Device and method for defending DDoS attack by port in P2P service
By using five-tuple flow statistics and dynamically configuring firewall blocking rules, the problem of P2P gateways defending against DDoS attacks has been solved, enabling precise defense of P2P services and improving network security.
Patent Information
- Application Number
- CN202411967658.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-11-11
- Estimated Expiration
- 2044-12-30
AI Technical Summary
When a P2P gateway is subjected to a DDoS attack, it can also lead to an attack on the internal network of the Internet access provider. Existing technologies are difficult to effectively defend against such attacks, especially in P2P services. Traditional defense methods cannot accurately block the attacked ports, resulting in insufficient network security.
By introducing five-tuple flow statistics for P2P business traffic data, the number of records for target IPs and target ports is aggregated through a central database. DDoS attacks are detected in real time, and the blocking rules of the ingress firewall are dynamically configured to accurately block attacked ports, thereby increasing the cost of DDoS attacks.
It achieved precise defense for P2P services, improved network security, and reduced the impact of DDoS attacks.
Smart Images
Figure CN119728280B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to an apparatus and method for defending against DDoS attacks on a port-by-port basis in P2P services. Background Technology
[0002] DDoS attacks are a common type of internet attack that sends large amounts of data or high PPS (pivot-per-second) data to a target IP address in a short period of time, causing network congestion or performance exceeding limits, resulting in a DoS (Denial of Service) error. Internet service providers (ISPs) are directly affected by DDoS attacks.
[0003] Internet access providers, possessing AS (Autonomous System) numbers, can publish black hole routes on the internet. Typically, attacked IPs are sent to the black hole route to defend against DDoS attacks, or traffic is cleaned by bypassing the route to a scrubbing device, or filtering rules are set at the ingress firewall.
[0004] Currently, internet service providers (ISPs) commonly use NAT (Network Address Translation) technology to address the issue of IPv4 address exhaustion for IPv4 broadband users. ISPs assign reserved IP addresses such as 10.0.0.0 / 8 to broadband users, and when user traffic passes through a NAT gateway, it is translated into public IPv4 addresses. A P2P gateway is a NAT gateway that is equipped to handle users' peer-to-peer (P2P) needs.
[0005] The unique feature of a P2P gateway is that after a user initiates a P2P connection request, the gateway assigns a port on a public IP address. All traffic sent by internet users to this IP address and port will be forwarded to that user. Therefore, if a P2P gateway is attacked by DDoS, it can lead to DDoS attacks on the internet service provider's internal network as well.
[0006] In view of this, there is an urgent need for devices and methods for port-based DDoS attack defense in P2P services, in order to at least address the aforementioned shortcomings. Summary of the Invention
[0007] One of the objectives of this invention is to provide a device and method for port-based DDoS attack defense in P2P services. It introduces a five-tuple flow to statistically analyze P2P service traffic data, and introduces statistical rules to aggregate and count the corresponding records from a central database based on the target IP and target port. After real-time detection of DDoS attacks, it dynamically configures the blocking rules of the ingress firewall for automatic blocking, accurately blocking the DDoS-affected ports, increasing the cost of DDoS attacks, and improving the security of P2P services.
[0008] The apparatus for port-based DDoS attack defense in P2P services provided in this embodiment of the invention includes:
[0009] The data upload subsystem is used to statistically analyze P2P business traffic data based on the five-tuple stream and upload it to the central database.
[0010] The statistics subsystem is used to determine the statistics rules, and based on the statistics rules, it summarizes and counts the corresponding records from the central database according to the target IP and target port, and filters the target IP and target port combinations with a record number greater than a set threshold.
[0011] The interception rule configuration subsystem is used to configure the interception rules of the ingress firewall based on the combination of target IP and target port.
[0012] The defense subsystem is used to defend against DDoS attacks using a firewall based on real-time configured blocking rules.
[0013] Preferably, the statistical subsystem determines the statistical rules, including:
[0014] Retrieve historical DDoS attack records;
[0015] Analyze historical DDoS attack records to obtain the first historical P2P business traffic data and historical DDoS attack data;
[0016] Based on the preset attack trigger relationship feature extraction template, and according to the first historical P2P business traffic data and historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set.
