Device and method for defending DDoS attack according to port in P2P service

Abstract

The invention provides a device and a method for defending DDoS (Distributed Denial of Service) attack according to ports in P2P (Peer-to-Peer) service, and the device comprises a data uploading subsystem which is used for counting P2P service flow data based on quintuple flow and uploading the P2P service flow data to a central database; the statistical subsystem is used for summarizing and counting the number of records from the central database according to the target IP and the target port based on a statistical rule, and screening the records of which the number is greater than a set threshold value; the interception rule configuration subsystem is used for configuring an interception rule of the entrance firewall according to the record; and the defense subsystem is used for defending DDoS attacks based on a firewall configured in real time. According to the device and the method for defending the DDoS attack according to the port in the P2P service, the statistical rule is introduced, the corresponding record number is summarized and counted from the central database according to the target IP and the target port, the interception rule of the entrance firewall is dynamically configured according to the statistical result, the attacked port is automatically intercepted and accurately intercepted, the attack cost is increased, and the service is safer.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a device and method for defending against DDoS attacks by port in P2P services. Background Art

[0002] DDoS attack is a common means of Internet attack. It sends large traffic or high PPS data to the attacked IP in a short period of time, causing link congestion or performance overload on the network where the attacked IP is located, resulting in DoS (Denial of Service) errors. The Internet access providers are directly affected by DDoS attacks.

[0003] Internet access providers, because they have AS (Autonomous System) numbers, can publish black hole routes on the Internet. They usually send attacked IPs to black hole routes to defend against DDoS attacks, or use bypass routes to cleaning devices for traffic cleaning, or set filtering rules on the ingress firewall.

[0004] Internet access providers now generally use NAT technology to solve the problem of IPv4 address exhaustion for IPv4 broadband users. Internet access providers allocate reserved IP addresses such as 10.0.0.0 / 8 to broadband users, and when user traffic passes through the NAT gateway, it is converted to a public IPv4 address. Among them, the P2P gateway is a NAT gateway that has the function of solving the user's P2P needs.

[0005] The special feature of P2P gateway is that after the user initiates a P2P connection request, the P2P gateway will allocate a port on the public IP, and all traffic sent by Internet users to this IP and port will be forwarded to this user. Therefore, after the P2P gateway is attacked by DDoS, the internal network of the Internet access provider will also be attacked by DDoS.

[0006] In view of this, there is an urgent need for a device and method for defending against DDoS attacks by port in P2P services to at least solve the above-mentioned deficiencies. Summary of the invention

[0007] One of the purposes of the present invention is to provide a device and method for defending against DDoS attacks by port in P2P business, introduce five-tuple flow statistics P2P business traffic data, introduce statistical rules to summarize and count the corresponding number of records from a central database by target IP and target port, and after real-time detection of DDoS, dynamically configure the interception rules of the inlet firewall to automatically intercept, accurately intercept the port affected by DDoS, increase the cost of DDoS attacks, and improve the security of P2P business.

[0008] The device for defending against DDoS attacks by port in a P2P service provided by an embodiment of the present invention includes:

[0009] Data upload subsystem, used to collect P2P service traffic data based on quintuple flow statistics and upload it to the central database;

[0010] The statistical subsystem is used to determine the statistical rules, summarize and count the corresponding records by target IP and target port from the central database based on the statistical rules, and filter the target IP and target port combinations whose record numbers are greater than the set threshold;

[0011] The interception rule configuration subsystem is used to configure the interception rules of the ingress firewall according to the combination of target IP and target port;

[0012] Defense subsystem, used for firewall defense against DDoS attacks based on real-time configuration of interception rules.

[0013] Preferably, the statistical subsystem determines the statistical rules, including:

[0014] Get historical DDoS attack records;

[0015] Analyze historical DDoS attack records to obtain the first historical P2P service traffic data and historical DDoS attack data;

[0016] Based on the preset attack trigger relationship feature extraction template, try to extract the attack trigger relationship feature set according to the first historical P2P service traffic data and the historical DDoS attack data;

[0017] If the extraction attempt is successful, determine the statistical timing based on the P2P service traffic data and the attack trigger relationship feature set;

[0018] If the extraction attempt fails, statistics are collected based on the preset statistical period.

