A near-destination DDoS defense method based on bidirectional source address verification

By deploying SAV-B devices near the DDoS attack target, and using two-way source address verification technology to verify the five-tuple information of network data packets, the existing DDoS defense methods solve the problem of manslaughter, deployment difficulties and delays in reflective amplification attacks and source address forgery scenarios, achieving more efficient and accurate DDoS defense effects.

CN118432902BActive Publication Date: 2025-03-21UNIV OF ELECTRONICS SCI & TECH OF CHINA
1 Cites 0 Cited by

Patent Information

Application Number
CN202410582387.X
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2024-05-11
Publication Date
2025-03-21
Estimated Expiration
2044-05-11

AI Technical Summary

Technical Problem

Existing DDoS defense methods have problems such as manslaughter, deployment difficulties and processing delays when defending against reflective amplification attacks, especially in the scenarios of source address forgery and open services.

Method used

Bidirectional source address verification technology is adopted to identify and defend against attacks that forged source addresses by deploying SAV-B devices near the target of DDoS attack, collect and process five-tuple information of network data packets, and generate a hash digest using hash function to generate a hash digest to identify and defend against attacks that forged source addresses.

Benefits of technology

Effectively prevent source address forgery attacks and improve the overall security protection capabilities of the network. Especially in the scenarios of reflective amplification attacks and open services, it significantly improves the accuracy and efficiency of DDoS defense.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The present invention provides a near-destination DDoS defense method based on bidirectional source address verification (SAV‑B). The method deploys SAV‑B devices near the DDoS attack target (i.e., the protected area). The SAV‑B devices are used to collect five-tuple information of network data packets transmitted into and out of the network. The five-tuple information includes source IP address, destination IP address, source port number, destination port number, and transmission protocol. An efficient hash function is used to generate a hash digest for the information. The hash digest is used to verify the authenticity of the source address of the data packet to achieve efficient and accurate source address verification. This dynamic update and verification mechanism enables the SAV‑B device to adapt to changes in the network environment and emerging security threats, thereby providing an efficient defense method for ensuring network security.
Need to check novelty before this filing date? Find Prior Art