[0017] If the extraction attempt is successful, the timing for statistical analysis will be determined based on the P2P business traffic data and the attack trigger relationship feature set.
[0018] If the extraction attempt fails, statistics will be performed based on the preset statistical period.
[0019] Preferably, the statistics subsystem obtains historical DDoS attack records, including:
[0020] Try to retrieve historical alerts;
[0021] If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for the preset time period before the corresponding historical alert.
[0022] DDoS attack determination is based on the second historical P2P business traffic data.
[0023] If the DDoS attack is deemed successful, the second historical P2P service traffic data marked with the DDoS attack determination result will be used as a historical DDoS attack record.
[0024] If the attempt to obtain historical alerts fails, obtain the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route;
[0025] Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template;
[0026] Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features;
[0027] If the extraction attempt is successful, determine the third historical P2P business traffic data and DDoS attack processing characteristics of the corresponding target routing record;
[0028] The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
[0029] Preferably, the statistical subsystem acquires historical alerts, including:
[0030] Obtain the first platform business attributes of the pre-selected P2P platform, and at the same time, obtain the second platform business attributes of the local P2P platform.
[0031] Calculate the attribute similarity between the business attributes of the first platform and the business attributes of the second platform;
[0032] Sampling rules are determined based on attribute similarity;
[0033] Based on the sampling rules, obtain the first sampled historical attack records of the pre-selected P2P platforms;
[0034] Based on the sampling rules, obtain the second sampling historical attack records of the local P2P platform;
[0035] Determine whether the same attack ID exists in the first sampled historical attack record and the second sampled historical attack record;
[0036] If no identical attack ID exists, the initial pre-selection value of the pre-selected P2P platform is determined according to the initial pre-selection value determination rule preset by the sampling rules, and the initial pre-selection value is used as the final pre-selection value.
[0037] If the same attack ID exists, the first sampled historical attack record and the second sampled historical attack record with the same attack ID will be compared to calculate the similarity of the attack process.
[0038] Based on the preset correction rules and the initial pre-selection values preset according to the similarity of the attack process, the pre-selection values of the pre-selected P2P platforms are obtained.
[0039] Pre-selected P2P platforms with pre-selected values greater than or equal to a preset pre-selected value threshold will be used as platforms for obtaining historical early warnings.
[0040] The system for defending against DDoS attacks per port in P2P services provided in this embodiment of the invention further includes:
[0041] The pre-verification subsystem is used to pre-verify P2P business parties before statistically analyzing P2P business traffic data.
[0042] Preferably, before the pre-verification subsystem collects P2P business traffic data, it performs pre-verification of the P2P business party, including:
[0043] Obtain risk business identification records;
[0044] Based on the risk business identification record, identify the parties involved in historical risky business;
[0045] Obtain the second risky business prior to the first risky business identified in the risky business identification record by the historical risky business party;
[0046] Establish the relationship between the second risk business and the first risk business;
[0047] Calculate the relationship similarity of the first risk business corresponding to the same business type;
[0048] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship.
[0049] Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business party, we attempt to identify risk correlations.
[0050] If the risk association is successfully identified, the P2P business party will be pre-verified based on the risk business feature set of the risk association.
[0051] The method for defending against DDoS attacks per port in P2P services provided in this embodiment of the invention includes:
[0052] Step 1: Statistically analyze P2P business traffic data based on the five-tuple flow and upload it to the central database;
[0053] Step 2: Determine the statistical rules, and based on the statistical rules, summarize and count the corresponding records from the central database according to the target IP and target port, and filter the target IP and target port combinations with a record count greater than the set threshold;
[0054] Step 3: Configure the ingress firewall's blocking rules based on the target IP and target port combination;
[0055] Step 4: Defend against DDoS attacks using a firewall based on real-time configuration of blocking rules.
