DoS attack countermeasure device and DoS attack countermeasure program

Abstract

An access permission determination unit (40) determines whether the target server (12) can be accessed from the target access source based on a blacklist (34) indicating access sources prohibited from accessing the target server (12) or a whitelist (36) indicating access sources permitted to access the target server (12). If it is determined that the target server (12) cannot be accessed by the target access source, the access control unit (44) prevents the target access source from accessing the target server (12) but allows the target access source to access a virtual server (14) that simulates the target server (12).

Description

Technical Field

[0001] The present invention relates to a DoS attack response device and a DoS attack response program. Background Art

[0002] Sometimes, offensive operations are carried out through the Internet targeting computer information systems, computer networks, infrastructure, or personal computer equipment. Such offensive operations are called cyber attacks.

[0003] There are various types of network attacks, among which there is a DoS (Denial of Service) attack. A DoS attack is an attack that increases the number of visits to a server that provides services and intentionally overloads the server. In addition, there are also various types of DoS attacks, such as a DDoS (Distributed DoS) attack in which multiple machines simultaneously attack a single server, and an EDoS (Economic DoS) attack in which the victim suffers economic losses.

[0004] In the past, a technology for detecting DoS attacks has been proposed. For example, Patent Document 1 discloses an intrusion detection and prevention device that is set between a router and a DDoS attack defense target host in a communication path and detects a suspected DDoS attack based on the service flow to the DDoS attack defense target host. In addition, Patent Document 2 discloses a server that, when multiple access requests are sent from the same request source in a short period of time, there is a possibility of a DoS attack, and therefore, the request source is registered in an access denial list, and packets from the request source are cut off and not sent to the request destination.

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: Japanese Patent Application Publication No. 2006-50081

[0008] Patent Document 2: International Publication No. 2009 / 066344 Summary of the invention

[0009] Problems to be solved by the invention

[0010] As described above, conventionally, technologies for detecting DoS attacks or technologies for blocking DoS attacks have been proposed. However, as such technologies have developed, the sophistication of DoS attacks has also increased, and conventional technologies may not be sufficient as countermeasures against DoS attacks.

[0011] The server targeted by the attacker who is carrying out the DoS attack is a server that is providing services or other servers that are operating normally. It is believed that there are fewer attackers who want to launch a DoS attack on a server that is no longer able to provide services (e.g., a paralyzed server). Therefore, it is believed that if the attacker who is carrying out the DoS attack can be made to mistakenly believe that the server targeted by the DoS attack is paralyzed, the DoS attack from the attacker can be stopped.

[0012] The purpose of the DoS attack countermeasure device disclosed in this specification is to make an attacker who conducts a DoS attack on a target server mistakenly believe that the target server has crashed, thereby stopping the DoS attack on the target server.

[0013] Means for solving problems

[0014] The DoS attack response device disclosed in this specification is characterized in that it has: an access permission determination unit, which determines whether the target server can be accessed from a concern access source based on an access permission list showing access sources that are allowed or prohibited from accessing the target server; and an access control unit, which, when it is determined that the concern access source cannot access the target server, does not allow the concern access source to access the target server, but allows the concern access source to access a virtual server that simulates the target server.

[0015] Alternatively, the DoS attack response device may be capable of operating in a normal mode or an emergency mode, wherein in the normal mode, the access permission determination unit determines whether the target server is accessible from the access source of interest based on a blacklist of the access permission list indicating access sources prohibited from accessing the target server, and in the emergency mode, the access permission determination unit determines whether the target server is accessible from the access source of interest based on a whitelist of the access permission list indicating access sources permitted to access the target server, and the DoS attack response device further includes a mode switching unit, which causes the DoS attack response device to operate in the normal mode when the access load of the target server is less than a first threshold value, and which causes the DoS attack response device to operate in the emergency mode when the access load of the target server is greater than the first threshold value.

[0016] Alternatively, when the access control unit detects an access source that has carried out a DoS attack on the target server when the DoS attack response device is operating in the emergency mode, the access control unit may gradually expand the range of access sources accessing the virtual server starting from the access source that has carried out a DoS attack on the target server based on the whitelist and in accordance with the access load of the target server.

[0017] In addition, the DoS attack response device disclosed in this specification has an access control unit, which, when detecting an access source that has launched a DoS attack on a target server, cuts off access to the target server from the access source and then allows the access source to access a virtual server that simulates the target server.