[0019] Preferably, the statistical subsystem obtains historical DDoS attack records, including:

[0020] Try to obtain historical warnings;

[0021] If the historical warning acquisition attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service flow data of a preset time length before the corresponding historical warning;

[0022] Determine the DDoS attack based on the second historical P2P service traffic data;

[0023] If the DDoS attack is judged to be successful, the second historical P2P service flow data marked with the DDoS attack judgment result is used as a historical DDoS attack record;

[0024] If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route;

[0025] According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained;

[0026] Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features;

[0027] If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing;

[0028] The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

[0029] Preferably, the statistical subsystem obtains historical warnings, including:

[0030] Obtaining the first platform service attribute of the pre-selected P2P platform, and at the same time, obtaining the second platform service attribute of the local P2P platform;

[0031] Calculating the attribute similarity between the first platform service attribute and the second platform service attribute;

[0032] Determine sampling rules based on attribute similarity;

[0033] Based on the sampling rules, obtain the first sampled historical attack records of the pre-selected P2P platform;

[0034] Based on the sampling rules, obtain the second sampling historical attack record of the local P2P platform;

[0035] Determine whether the same attack ID exists in the first sampled historical attack record and the second sampled historical attack record;

[0036] If there is no identical attack ID, the initial pre-selected value of the pre-selected P2P platform is determined according to the initial pre-selected value determination rule preset in the sampling rule, and the initial pre-selected value is used as the final pre-selected value;

[0037] If the same attack ID exists, the first sampled historical attack record and the second sampled historical attack record with the same attack ID are compared to calculate the similarity of the attack process;

[0038] Based on the preset correction rule, the initial pre-selected value preset by the sampling rule is corrected according to the similarity of the attack process, and the pre-selected value of the pre-selected P2P platform is obtained;

[0039] The pre-selected P2P platforms whose pre-selected values ​​are greater than or equal to the preset pre-selected value threshold are used as the platforms for obtaining historical warnings.

[0040] The system for defending against DDoS attacks by port in P2P services provided by an embodiment of the present invention also includes:

[0041] The pre-verification subsystem is used to perform pre-verification of the P2P service party before collecting statistics on P2P service traffic data.

[0042] Preferably, before the pre-verification subsystem collects statistics on P2P service flow data, it performs pre-verification of the P2P service party, including:

[0043] Obtain risk business identification records;

[0044] Determine historical risk business parties based on risk business identification records;

[0045] Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record;

[0046] Establishing a relationship between the second risk business and the first risk business;

[0047] Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type;

[0048] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship;

[0049] Attempt to identify risk associations based on the fourth historical P2P business flow data and the P2P business flow data of the P2P business party;

[0050] If the risk association relationship is successfully identified, the P2P business party is pre-verified based on the risk business feature set of the risk association relationship.

[0051] The method for defending against DDoS attacks by port in a P2P service provided by an embodiment of the present invention includes:

[0052] Step 1: Collect P2P service traffic data based on the five-tuple flow statistics and upload it to the central database;

[0053] Step 2: Determine the statistical rules, and based on the statistical rules, collect and count the corresponding records by target IP and target port from the central database, and filter the target IP and target port combinations whose record numbers are greater than the set threshold;

[0054] Step 3: Configure the interception rules of the ingress firewall according to the target IP and target port combination;

[0055] Step 4: Firewall defense against DDoS attacks based on real-time configuration of interception rules.

[0056] Preferably, determining the statistical rules includes:

[0057] Get historical DDoS attack records;

[0058] Analyze historical DDoS attack records to obtain the first historical P2P service traffic data and historical DDoS attack data;

[0059] Based on the preset attack trigger relationship feature extraction template, try to extract the attack trigger relationship feature set according to the first historical P2P service traffic data and the historical DDoS attack data;

[0060] If the extraction attempt is successful, determine the statistical timing based on the P2P service traffic data and the attack trigger relationship feature set;

[0061] If the extraction attempt fails, statistics are collected based on the preset statistical period.