[0056] Preferably, the statistical rules are determined, including:
[0057] Retrieve historical DDoS attack records;
[0058] Analyze historical DDoS attack records to obtain the first historical P2P business traffic data and historical DDoS attack data;
[0059] Based on the preset attack trigger relationship feature extraction template, and according to the first historical P2P business traffic data and historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set.
[0060] If the extraction attempt is successful, the timing for statistical analysis will be determined based on the P2P business traffic data and the attack trigger relationship feature set.
[0061] If the extraction attempt fails, statistics will be performed based on the preset statistical period.
[0062] Preferably, historical DDoS attack records are retrieved, including:
[0063] Try to retrieve historical alerts;
[0064] If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for the preset time period before the corresponding historical alert.
[0065] DDoS attack determination is based on the second historical P2P business traffic data.
[0066] If the DDoS attack is deemed successful, the second historical P2P service traffic data marked with the DDoS attack determination result will be used as a historical DDoS attack record.
[0067] If the attempt to obtain historical alerts fails, obtain the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route;
[0068] Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template;
[0069] Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features;
[0070] If the extraction attempt is successful, determine the third historical P2P business traffic data and DDoS attack processing characteristics of the corresponding target routing record;
[0071] The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
[0072] The method for defending against DDoS attacks per port in P2P services provided in this embodiment of the invention further includes:
[0073] Before collecting P2P business traffic data, pre-verification of P2P business parties should be conducted.
[0074] Preferably, before collecting P2P business traffic data, pre-verification of the P2P business party should be performed, including:
[0075] Obtain risk business identification records;
[0076] Based on the risk business identification record, identify the parties involved in historical risky business;
[0077] Obtain the second risky business prior to the first risky business identified in the risky business identification record by the historical risky business party;
[0078] Establish the relationship between the second risk business and the first risk business;
[0079] Calculate the relationship similarity of the first risk business corresponding to the same business type;
[0080] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship.
[0081] Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business party, we attempt to identify risk correlations.
[0082] If the risk association is successfully identified, the P2P business party will be pre-verified based on the risk business feature set of the risk association.
[0083] The beneficial effects of this invention are as follows:
[0084] This invention introduces a five-tuple flow statistics method for P2P service traffic data. It introduces statistical rules to summarize and count the corresponding records from the central database according to the target IP and target port. After real-time detection of DDoS, it dynamically configures the blocking rules of the ingress firewall to automatically block the DDoS attack, accurately blocking the port affected by the DDoS attack, increasing the cost of DDoS attacks and improving the security of P2P services.
[0085] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.
[0086] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0087] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0088] Figure 1 This is a schematic diagram of a device for defending against DDoS attacks by port in a P2P service according to an embodiment of the present invention;
[0089] Figure 2 This is a schematic diagram of a method for defending against DDoS attacks by port in a P2P service according to an embodiment of the present invention. Detailed Implementation
[0090] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.
[0091] This invention provides a device for defending against DDoS attacks on a port-by-port basis in P2P services, such as... Figure 1 As shown, it includes:
[0092] Data upload subsystem 1 is used to statistically analyze P2P business traffic data based on five-tuple flow and upload it to the central database; the key fields for five-tuple flow statistics are protocol, source IP, destination IP, source port, destination port, uplink traffic, and downlink traffic;
[0093] Statistical Subsystem 2 is used to determine statistical rules. Based on the statistical rules, it summarizes and counts the corresponding records from the central database according to the target IP and target port, and filters the target IP and target port combinations with a record count greater than a set threshold. The set threshold is manually set, for example: 2000.
[0094] The interception rule configuration subsystem 3 is used to configure the interception rules of the ingress firewall based on the combination of target IP and target port.
[0095] Defense Subsystem 4 is a firewall used to defend against DDoS attacks based on real-time configured blocking rules.
[0096] The working principle and beneficial effects of the above technical solution are as follows:
[0097] This invention introduces a five-tuple flow statistics method for P2P service traffic data. It introduces statistical rules to summarize and count the corresponding records from the central database according to the target IP and target port. After real-time detection of DDoS, it dynamically configures the blocking rules of the ingress firewall to automatically block the DDoS attack, accurately blocking the port affected by the DDoS attack, increasing the cost of DDoS attacks and improving the security of P2P services.