[0018] In addition, the DoS attack response program disclosed in the present specification is characterized in that the DoS attack response program enables the computer to function as the following parts: an access permission determination unit that determines whether the target server can be accessed from a concern access source based on an access permission list showing access sources that are allowed or prohibited from accessing the target server; and an access control unit that, when it is determined that the concern access source cannot access the target server, does not allow the concern access source to access the target server, but allows the concern access source to access a virtual server that simulates the target server.

[0019] In addition, the DoS attack response program disclosed in this specification is characterized in that the DoS attack response program enables the computer to function as an access control unit, which, when detecting an access source that has launched a DoS attack on a target server, cuts off access to the target server from the access source and then causes the access source to access a virtual server that simulates the target server.

[0020] Effects of the Invention

[0021] According to the DoS attack countermeasure device disclosed in this specification, an attacker who carries out a DoS attack on a target server can be misled into believing that the target server has been paralyzed, thereby stopping the DoS attack on the target server. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the structure of the DoS attack response system of this embodiment.

[0023] Figure 2 It is a schematic diagram of the structure of the gateway.

[0024] Figure 3 It is a diagram showing an example of a white list.

[0025] Figure 4 is a flowchart showing the processing flow of the gateway. DETAILED DESCRIPTION

[0026] Figure 1 1 is a schematic diagram of the structure of the DoS attack countermeasure system 10 of the present embodiment. The DoS attack countermeasure system 10 is configured to include a target server 12, a virtual server 14, and a gateway 16 as a DoS attack countermeasure device.

[0027] The target server 12 is composed of a computer. The target server 12 is connected to the Internet 18 via the gateway 16 and provides services to users who access the target server 12 via the Internet 18. The target server 12 is a server that may become a target of DoS attack and is a server that becomes a target of DoS attack response processing based on the DoS attack response system 10 and the gateway 16.

[0028] The virtual server 14 is also composed of a computer. Like the target server 12, the virtual server 14 is connected to the Internet 18 via the gateway 16. The virtual server 14 is a server that imitates the target server 12. Imitating the target server 12 means that the information disclosed to the user accessing via the Internet 18 is the same as that of the target server 12, and from the perspective of the user accessing via the Internet 18, there is no difference between accessing the target server 12 and accessing the virtual server 14. The virtual server 14 can also be said to be a clone server of the target server 12.

[0029] The gateway 16 is a computer provided between the target server 12 and the Internet 18 and between the virtual server 14 and the Internet 18 in the communication path. Therefore, when the access source wants to access the target server 12 via the Internet 18, it must go through the gateway 16. The details will be described later, and the gateway 16 performs processing such as determining whether the target server 12 can be accessed via the Internet 18, and allowing the access source to access (guide) the target server 12 or the virtual server 14. In addition, the access source is a user terminal used by a user who wants to access the target server 12.

[0030] Figure 2 1 is a schematic diagram of the structure of the gateway 16.

[0031] The communication interface 30 includes, for example, a network adapter, etc. The communication interface 30 is connected to the target server 12 , the virtual server 14 , and the Internet 18 , thereby connecting the gateway 16 to the target server 12 and the virtual server 14 in a communicable manner, and connecting the gateway 16 to the access source via the Internet 18 in a communicable manner.

[0032] The memory 32 is configured to include, for example, eMMC (embedded Multi Media Card), ROM (Read Only Memory) or RAM (Random Access Memory). The memory 32 stores a DoS attack response program for causing each part of the gateway 16 to operate. In addition, the DoS attack response program can be stored in a non-temporary storage medium that can be read by a computer, such as a USB (Universal Serial Bus) memory or a CD-ROM. The gateway 16 reads the storage medium storing the DoS attack response program, thereby being able to execute the DoS attack response program.

[0033] In addition, if Figure 2 As shown, a blacklist 34 as an access permission / denial list and a whitelist 36 as an access permission / denial list are stored in the memory 32 .

[0034] The blacklist 34 is a list of access sources that are prohibited from accessing the target server 12. Without limitation thereto, the blacklist 34 may be, for example, a list of access sources that the gateway 16 has determined to have carried out a DoS attack in the past. In addition, if there is an access source that has been determined to be used by a malicious user, the access source may also be included in the blacklist 34.

[0035] In this embodiment, the domain name of the access source is listed in the blacklist 34 as information indicating the access source. In the blacklist 34, a generalized representation method can be performed including multiple domain names that are prohibited from accessing the target server 12. For example, a top-level domain name (such as ".jp"), a top-level domain name, and a second-level domain name (such as ".co.jp") can be included in the blacklist 34. For example, in the case where a certain top-level domain name is listed in the blacklist 34, all domain names including the top-level domain name are included in the blacklist 34. In addition, the information indicating the access source in the blacklist 34 is not limited to this, and it can also be, for example, the IP address of the access source.