[0062] Preferably, historical DDoS attack records are obtained, including:

[0063] Try to obtain historical warnings;

[0064] If the historical warning acquisition attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service flow data of a preset time length before the corresponding historical warning;

[0065] Determine the DDoS attack based on the second historical P2P service traffic data;

[0066] If the DDoS attack is judged to be successful, the second historical P2P service flow data marked with the DDoS attack judgment result is used as a historical DDoS attack record;

[0067] If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route;

[0068] According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained;

[0069] Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features;

[0070] If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing;

[0071] The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

[0072] The method for defending against DDoS attacks by port in a P2P service provided by an embodiment of the present invention further includes:

[0073] Before collecting P2P service traffic data, pre-verification of the P2P service party is performed.

[0074] Preferably, before collecting statistics on P2P service flow data, pre-verification of the P2P service party is performed, including:

[0075] Obtain risk business identification records;

[0076] Determine historical risk business parties based on risk business identification records;

[0077] Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record;

[0078] Establishing a relationship between the second risk business and the first risk business;

[0079] Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type;

[0080] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship;

[0081] Attempt to identify risk associations based on the fourth historical P2P business flow data and the P2P business flow data of the P2P business party;

[0082] If the risk association relationship is successfully identified, the P2P business party is pre-verified based on the risk business feature set of the risk association relationship.

[0083] The beneficial effects of the present invention are:

[0084] The present invention introduces quintuple flow statistics of P2P business traffic data, introduces statistical rules to summarize and count the corresponding record numbers according to target IP and target port from a central database, and after real-time detection of DDoS, dynamically configures the interception rules of the inlet firewall to automatically intercept, accurately intercept the ports affected by DDoS, increase the cost of DDoS attacks, and improve the security of P2P services.

[0085] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in the present application documents.

[0086] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0088] Figure 1 Schematic diagram of a device for defending against DDoS attacks by port in a P2P service in an embodiment of the present invention;

[0089] Figure 2 Schematic diagram of a method for defending against DDoS attacks by port in a P2P service in an embodiment of the present invention. DETAILED DESCRIPTION

[0090] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0091] The embodiment of the present invention provides a device for defending against DDoS attacks by port in P2P business, such as Figure 1 As shown, including:

[0092] The data upload subsystem 1 is used to collect P2P service flow data based on the five-tuple flow statistics and upload it to the central database; wherein the key fields of the five-tuple flow statistics are protocol, source IP, target IP, source port, target port, upstream flow and downstream flow;

[0093] Statistical subsystem 2, used to determine statistical rules, summarize and count the corresponding number of records from the central database according to the target IP and target port based on the statistical rules, and filter the target IP and target port combination whose number of records is greater than a set threshold; wherein the set threshold is set manually, for example: 2000;

[0094] The interception rule configuration subsystem 3 is used to configure the interception rules of the ingress firewall according to the combination of the target IP and the target port;

[0095] The defense subsystem 4 is used for firewall defense against DDoS attacks based on real-time configuration of interception rules.

[0096] The working principle and beneficial effects of the above technical solution are:

[0097] The present invention introduces quintuple flow statistics of P2P business traffic data, introduces statistical rules to summarize and count the corresponding record numbers according to target IP and target port from a central database, and after real-time detection of DDoS, dynamically configures the interception rules of the inlet firewall to automatically intercept, accurately intercept the ports affected by DDoS, increase the cost of DDoS attacks, and improve the security of P2P services.