[0098] In one embodiment, the statistical subsystem determines statistical rules, including:
[0099] Retrieve historical DDoS attack records; these records include logs of DDoS attacks historically suffered by the local internet access provider.
[0100] Analyze historical DDoS attack records to obtain historical P2P service traffic data and historical DDoS attack data; among them, historical P2P service traffic data refers to the P2P service traffic data of normal users in historical DDoS attack records; historical DDoS attack data refers to the P2P service traffic data of DDoS attack users in historical DDoS attack records.
[0101] Based on a preset attack trigger relationship feature extraction template, an attempt is made to extract an attack trigger relationship feature set according to historical P2P business traffic data and historical DDoS attack data. The preset attack trigger relationship feature extraction template is a description template that describes what kind of historical P2P business traffic data triggers what kind of DDoS attack.
[0102] If the extraction attempt is successful, the statistical timing will be determined based on the P2P business traffic data and the attack trigger relationship feature set. When determining the statistical timing, the description information of the business traffic data will be matched with the description information of historical P2P business traffic data. If the match is successful, the corresponding timing of the successful match will be used as the statistical timing.
[0103] If the extraction attempt fails, statistics will be performed based on a preset statistical period. Specifically, if the extraction attempt fails, it indicates that there are no significant features in the business traffic data that suggest a potential DDoS attack, and statistics will be performed directly based on a manually preset statistical period.
[0104] The working principle and beneficial effects of the above technical solution are as follows:
[0105] This invention acquires historical service traffic data and parses it to obtain first historical P2P service traffic data and historical DDoS attack data. It introduces an attack triggering relationship feature extraction template describing which historical P2P service traffic data triggers which DDoS attack, and attempts to extract the attack triggering relationship feature set between the first historical P2P service traffic data and the historical DDoS attack data. If the extraction attempt is successful, the timing of meeting the attack triggering condition is determined and statistically analyzed based on the P2P service traffic data and the attack triggering relationship feature set. The statistical timing is dynamically determined based on the characteristics of the first historical P2P service traffic data. If the extraction attempt fails, statistics are performed based on a preset statistical period. This avoids the problem of delayed detection of problematic IPs and port groups due to setting a fixed statistical period, thus preventing DDoS attacks and improving security.
[0106] In one embodiment, the statistics subsystem retrieves historical DDoS attack records, including:
[0107] Attempt to obtain historical alerts; where historical alerts refer to: historical alert information from the P2P platforms of the Internet access provider;
[0108] If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for a preset time period prior to the corresponding historical alert; among which, target type alerts include: link congestion and performance overrun; the preset time period is manually set.
[0109] DDoS attack determination is performed based on the second historical P2P business traffic data; when determining a DDoS attack, the corresponding DDoS attack determination method is retrieved according to the target type warning.
[0110] If the DDoS attack is determined to be successful, the second historical P2P business traffic data marked with the DDoS attack determination result will be used as the historical DDoS attack record; where the DDoS attack determination result is marked as the second historical P2P business traffic data marked with the attack traffic data of malicious users and the traffic data of ordinary users.
[0111] If the attempt to obtain historical alerts fails, obtain the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route;
[0112] Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template. The DDoS attack handling feature extraction template is a template for extracting DDoS attack handling features by comparing the target routing records of different record types. The DDoS attack handling features include, for example: which IP addresses or IP ranges are directed to the black hole route, the time and duration of the application of the routing rules, the amount of traffic being cleaned, the specific type of cleaning operation (e.g., dropping, rate limiting), and the reinjection path of the traffic after cleaning.
[0113] Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features;
[0114] If the extraction attempt is successful, the third historical P2P service traffic data and DDoS attack processing characteristics of the corresponding target routing record are determined; among them, the attack traffic data of malicious users and the traffic data of ordinary users in the third historical P2P service traffic data can be identified based on the DDoS attack processing characteristics.