[0036] The whitelist 36 is a list showing access sources that are allowed to access the target server 12. Without being limited to this, the whitelist 36 may also be a list showing access sources that have officially accessed the target server 12 in the past. Here, officially accessing the target server 12 means that the access source accesses the target server 12, does not launch a network attack including a DoS attack on the target server 12, and receives the service provided by the target server 12. In addition, if there is an access source that has been determined to have officially accessed the target server 12, the access source may also be included in the whitelist 36.

[0037] In this embodiment, the domain name of the access source is listed in the white list 36 as information indicating the access source, similarly to the black list 34. In addition, the white list 36 can also be a generalized representation method including a plurality of domain names that are allowed to access the target server 12. In addition, as information indicating the access source in the white list 36, the IP address of the access source may also be used.

[0038] exist Figure 3 An example of a whitelist 36 is shown in FIG. Figure 3 In , the part represented by "xxx" is arbitrary. For example, "xxx.sample.co.jp" includes all domains having ".jp" as a top-level domain, ".co" as a second-level domain, and ".sample" as a subdomain.

[0039] In addition, in the present embodiment, the blacklist 34 and the whitelist 36 are stored in the memory 32 of the gateway 16 , but they may be stored in other devices that can be accessed from the gateway 16 .

[0040] The processor 38 may be configured to include, for example, a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). The processor 38 may not be configured by a single processing device, but may be configured by the cooperation of a plurality of processing devices located in physically separate locations. Figure 2 As shown, the processor 38 functions as an access permission determination unit 40 , a mode switching unit 42 , an access control unit 44 , and a list updating unit 46 according to the DoS attack countermeasure program stored in the memory 32 .

[0041] When receiving an access request for the target server 12 from an access source, the access determination unit 40 determines whether the target server 12 is accessible from the access source based on the blacklist 34 or the whitelist 36 as the access permission list. In this specification, the access source that is the object of the access determination unit 40 to determine whether the target server 12 is accessible (in other words, the access source that has sent the access request for the target server 12) is referred to as the access source of interest. The details of the processing of the access determination unit 40 will be described later together with the processing of the mode switching unit 42.

[0042] The mode switching unit 42 performs processing for switching the operation mode of the gateway 16. In the present embodiment, the gateway 16 has two operation modes, a normal mode and an emergency mode. Therefore, the mode switching unit 42 switches the operation mode of the gateway 16 between the normal mode and the emergency mode.

[0043] The normal mode is an operation mode in which the access permission determination unit 40 determines whether access to the target server 12 is permitted from the target access source based on the blacklist 34 .

[0044] Specifically, in the normal mode, when the gateway 16 receives an access request to the target server 12 from the access source of interest, the access permission determination unit 40 obtains the IP address of the access source of interest. Then, the access permission determination unit 40 sends the IP address as a query to a DNS (Domain Name System) server (not shown) to obtain the domain name corresponding to the IP address (i.e., the access source of interest). On this basis, the access permission determination unit 40 determines whether the obtained domain name is included in the blacklist 34. If the domain name is included in the blacklist 34, it is determined that the access source of interest cannot access the target server 12. If the obtained domain name is not included in the blacklist 34, it is determined that the access source of interest can access the target server 12.

[0045] The emergency mode is an operation mode in which the access permission determination unit 40 determines whether access to the target server 12 is permitted from the access source of interest based on the white list 36 .

[0046] Specifically, in the emergency mode, similar to the normal mode, when the gateway 16 receives an access request to the target server 12 from the access source of interest, the access permission determination unit 40 obtains the domain name of the access source of interest. Based on this, the access permission determination unit 40 determines whether the obtained domain name is included in the whitelist 36. If the obtained domain is included in the whitelist 36, it is determined that the access source of interest can access the target server 12. If the obtained domain is not included in the whitelist 36, it is determined that the access source of interest cannot access the target server 12.

[0047] In the normal mode, access to the target server 12 is allowed from all access sources that are not included in the blacklist 34, and therefore, access to the target server 12 is allowed from unknown access sources (i.e., not included in the blacklist 34 and the whitelist 36). On the other hand, in the emergency mode, access to the target server 12 is allowed only from access sources included in the whitelist 36, and therefore, access to the target server 12 from unknown access sources is not allowed. Therefore, compared with the normal mode, the emergency mode can be said to have stricter access conditions for the target server 12, and it can be said that the target server 12 can be protected more reliably from DoS attacks. On the other hand, compared with the normal mode, in the emergency mode, even if the access source is used by a user without malicious intent, a situation may occur where the access source that is not included in the whitelist 36 is prohibited from accessing the target server 12.