[0098] In one embodiment, the statistics subsystem determines the statistical rules, including:

[0099] Obtain historical DDoS attack records; the historical DDoS attack records are: logs of DDoS attacks on local Internet access providers in history;

[0100] Parse historical DDoS attack records to obtain historical P2P service traffic data and historical DDoS attack data; the historical P2P service traffic data is: the P2P service traffic data of normal users in the historical DDoS attack records; the historical DDoS attack data is: the P2P service traffic data of DDoS attack users in the historical DDoS attack records;

[0101] Based on the preset attack trigger relationship feature extraction template, according to the historical P2P business traffic data and the historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set; wherein the preset attack trigger relationship feature extraction template is: a description template that describes what kind of historical P2P business traffic data triggers what kind of DDoS attack;

[0102] If the extraction attempt is successful, determine the statistical timing for statistics based on the P2P service flow data and the attack trigger relationship feature set; when determining the statistical timing, match the description information of the service flow data with the description information of the historical P2P service flow data, and if the match is successful, use the corresponding timing of the successful match as the statistical timing;

[0103] If the extraction attempt fails, statistics are performed based on the preset statistical period. If the extraction attempt fails, it means that there are no significant features that can characterize the possibility of DDoS attack in the business traffic data, and statistics are directly performed based on the manually preset statistical period.

[0104] The working principle and beneficial effects of the above technical solution are:

[0105] The present invention obtains historical business traffic data, parses and obtains first historical P2P business traffic data and historical DDoS attack data. An attack trigger relationship feature extraction template is introduced to describe what kind of historical P2P business traffic data triggers what kind of DDoS attack, and an attack trigger relationship feature set between the first historical P2P business traffic data and the historical DDoS attack data is attempted to be extracted. If the extraction attempt is successful, the timing of satisfying the attack trigger situation is determined and counted based on the P2P business traffic data and the attack trigger relationship feature set, and the statistical timing is dynamically determined based on the first historical P2P business traffic data feature. If the extraction attempt fails, statistics are performed based on a preset statistical period, thereby avoiding the DDoS attack caused by the untimely discovery of the problem IP and port group due to setting a fixed statistical period, thereby improving security.

[0106] In one embodiment, the statistics subsystem obtains historical DDoS attack records, including:

[0107] Try to obtain historical warnings; where historical warnings are: historical warning information of the P2P platform of the Internet access provider;

[0108] If the historical warning attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service traffic data of a preset time length before the corresponding historical warning; wherein the target type warning includes: link congestion and performance exceeding the limit; the preset time length is manually preset;

[0109] Performing DDoS attack determination according to the second historical P2P service flow data; wherein, when performing DDoS attack determination, calling a corresponding DDoS attack determination method according to a target type warning;

[0110] If the DDoS attack is determined to be successful, the second historical P2P service flow data marked with the DDoS attack determination result is used as a historical DDoS attack record; wherein the marked DDoS attack determination result is: the second historical P2P service flow data marked with the attack flow data of malicious users and the flow data of ordinary users;

[0111] If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route;

[0112] According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained; wherein the DDoS attack processing feature extraction template is a template for extracting DDoS attack processing features by comparing target routing records of different record types, and the DDoS attack processing features are, for example, which IP addresses or IP segments are directed to the black hole route, the time and duration of the application of the routing rule, the amount of traffic being cleaned, the specific type of the cleaning operation (for example, discarding, speed limiting), and the reinjection path of the cleaned traffic, etc.;

[0113] Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features;

[0114] If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing; wherein the attack traffic data of malicious users and the traffic data of ordinary users in the third historical P2P service traffic data can be identified according to the DDoS attack processing characteristics;

[0115] The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

[0116] The working principle and beneficial effects of the above technical solution are:

