Method for detecting and defending denial of service attack

By deploying measurement and attack detection modules on hardware programmable switches, using hash functions and table lookup methods to count and detect data packet frequency and data volume, combined with decision tree model, the problem of low DDoS attack detection performance in the existing technology is solved. , realizes efficient and accurate attack detection and defense.

CN119316178APending Publication Date: 2025-01-14INST OF COMPUTING TECH CHINESE ACAD OF SCI
1 Cites -1 Cited by

Patent Information

Application Number
CN202411132458.2
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-08-19
Publication Date
2025-01-14

AI Technical Summary

Technical Problem

The software-defined network (SDN) and network function virtualization (NFV) methods are unable to effectively deal with Tbps-level attack traffic when detecting and defending distributed denial of service attacks (DDoS), and are programmable in hardware due to poor performance. It is difficult to implement attack entropy calculation on switches, increasing memory and computing overhead.

Method used

The measurement module and attack detection module are deployed in the data plane of the hardware programmable switch. The refreshable data structure is used to count the frequency of data packets and data amounts, and the calculation overhead is reduced through hash function mapping and table lookup, and attack detection is carried out in combination with the decision tree model. and defense, enabling periodic measurement and accurate defense.

Benefits of technology

By reducing computing and memory overhead, it is possible to efficiently detect multiple DDoS attacks on hardware programmable switches, improve detection accuracy and defense effects, and can deal with multiple attack types and respond in a timely manner.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119316178A_ABST
    Figure CN119316178A_ABST
Patent Text Reader

Abstract

The invention provides a method for detecting denial of service attack, which is applied to a data plane of a hardware programmable switch and comprises the following steps of: deploying a measurement module and a first attack detection module on the data plane; the measurement module performs statistics according to data packets received by a preset time window by using a refreshable data structure to obtain first occurrence frequencies of various first mapping values and second occurrence frequencies of various second mapping values under the time window; a first attack detection module obtains a minimum first occurrence frequency and a minimum second occurrence frequency from the data structure, and searches a source IP address entropy corresponding to the minimum first occurrence frequency and a destination IP address entropy corresponding to the minimum second occurrence frequency from an occurrence frequency-address entropy relation corresponding table item; and judging whether the current time window contains denial of service attack traffic or not according to the searched source IP address entropy and destination IP address entropy.
Need to check novelty before this filing date? Find Prior Art

Citation Information

Patent Citations

  • DDoS attack detection method, DDoS attack traffic filtering method and device

    CN115277103B