[0048] Therefore, the mode switching unit 42 switches the operation mode of the gateway 16 according to the access load of the target server 12. Specifically, the mode switching unit 42 causes the gateway 16 to operate in the normal mode when the access load of the target server 12 is less than the first threshold value predetermined by the administrator of the DoS attack response system 10, etc., and causes the gateway 16 to operate in the emergency mode when the access load of the target server 12 is greater than the first threshold value. Here, the access load is a value calculated by considering the traffic volume of the target server 12 (the amount of data sent to the target server 12 per unit time), the CPU load, the memory usage, etc. The first threshold value is determined as the access load level when the target server 12 is suspected to be under a DoS attack.

[0049] In normal mode, the target server 12 is less likely to be attacked by DoS, so the access determination unit 40 determines access to the target server 12 based on the blacklist 34, thereby reducing the possibility of erroneously prohibiting access to the target server 12 from an access source used by a non-malicious user.

[0050] On the other hand, in the emergency mode, the target server 12 is more likely to be attacked by DoS, so the access determination unit 40 determines whether the target server 12 is accessible based on the whitelist 36, thereby reducing the possibility of a malicious user accessing the target server 12 and performing a DoS attack, at least compared to the normal mode. In addition, in the emergency mode, access to the target server 12 from unknown access sources is denied, so the emergency mode is also effective against DDoS attacks in which DoS attacks are dispersed from multiple access sources.

[0051] When the access determination unit 40 determines that the access source of interest can access the target server 12, the access control unit 44 allows the access source of interest to access the target server 12. On the other hand, when the access determination unit 40 determines that the access source of interest cannot access the target server 12, the access control unit 44 does not allow the access source of interest to access the target server 12, but rejects the access request from the access source of interest to access the target server 12, or does not allow the access source of interest to access the target server 12 but allows the access source of interest to access the virtual server 14.

[0052] The access source of interest determined as being unable to access the target server 12 can be considered to be an access source used by a malicious user (attacker) who intends to launch a DoS attack on the target server 12. As described above, the virtual server 14 imitates the target server 12, so even if the access source of interest is made to access the virtual server 14, the malicious user who is using the access source of interest will mistakenly believe that he is accessing the target server 12, and will not notice that he is actually accessing the virtual server 14. Moreover, the malicious user intends to launch a DoS attack on the target server 12, but actually launches a DoS attack on the virtual server 14.

[0053] Finally, it can be considered that when the virtual server 14 is paralyzed by the DoS attack, the malicious user mistakenly believes that the purpose of paralyzing the target server 12 through the DoS attack has been achieved, and stops the DoS attack. Of course, at this time, there is no impact on the target server 12. In this way, according to this embodiment, the virtual server 14 is used as a bait, thereby making the malicious user mistakenly believe that the target server 12 is paralyzed through the DoS attack, thereby protecting the target server 12 from the DoS attack.

[0054] Furthermore, when the access control unit 44 detects a sign of an intrusion attack such as code rewriting of the virtual server 14 from a source of interest leading to the virtual server 14 , the access control unit 44 can immediately cut off access to the virtual server 14 from the source of interest.

[0055] In the present embodiment, the access control unit 44 guides the access source of interest determined to be unable to access the target server 12 to the virtual server 14 only in the emergency mode when the target server 12 is highly likely to be attacked by DoS. In the present embodiment, in the normal mode, the access control unit 44 only rejects access requests to the target server 12 from the access source of interest determined to be unable to access the target server 12. However, in the normal mode, the access control unit 44 may guide the access source of interest determined to be unable to access the target server 12 to the virtual server 14.

[0056] In addition, when the access control unit 44 detects an access source that has carried out a DoS attack on the target server 12 based on the data sent to the target server 12 from the access source that has accessed the target server 12 and the access load of the target server 12, the access control unit 44 immediately cuts off access from the access source to the target server 12, or after cutting off access from the access source to the target server 12, allows the access source to access the virtual server 14.