[0115] The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
[0116] The working principle and beneficial effects of the above technical solution are as follows:
[0117] When obtaining historical DDoS attack records, the first step is to retrieve historical warning information. For example, DDoS attacks typically cause link congestion and performance exceeding limits. A DDoS attack is possible when a corresponding warning is issued. However, not all link congestion and performance exceeding limits are caused by DDoS attacks (e.g., a mismatch between server performance and the volume of regular P2P traffic being processed can also cause these issues). Therefore, when a target-type warning (e.g., link congestion and performance exceeding limits) is issued, a DDoS attack determination method is established based on the target-type warning. The second historical P2P traffic data, representing a preset time period prior to the corresponding historical warning, is then used to determine the historical DDoS attack. Attack records; if DDoS attacks cannot be identified through historical alerts, there may be situations where the server successfully handles the attack without issuing an alert (e.g., sending the attacked IP to a black hole route to defend against DDoS attacks, or using a bypass route to a cleaning device for traffic cleaning). Therefore, obtain the target routing record, determine the DDoS attack processing feature extraction template based on the record type, and attempt to extract DDoS attack processing features. If the extraction attempt is successful, it indicates that the routing process corresponding to the routing record is a DDoS attack processing process. Based on the DDoS attack processing features and third-party historical P2P business traffic data, determine historical DDoS attack records, improving the comprehensiveness and rationality of obtaining historical DDoS attack records.
[0118] In one embodiment, the statistical subsystem acquires historical alerts, including:
[0119] Obtain the first platform business attributes of the pre-selected P2P platforms, and at the same time, obtain the second platform business attributes of the local P2P platforms; wherein, the pre-selected P2P platforms are: all P2P platforms available for historical early warning through big data search; the platform business attributes include: information such as the personnel type and business type of the business party;
[0120] Calculate the attribute similarity between the business attributes of the first platform and the business attributes of the second platform;
[0121] Sampling rules are determined based on attribute similarity; the sampling rule is that the greater the attribute similarity, the smaller the sample size, and the specific inverse ratio is set manually.
[0122] Based on the sampling rules, the first sampled historical attack records of the pre-selected P2P platforms are obtained; the sampled historical attack records are: records of DDoS attacks suffered by the P2P platforms in history, extracted based on the sampling rules.
[0123] Based on the sampling rules, obtain the second sampling historical attack records of the local P2P platform;
[0124] Determine whether the same attack ID exists in the first sampled historical attack record and the second sampled historical attack record;
[0125] If no identical attack IDs exist, the initial pre-selection value for the pre-selected P2P platform is determined according to the initial pre-selection value determination rule preset by the sampling rules, and the initial pre-selection value is used as the final pre-selection value; wherein, the preset initial pre-selection value determination rule is: the smaller the sample size, the larger the initial pre-selection value;
[0126] If the same attack ID exists, the first and second sampled historical attack records with the same attack ID are compared to calculate the attack process similarity; where the attack process similarity is: the degree of similarity between the DDoS attack processes recorded in the historical attack records sampled from the pre-selected P2P platform and the local P2P platform.
[0127] Based on preset correction rules and the initial pre-selection value preset by the sampling rules according to the similarity of the attack process, the pre-selection value of the pre-selected P2P platform is obtained; among them, the greater the similarity of the attack process, the more the corresponding initial pre-selection value is adjusted upward.
[0128] Pre-selected P2P platforms with pre-selected values greater than or equal to a preset pre-selected value threshold will be used as platforms for obtaining historical early warnings.