[0117] When obtaining historical DDoS attack records, the historical warning information can be obtained first. For example, when a DDoS attack occurs, it generally causes link congestion and performance overruns. When a corresponding warning is issued, there is a possibility of a DDoS attack. However, not all link congestion and performance overruns are caused by DDoS attacks (for example, the mismatch between server performance and the processed regular P2P business volume can also cause the above situation). Therefore, when it is a target type warning (for example, link congestion and performance overruns), the DDoS attack determination method is determined based on the target type warning, and the second historical P2P business traffic data of a preset time length before the corresponding historical warning moment is determined. The historical DDoS attack is determined based on the determination result. If the DDoS attack cannot be identified through historical warnings, there may be situations where the server successfully handles the attack but does not issue an alarm (for example, sending the attacked IP to a black hole router to defend against DDoS attacks, or routing the attack to a cleaning device through a bypass router for traffic cleaning). Therefore, the target routing record is obtained, and a DDoS attack processing feature extraction template is determined according to the type of record to try to extract the DDoS attack processing feature. If the extraction attempt is successful, it means that the routing processing process corresponding to the corresponding routing record is the DDoS attack processing process. The historical DDoS attack record is determined based on the DDoS attack processing feature and the third historical P2P business traffic data, which improves the comprehensiveness and rationality of the acquisition of historical DDoS attack records.

[0118] In one embodiment, the statistical subsystem obtains historical warnings, including:

[0119] Obtain the first platform business attribute of the pre-selected P2P platform, and at the same time, obtain the second platform business attribute of the local P2P platform; wherein the pre-selected P2P platform is: all P2P platforms that can be obtained from the big data search for historical warnings; the platform business attributes include: the type of personnel of the business party, the type of business, and other information;

[0120] Calculating the attribute similarity between the first platform service attribute and the second platform service attribute;

[0121] According to the attribute similarity, the sampling rule is determined; wherein the sampling rule is: the greater the attribute similarity, the smaller the sampling number, and the specific inverse proportional relationship is set manually;

[0122] Based on the sampling rules, the first sampled historical attack records of the pre-selected P2P platform are obtained; the sampled historical attack records are: the records of the P2P platform suffering from DDoS attacks in the past extracted based on the sampling rules;

[0123] Based on the sampling rules, obtain the second sampling historical attack record of the local P2P platform;

[0124] Determine whether the same attack ID exists in the first sampled historical attack record and the second sampled historical attack record;

[0125] If there is no identical attack ID, the initial pre-selected value of the pre-selected P2P platform is determined according to the initial pre-selected value determination rule preset in the sampling rule, and the initial pre-selected value is used as the final pre-selected value; wherein the preset initial pre-selected value determination rule is: the smaller the sampling number, the larger the initial pre-selected value;

[0126] If the same attack ID exists, the first sampled historical attack record and the second sampled historical attack record with the same attack ID are compared to calculate the similarity of the attack process; wherein the similarity of the attack process is: the similarity of the DDoS attack process recorded in the sampled historical attack records of the pre-selected P2P platform and the local P2P platform;

[0127] Based on the preset correction rules, the initial pre-selected values ​​preset by the sampling rules are corrected according to the similarity of the attack process, and the pre-selected values ​​of the pre-selected P2P platforms are obtained; wherein, the greater the similarity of the attack process, the more the corresponding initial pre-selected values ​​are adjusted upward;

[0128] The pre-selected P2P platforms whose pre-selected values ​​are greater than or equal to the preset pre-selected value threshold are used as the platforms for obtaining historical warnings.

[0129] The working principle and beneficial effects of the above technical solution are:

[0130] When obtaining historical warnings for extracting historical DDoS attack records, it is necessary to screen the extracted platforms in advance. During the screening, the attribute similarity between the first platform business attribute of the pre-selected P2P platform and the second platform business attribute of the local P2P platform is calculated, and the sampling rules corresponding to the attribute similarity are determined (the greater the attribute similarity, the smaller the sampling number); based on the sampling rules, the first sampled historical attack records of the pre-selected P2P platform and the second sampled historical attack records of the local P2P platform are screened respectively to determine whether the first sampled historical attack records and the second sampled historical attack records have the same attack ID. If there is no identical attack ID, it means that the sampled historical attack If the pre-selected P2P platform and the local P2P platform in the record do not have the same attacker, the pre-selected value of the pre-selected P2P platform is determined according to the sampling number (the smaller the sampling number, the smaller the possibility of the same attack ID, so the smaller the sampling number, the larger the initial pre-selected value); if the same attack ID exists, the similarity of the attack process is compared, and the initial pre-selected value determined by the pre-selected P2P platform based on the sampling rule is adjusted upward according to the similarity of the attack process (the greater the similarity of the attack process, the more the corresponding initial pre-selected value is adjusted upward), and finally the pre-selected P2P platform with a pre-selected value greater than or equal to the pre-selected value threshold is selected as the platform for obtaining historical warnings, thereby improving the availability of subsequent historical DDoS attack records.

