processor communicatively connected to the memory;

[0024] The memory is configured to store program code or instruction set, which is loaded and executed by the processor to implement the attack defense method described in the first aspect.

[0025] The present invention has the following beneficial effects:

[0026] This invention monitors at the application layer, rather than the network layer, which prevents false positives due to high traffic during calls. It can protect against SIP Flooding attacks without affecting normal client usage.

[0027] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of the SIP Flooding attack defense method based on feedback algorithm of the present invention;

[0030] Figure 2 Establish a flowchart for SIP-based calls. Detailed Implementation

[0031] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0032] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0033] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0034] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0035] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0036] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0037] Example 1:

[0038] like Figure 1As shown, as an embodiment of the present invention, preferably, the present invention is a SIP Flooding attack defense method based on a feedback algorithm, comprising the following steps:

[0039] Step SS01: Monitor at the application layer to obtain the INVITE data packet initiated by the user. Monitoring at the application layer, rather than the network layer, can prevent the call from being mistakenly blocked due to high data usage during the call.

[0040] Step SS02: Calculate the access rate of the INVITE packet before it enters the processing flow, and perform rate limiting on specific packets (based on users) rather than on IP addresses;

[0041] Step SS03: Calculate the feedback rate by combining the CPU utilization and user access count corresponding to the INVITE data packet. The calculation method for the feedback rate is as follows:

[0042]

[0043] Among them, V ref Here, k is the feedback rate, n is the number of user accesses (n≥0), x is the CPU utilization rate, and e is the natural constant (e=2.718281828459045).

[0044] As an embodiment of the present invention, preferably, the k value is used to adjust the steepness of the curve. In actual engineering, the k value can be adjusted according to the needs, and the default value is k=5.

[0045] Step SS04: When the access rate exceeds the feedback rate, rate limiting is applied to the corresponding user. This protects against SIP Flooding attacks without affecting normal client usage. Specifically, if V is greater than V... ref Then, rate limiting will begin on the user's corresponding connection. Simultaneously, because V is larger this time, CPU utilization will increase, which will rapidly reduce V. ref This will cause the user's corresponding connection to quickly enter rate-limiting mode.

[0046] Step SS05: As Figure 1 As shown, if the access rate is less than or equal to the feedback rate, an INVITE packet is sent to Callee to recalculate Vref and compare the recalculated Vref with the access rate (i.e., loop steps SS04-SS05).

[0047] Example 2:

[0048] As another embodiment of the present invention, the present invention is a SIP Flooding attack defense system based on a feedback algorithm. The system is used to implement the method described in Embodiment 1, and the system includes:

[0049] Monitoring module: It is used to monitor user behavior at the application layer and obtain INVITE data packets initiated by each user;

[0050] Rate conversion module: It calculates the corresponding access rate of the INVITE data packet before it enters the processing flow;

[0051] Feedback calculation module: It is used to calculate the feedback rate based on CPU utilization and the number of user accesses;

[0052] The judgment module compares the access rate and the feedback rate, and transmits the comparison result to the traffic balancing module.

[0053] Traffic balancing module: Based on the access rate and feedback rate, it limits the traffic for the corresponding user when the access rate is greater than the feedback rate.

[0054] Example 3:

[0055] As another embodiment of the present invention, the present invention is a SIP Flooding attack defense device based on a feedback algorithm, the device comprising:

[0056] A memory and a processor communicatively connected to the memory;

[0057] The memory is configured to store program code or instruction set, which is loaded and executed by the processor to implement the attack defense method described in Embodiment 1.

[0058] A method, system, and device for defending against SIP Flooding attacks based on a feedback algorithm are disclosed. By monitoring at the application layer rather than the network layer, this can prevent false positives during high-bandwidth calls. This approach can protect against SIP Flooding attacks without affecting normal client usage.

[0059] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0060] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A SIP Flooding attack defense method based on a feedback algorithm, characterized in that, Includes the following steps: Step SS01: Monitor at the application layer and obtain the INVITE data packet initiated by the user; Step SS02: Calculate the corresponding access rate of the INVITE data packet before it enters the processing flow; Step SS03: Calculate the feedback rate by combining the CPU utilization rate corresponding to the INVITE data packet and the number of user accesses; Step SS04: When the access rate exceeds the feedback rate, start rate limiting for the corresponding user; In step SS03, the feedback rate is calculated as follows: ； Among them, V ref Here, k is the feedback rate, n is the number of user accesses, x is the CPU utilization rate, and e is the natural constant.

2. A SIP Flooding attack defense system based on a feedback algorithm, characterized in that, The system is used to implement the method of claim 1, and the system comprises: Monitoring module: It is used to monitor user behavior at the application layer and obtain INVITE data packets initiated by each user; Rate conversion module: It calculates the corresponding access rate of the INVITE data packet before it enters the processing flow; Feedback calculation module: It is used to calculate the feedback rate based on CPU utilization and the number of user accesses; according to the formula Calculate the feedback rate; where V ref The feedback rate is given by k, a constant is given by n, the number of user accesses is given by x, the CPU utilization rate is given by e, and the natural constant is given by e. The judgment module compares the access rate and the feedback rate, and transmits the comparison result to the traffic balancing module. Traffic balancing module: Based on the access rate and feedback rate, it limits the traffic for the corresponding user when the access rate is greater than the feedback rate.

3. A SIP Flooding attack defense device based on a feedback algorithm, characterized in that, The device includes: A memory and a processor communicatively connected to the memory; The memory is configured to store program code or instruction set, which is loaded and executed by the processor to implement the attack defense method as described in claim 1.

Images