[0057] In normal mode, all access sources not included in the blacklist 34 are allowed to access the target server 12. Therefore, there may be access sources used by malicious users, and there may be a situation where the target server 12 is attacked by DoS from access sources that are allowed to access the target server 12 by the access permission determination unit 40. In addition, in emergency mode, the access sources included in the whitelist 36 are originally reliable access sources, such as access sources that have officially accessed the target server 12 in the past. However, even if it is a reliable access source, the access source may be used by malicious users. For example, sometimes the access source is occupied by a malicious user and becomes a zombie computer. Therefore, even if it is an access source temporarily included in the whitelist 36, there may be a situation where the target server 12 is attacked by DoS from the access source.

[0058] Therefore, in this embodiment, the access control unit 44 monitors whether the access source that has accessed the target server 12 has not carried out a DoS attack on the target server 12. If a DoS attack from the access source is detected, in the case of the normal mode, the access from the access source to the target server 12 is cut off, and in the case of the emergency mode, the access source is allowed to access the virtual server 14. In addition, here, in the case of the normal mode, the access source can also be allowed to access the virtual server 14.

[0059] In particular, in the case of emergency mode, the access control unit 44 may also expand the range of access sources accessing the virtual server 14 in stages from the access source where the DoS attack is detected, according to the whitelist 36, in accordance with the access load of the target server 12. When the access load of the target server 12 is relatively small, the target server 12 is often attacked by DoS from a single or a small number of access sources, but when the access load of the target server 12 is relatively large, the target server 12 may be attacked by DDoS from a large number of access sources. Therefore, in order to prevent DDoS attacks from multiple access sources, the access control unit 44 expands the range of access sources accessing the virtual server 14 in stages in accordance with the access load of the target server 12.

[0060] In this embodiment, when the access load of the target server 12 is less than the second threshold value predetermined by the administrator of the DoS attack response system 10, the access control unit 44 allows only the access source determined to have carried out a DoS attack on the target server 12 to access the virtual server 14. The second threshold value may be different from or the same as the first threshold value.

[0061] For example, consider the following case: when the gateway 16 operates in the emergency mode and a comprehensive domain such as "xxx.Acompany.co.jp" is registered in the whitelist 36, a DoS attack from a domain such as "user1.Acompany.co.jp" to the target server 12 is detected due to the invasion of a malicious user. In addition, it is assumed that this domain is a domain currently used by user 1 of company A. At this time, if the access load of the target server 12 is less than the second threshold value, the access control unit 44 allows only access sources from the domain such as "user1.Acompany.co.jp" that has carried out the DoS attack to access the virtual server 14. At this time, the access control unit 44 allows access sources from domains included in "xxx.Acompany.co.jp" other than this domain to access the target server 12.

[0062] When the access load of the target server 12 is greater than the second threshold value, the access control unit 44 expands the domains accessing the virtual server 14. For example, in the above example, when the access load of the target server 12 is greater than the second threshold value, domains other than user 1 of Company A are also invaded, and the target server 12 may be attacked by DDoS from access sources of multiple domains of Company A. Therefore, if the access load of the target server 12 is greater than the second threshold value, the access control unit 44 allows multiple access sources of the comprehensive domain represented by "xxx.Acompany.co.jp" including the domain "user1.Acompany.co.jp" that has carried out the DoS attack to access the virtual server 14 in the whitelist 36. In this way, DDoS attacks from multiple domains of Company A can be prevented.

[0063] In addition, when the domain name of the access source determined to have carried out a DoS attack on the target server 12 cannot be obtained by the DNS server, the access control unit 44 can extract the address area that is the restricted object from the IP address management organization such as JPNIC (Japan Network Information Center), so that the access source of the IP address contained in the extracted address area can access the virtual server 14.

[0064] The list updating unit 46 performs a process of updating the blacklist 34 or the whitelist 36. For example, when the gateway 16 is operating in the normal mode, the list updating unit 46 adds the access source determined by the access control unit 44 as having performed a DoS attack on the target server 12 to the blacklist 34. In addition, when the gateway 16 is operating in the emergency mode, the list updating unit 46 deletes the access source that the access control unit 44 allowed to access the virtual server 14 from the whitelist 36 and then adds the access source to the blacklist 34.

[0065] The structure of the DoS attack response system 10 of this embodiment is as described above. Figure 4 The flowchart shown illustrates the processing flow of the gateway 16.

[0066] In step S10, the mode switching unit 42 determines whether the access load of the target server 12 is greater than the first threshold value. If the access load of the target server 12 is less than the first threshold value, the process proceeds to step S12, where the mode switching unit 42 sets the operation mode of the gateway 16 to the normal mode.