[0131] The embodiment of the present invention provides a method for defending against DDoS attacks by port in a P2P service, further comprising:

[0132] The pre-verification subsystem is used to pre-verify the P2P service parties before counting the P2P service flow data. The P2P service parties are the senders and receivers of the P2P service flow data.

[0133] The working principle and beneficial effects of the above technical solution are:

[0134] Before counting the P2P business traffic data, risky businesses of the P2P business parties can be identified based on their prior information (for example, the P2P business parties' historical business operations). When risky businesses are identified, the business services of the corresponding P2P business parties are directly suspended. Otherwise, subsequent DDoS attack defense is performed on the P2P business traffic data of the corresponding P2P business parties to improve defense efficiency.

[0135] In one embodiment, before the pre-verification subsystem collects statistics on P2P service traffic data, it performs pre-verification of the P2P service party, including:

[0136] Obtain risk business identification records; wherein, risk business identification records are: process records of identifying business risks during the P2P business process;

[0137] Determine the historical risk business party based on the risk business identification record; the historical risk business party is: the risk business handling party in the risk business identification record;

[0138] Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record; wherein the first risk business is: the risk P2P business identified in the risk business identification record; the second risk business is: the historical P2P business related to the first risk business that was handled before the first risk business;

[0139] Establishing a relationship between the second risk business and the first risk business;

[0140] Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type; wherein the relationship similarity is: the similarity of the historical P2P business related to the first risk business that was handled before the first risk business. The higher the relationship similarity, the more similar the second risk business types associated with the first risk business of the corresponding business type are, indicating that the corresponding second risk business can more synergize with the first risk business;

[0141] If the relationship similarity is greater than or equal to a preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship; wherein the preset relationship similarity threshold is manually preset;

[0142] Attempt to identify the risk association relationship according to the fourth historical P2P business flow data and the P2P business flow data of the P2P business party; wherein the fourth historical P2P business flow data is: the historical P2P business flow data of the P2P business party;

[0143] If the risk association relationship is successfully identified, the P2P business party is pre-verified according to the risk business feature set of the risk association relationship, wherein the risk business feature set includes multiple risk features, including the P2P business behavior of the risk business handler of the first risk business and / or the second risk business corresponding to the risk association relationship.

[0144] The working principle and beneficial effects of the above technical solution are:

[0145] The present invention obtains historical risk business identification records, determines the historical risk business parties in the records, parses the risk business identification records, determines the first risk business to be identified, and in addition, introduces the second risk business related to the first risk business that was handled before the first risk business, establishes an association relationship between the second risk business and the first risk business, and calculates the relationship similarity of the corresponding association relationship of the first risk business of the same business type. The higher the relationship similarity, the more similar the second risk business type associated with the first risk business of the corresponding business type is, indicating that the corresponding second risk business can more synergistically act on the first risk business, and screens the risk association relationships with a relationship similarity greater than a relationship similarity threshold, so that the extraction of risk association relationships is more reasonable;

[0146] The fourth historical P2P business flow data and P2P business flow data of the P2P business party are introduced, and the risk association relationship of the business type is identified according to the current business type (determined according to the P2P business flow data) and the previous business type (determined according to the fourth historical P2P business flow data). If the identification is successful, the P2P business behavior of the historical risk business party in the historical risk corresponding to the corresponding risk association relationship is further verified, thereby improving the pre-verification efficiency.