[0129] The working principle and beneficial effects of the above technical solution are as follows:
[0130] When obtaining historical alerts for extracting historical DDoS attack records, the platforms to be extracted need to be screened beforehand. During screening, the similarity between the first platform business attributes of the pre-selected P2P platforms and the second platform business attributes of the local P2P platform is calculated, and the sampling rules corresponding to the attribute similarity are determined (the greater the attribute similarity, the smaller the sample size). Based on the sampling rules, the first sampled historical attack records of the pre-selected P2P platforms and the second sampled historical attack records of the local P2P platform are screened separately. It is then determined whether there is a common attack ID in the first and second sampled historical attack records. If no common attack ID is found, it indicates that the sampled historical attack... If no identical attackers are found between the pre-selected P2P platforms and the local P2P platform, the pre-selection value of the pre-selected P2P platforms is determined based on the sampling number (the smaller the sampling number, the lower the probability of identical attack IDs, therefore the smaller the sampling number, the larger the initial pre-selection value). If identical attack IDs exist, the similarity of the attack process is compared, and the initial pre-selection value of the pre-selected P2P platforms determined based on the sampling rules is increased according to the similarity of the attack process (the greater the similarity of the attack process, the greater the increase in the corresponding initial pre-selection value). Finally, pre-selected P2P platforms with pre-selection values greater than or equal to the pre-selection value threshold are selected as platforms for obtaining historical alerts, thereby improving the availability of subsequent historical DDoS attack records.
[0131] This invention provides a method for defending against DDoS attacks on a port-by-port basis in P2P services, and further includes:
[0132] The pre-verification subsystem is used to pre-verify P2P service providers before statistically analyzing P2P service traffic data. The P2P service providers are the senders and receivers of P2P service traffic data.
[0133] The working principle and beneficial effects of the above technical solution are as follows:
[0134] Before collecting P2P business traffic data, risky business can be identified based on the prior information of the P2P business (such as the business transactions handled by the P2P business in the past). When a risky business is identified, the business service of the corresponding P2P business can be suspended directly. Otherwise, subsequent DDoS attack defenses can be carried out on the P2P business traffic data of the corresponding P2P business to improve defense efficiency.
[0135] In one embodiment, before the pre-verification subsystem collects P2P service traffic data, it performs pre-verification of the P2P service provider, including:
[0136] Obtain risk business identification records; whereby, risk business identification records are: process records of identifying business risks during the P2P business process;
[0137] Based on the risk business identification record, identify the parties involved in historical risky business; among them, the parties involved in historical risky business are: the parties that handled the risky business in the risk business identification record;
[0138] Obtain the second risky business prior to the first risky business identified in the risky business identification record; wherein, the first risky business is: the risky P2P business identified in the risky business identification record; and the second risky business is: the historical P2P business related to the first risky business that was handled before the first risky business.
[0139] Establish the relationship between the second risk business and the first risk business;
[0140] Calculate the relationship similarity of the first risk business corresponding to the same business type; where the relationship similarity is: the similarity of the historical P2P business related to the first risk business that was handled before the first risk business. The higher the relationship similarity, the more similar the types of second risk businesses associated with the first risk business of the corresponding business type, indicating that the corresponding second risk business can have a more synergistic effect on the first risk business.
[0141] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship; the preset relationship similarity threshold is set manually in advance.
[0142] Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business provider, an attempt is made to identify risk correlations; whereby the fourth historical P2P business traffic data refers to the historical P2P business traffic data of the P2P business provider.
[0143] If the risk association is successfully identified, the P2P business parties are pre-verified based on the risk business characteristic set of the risk association. This risk business characteristic set includes multiple risk characteristics, including the P2P business behavior of the parties handling the first and / or second risk businesses corresponding to the risk association.
[0144] The working principle and beneficial effects of the above technical solution are as follows:
[0145] This invention acquires historical risk business identification records, identifies the historical risk business parties in the records, parses the risk business identification records, identifies the first risk business, and introduces second risk businesses related to the first risk business that were processed before the first risk business to establish a correlation between the second risk business and the first risk business. It calculates the relationship similarity of the correlation between the first risk business of the same business type and the corresponding second risk business. The higher the relationship similarity, the more similar the types of second risk businesses associated with the first risk business of the corresponding business type are, indicating that the corresponding second risk business can synergistically affect the first risk business. It filters risk correlation relationships with a relationship similarity greater than the relationship similarity threshold, making the extraction of risk correlation relationships more reasonable.
[0146] By introducing the fourth historical P2P business traffic data and P2P business traffic data of P2P business parties, the risk correlation of business types is identified based on the current business type (determined by P2P business traffic data) and the previous business type (determined by the fourth historical P2P business traffic data). If the identification is successful, the P2P business behavior of the business parties in the historical risks corresponding to the corresponding risk correlation is further verified, which improves the pre-verification efficiency.