[0067] When an access request to access the target server 12 from the access source of interest is received in the normal mode, the access permission determination unit 40 determines whether the access source of interest is included in the blacklist 34 in step S14. If the access source of interest is not included in the blacklist 34, the process proceeds to step S16, in which the access control unit 44 allows the access source of interest to access the target server 12, and the process ends. In addition, after step S16, if the access control unit 44 detects an access source that performs a DoS attack on the target server 12, the access from the access source to the target server 12 may be cut off, or the access source may be allowed to access the virtual server 14. In addition, in this case, the list update unit 46 may add the access source to the blacklist 34.

[0068] If the access source of interest is included in the blacklist 34, the process proceeds to step S18, where the access control unit 44 terminates the process without allowing the access source of interest to access the target server 12. Alternatively, as described above, the access control unit 44 may allow the access source of interest to access the virtual server 14 in step S18.

[0069] In step S10 , when the access load of the target server 12 is equal to or larger than the first threshold value, the process proceeds to step S20 , in which the mode switching unit 42 sets the operation mode of the gateway 16 to the emergency mode.

[0070] When receiving an access request from the access source of interest to access the target server 12 in the emergency mode, the access permission determination unit 40 determines whether the access source of interest is included in the whitelist 36 in step S22 .

[0071] If the access source of interest is not included in the whitelist 36, the process proceeds to step S24, in which the access control unit 44 allows the access source of interest to access the virtual server 14. Thereafter, when the virtual server 14 is paralyzed by the DoS attack from the access source of interest, the DoS attack is considered to be over. If the access source of interest is not included in the blacklist 34 after the DoS attack stops, the list update unit 46 adds the access source of interest to the blacklist 34.

[0072] When the access source of interest is included in the whitelist 36 , the process proceeds to step S26 , in which the access control unit 44 causes the access source of interest to access the target server 12 .

[0073] In step S28, the access control unit 44 monitors the target server 12 and the data sent to the target server 12 from each access source, and determines whether there is a DoS attack on the target server 12. If the access control unit 44 determines that there is no DoS attack on the target server 12, the process ends. On the other hand, if the access control unit 44 detects a DoS attack on the target server 12, the process proceeds to step S30.

[0074] In step S30, the access control unit 44 allows the access source determined in step S28 to perform a DoS attack on the target server 12 to access the virtual server 14. In addition, as described above, the access control unit 44 may expand the range of access sources accessing the virtual server 14 according to the access load of the target server 12 based on the whitelist 36.

[0075] In step S32 , the list updating unit 46 deletes the access source that has performed the DoS attack on the target server 12 in step S28 from the white list 36 , and then adds the access source to the black list 34 .

[0076] The DoS attack response device of the present invention has been described above. However, the DoS attack response device of the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the gist of the present invention.

[0077] Description of symbols

[0078] 10: DoS attack response system; 12: target server; 14: virtual server; 16: gateway; 18: Internet; 30: communication interface; 32: memory; 34: blacklist; 36: whitelist; 38: processor; 40: access permission determination unit; 42: mode switching unit; 44: access control unit; 46: list update unit.

Claims

1. A DoS attack response device, characterized in that: The DoS attack response device has: an access permission determination unit for determining whether access to the target server is permitted from the access source of interest based on an access permission list indicating access sources permitted or prohibited from accessing the target server; as well as an access control unit, which, when determining that the access source of interest cannot access the target server, does not allow the access source of interest to access the target server, but allows the access source of interest to access a virtual server that simulates the target server, The DoS attack response device can operate in a normal mode or an emergency mode. In the normal mode, the access permission determination unit determines whether the target server can be accessed from the access source of interest based on a blacklist of the access permission list indicating access sources prohibited from accessing the target server, and in the emergency mode, the access permission determination unit determines whether the target server can be accessed from the access source of interest based on a whitelist of the access permission list indicating access sources permitted to access the target server. The DoS attack response device also has a mode switching unit. When the access load of the target server is less than the first threshold value, the mode switching unit causes the DoS attack response device to operate in the normal mode. When the access load of the target server is greater than the first threshold value, the mode switching unit causes the DoS attack response device to operate in the emergency mode.

2. The DoS attack response device according to claim 1, characterized in that: When the access control unit detects an access source that has carried out a DoS attack on the target server while the DoS attack response device is operating in the emergency mode, the access control unit gradually expands the range of access sources accessing the virtual server starting from the access source that has carried out a DoS attack on the target server according to the whitelist and in accordance with the access load of the target server.

Images