[0147] The embodiment of the present invention provides a method for defending against DDoS attacks by port in P2P services, such as Figure 2 As shown, including:

[0148] Step 1: Collect P2P service traffic data based on the five-tuple flow statistics and upload it to the central database;

[0149] Step 2: Determine the statistical rules, and based on the statistical rules, collect and count the corresponding records by target IP and target port from the central database, and filter the target IP and target port combinations whose record numbers are greater than the set threshold;

[0150] Step 3: Configure the interception rules of the ingress firewall according to the target IP and target port combination;

[0151] Step 4: Firewall defense against DDoS attacks based on real-time configuration of interception rules.

[0152] In one embodiment, determining the statistical rule includes:

[0153] Get historical DDoS attack records;

[0154] Analyze historical DDoS attack records to obtain the first historical P2P service traffic data and historical DDoS attack data;

[0155] Based on the preset attack trigger relationship feature extraction template, try to extract the attack trigger relationship feature set according to the first historical P2P service traffic data and the historical DDoS attack data;

[0156] If the extraction attempt is successful, determine the statistical timing based on the P2P service traffic data and the attack trigger relationship feature set;

[0157] If the extraction attempt fails, statistics are collected based on the preset statistical period.

[0158] In one embodiment, obtaining historical DDoS attack records includes:

[0159] Try to obtain historical warnings;

[0160] If the historical warning acquisition attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service flow data of a preset time length before the corresponding historical warning;

[0161] Determine the DDoS attack based on the second historical P2P service traffic data;

[0162] If the DDoS attack is judged to be successful, the second historical P2P service flow data marked with the DDoS attack judgment result is used as a historical DDoS attack record;

[0163] If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route;

[0164] According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained;

[0165] Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features;

[0166] If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing;

[0167] The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

[0168] The method for defending against DDoS attacks by port in a P2P service provided by an embodiment of the present invention further includes:

[0169] Before collecting P2P service traffic data, pre-verification of the P2P service party is performed.

[0170] In one embodiment, before collecting statistics on P2P service flow data, pre-verification of the P2P service party is performed, including:

[0171] Obtain risk business identification records;

[0172] Determine historical risk business parties based on risk business identification records;

[0173] Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record;

[0174] Establishing a relationship between the second risk business and the first risk business;

[0175] Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type;

[0176] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship;

[0177] Attempt to identify risk associations based on the fourth historical P2P business flow data and the P2P business flow data of the P2P business party;

[0178] If the risk association relationship is successfully identified, the P2P business party is pre-verified based on the risk business feature set of the risk association relationship.

[0179] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A device for defending against DDoS attacks by port in P2P services, characterized in that: include: Data upload subsystem, used to collect P2P service traffic data based on quintuple flow statistics and upload it to the central database; The statistical subsystem is used to determine the statistical rules, summarize and count the corresponding records by target IP and target port from the central database based on the statistical rules, and filter the target IP and target port combinations whose record numbers are greater than the set threshold; The interception rule configuration subsystem is used to configure the interception rules of the ingress firewall according to the combination of target IP and target port; Defense subsystem, used for firewall defense against DDoS attacks based on real-time configuration of interception rules.

2. The device for defending against DDoS attacks by port in P2P services according to claim 1, characterized in that: The statistical subsystem determines the statistical rules, including: Get historical DDoS attack records; Analyze historical DDoS attack records to obtain the first historical P2P service traffic data and historical DDoS attack data; Based on the preset attack trigger relationship feature extraction template, try to extract the attack trigger relationship feature set according to the first historical P2P service traffic data and the historical DDoS attack data; If the extraction attempt is successful, determine the statistical timing based on the P2P service traffic data and the attack trigger relationship feature set; If the extraction attempt fails, statistics are collected based on the preset statistical period.

3. The device for defending against DDoS attacks by port in P2P services according to claim 2, characterized in that: The statistics subsystem obtains historical DDoS attack records, including: Try to obtain historical warnings; If the historical warning acquisition attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service flow data of a preset time length before the corresponding historical warning; Determine the DDoS attack based on the second historical P2P service traffic data; If the DDoS attack is judged to be successful, the second historical P2P service flow data marked with the DDoS attack judgment result is used as a historical DDoS attack record; If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route; According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained; Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features; If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing; The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

4. The device for defending against DDoS attacks by port in P2P services according to claim 1, characterized in that: Also includes: The pre-verification subsystem is used to perform pre-verification of the P2P service party before collecting statistics on P2P service traffic data.

5. The device for defending against DDoS attacks by port in P2P services according to claim 4, characterized in that: Before collecting P2P service traffic data, the pre-verification subsystem performs pre-verification of the P2P service party, including: Obtain risk business identification records; Determine historical risk business parties based on risk business identification records; Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record; Establishing a relationship between the second risk business and the first risk business; Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type; If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship; Attempt to identify risk associations based on the fourth historical P2P business flow data and the P2P business flow data of the P2P business party; If the risk association relationship is successfully identified, the P2P business party is pre-verified based on the risk business feature set of the risk association relationship.

6. A method for defending against DDoS attacks by port in P2P services, characterized in that: include: P2P service traffic data is counted based on the five-tuple flow and uploaded to the central database; Determine statistical rules, summarize and count the corresponding number of records by target IP and target port from the central database based on the statistical rules, and filter the target IP and target port combinations whose number of records is greater than the set threshold; Configure the interception rules of the ingress firewall based on the target IP and target port combination; Firewall defense against DDoS attacks based on real-time configuration of interception rules.

7. The method for defending against DDoS attacks by port in P2P services according to claim 6, characterized in that: Determine statistical rules, including: Get historical DDoS attack records; Analyze historical DDoS attack records to obtain the first historical P2P service traffic data and historical DDoS attack data; Based on the preset attack trigger relationship feature extraction template, try to extract the attack trigger relationship feature set according to the first historical P2P service traffic data and the historical DDoS attack data; If the extraction attempt is successful, determine the statistical timing based on the P2P service traffic data and the attack trigger relationship feature set; If the extraction attempt fails, statistics are collected based on the preset statistical period.

8. The method for defending against DDoS attacks by port in P2P services according to claim 7, characterized in that: Obtain historical DDoS attack records, including: Try to obtain historical warnings; If the historical warning acquisition attempt is successful and the historical warning is a target type warning, obtain the second historical P2P service flow data of a preset time length before the corresponding historical warning; Determine the DDoS attack based on the second historical P2P service traffic data; If the DDoS attack is judged to be successful, the second historical P2P service flow data marked with the DDoS attack judgment result is used as a historical DDoS attack record; If the historical warning attempt fails, obtain the target route record; the target route record includes: the use record of the black hole route and the cleaning record of the bypass route; According to the record type of the target routing record, a DDoS attack processing feature extraction template is obtained; Based on the target routing records and DDoS attack processing feature extraction template, try to extract DDoS attack processing features; If the extraction attempt is successful, determine the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record processing; The third historical P2P service traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.

9. The method for defending against DDoS attacks by port in P2P services according to claim 6, characterized in that: Also includes: Before collecting P2P service traffic data, pre-verification of the P2P service party is performed.

10. The method for defending against DDoS attacks by port in P2P services according to claim 9, characterized in that: Before collecting P2P service traffic data, pre-verification of the P2P service provider is performed, including: Obtain risk business identification records; Determine historical risk business parties based on risk business identification records; Obtain the second risk business before the first risk business identified by the historical risk business party in the risk business identification record; Establishing a relationship between the second risk business and the first risk business; Calculate the relationship similarity of the corresponding association relationship of the first risk business of the same business type; If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding association relationship is regarded as a risk association relationship; Attempt to identify risk associations based on the fourth historical P2P business flow data and the P2P business flow data of the P2P business party; If the risk association relationship is successfully identified, the P2P business party is pre-verified based on the risk business feature set of the risk association relationship.

Images