[0147] This invention provides a method for defending against DDoS attacks on a port-by-port basis in P2P services, such as... Figure 2 As shown, it includes:
[0148] Step 1: Statistically analyze P2P business traffic data based on the five-tuple flow and upload it to the central database;
[0149] Step 2: Determine the statistical rules, and based on the statistical rules, summarize and count the corresponding records from the central database according to the target IP and target port, and filter the target IP and target port combinations with a record count greater than the set threshold;
[0150] Step 3: Configure the ingress firewall's blocking rules based on the target IP and target port combination;
[0151] Step 4: Defend against DDoS attacks using a firewall based on real-time configuration of blocking rules.
[0152] In one embodiment, determining the statistical rules includes:
[0153] Retrieve historical DDoS attack records;
[0154] Analyze historical DDoS attack records to obtain the first historical P2P business traffic data and historical DDoS attack data;
[0155] Based on the preset attack trigger relationship feature extraction template, and according to the first historical P2P business traffic data and historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set.
[0156] If the extraction attempt is successful, the timing for statistical analysis will be determined based on the P2P business traffic data and the attack trigger relationship feature set.
[0157] If the extraction attempt fails, statistics will be performed based on the preset statistical period.
[0158] In one embodiment, obtaining historical DDoS attack records includes:
[0159] Try to retrieve historical alerts;
[0160] If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for the preset time period before the corresponding historical alert.
[0161] DDoS attack determination is based on the second historical P2P business traffic data.
[0162] If the DDoS attack is deemed successful, the second historical P2P service traffic data marked with the DDoS attack determination result will be used as a historical DDoS attack record.
[0163] If the attempt to obtain historical alerts fails, obtain the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route;
[0164] Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template;
[0165] Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features;
[0166] If the extraction attempt is successful, determine the third historical P2P business traffic data and DDoS attack processing characteristics of the corresponding target routing record;
[0167] The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
[0168] The method for defending against DDoS attacks per port in P2P services provided in this embodiment of the invention further includes:
[0169] Before collecting P2P business traffic data, pre-verification of P2P business parties should be conducted.
[0170] In one embodiment, before collecting P2P service traffic data, pre-verification of the P2P service provider is performed, including:
[0171] Obtain risk business identification records;
[0172] Based on the risk business identification record, identify the parties involved in historical risky business;
[0173] Obtain the second risky business prior to the first risky business identified in the risky business identification record by the historical risky business party;
[0174] Establish the relationship between the second risk business and the first risk business;
[0175] Calculate the relationship similarity of the first risk business corresponding to the same business type;
[0176] If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship.
[0177] Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business party, we attempt to identify risk correlations.
[0178] If the risk association is successfully identified, the P2P business party will be pre-verified based on the risk business feature set of the risk association.
[0179] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A device for defending against DDoS attacks per port in P2P services, characterized in that, include: The data upload subsystem is used to statistically analyze P2P business traffic data based on the five-tuple stream and upload it to the central database. The statistics subsystem is used to determine the statistics rules, and based on the statistics rules, it summarizes and counts the corresponding records from the central database according to the target IP and target port, and filters the target IP and target port combinations with a record number greater than a set threshold. The interception rule configuration subsystem is used to configure the interception rules of the ingress firewall based on the combination of target IP and target port. The defense subsystem is used to defend against DDoS attacks using a firewall based on real-time configured blocking rules. The statistical subsystem defines the statistical rules, including: Retrieve historical DDoS attack records; Analyze historical DDoS attack records to obtain the first historical P2P business traffic data and historical DDoS attack data; Based on the preset attack trigger relationship feature extraction template, and according to the first historical P2P business traffic data and historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set. If the extraction attempt is successful, the timing for statistical analysis will be determined based on the P2P business traffic data and the attack trigger relationship feature set. If the extraction attempt fails, statistics will be performed based on the preset statistical period.
2. The device for defending against DDoS attacks per port in P2P services as described in claim 1, characterized in that, The statistics subsystem retrieves historical DDoS attack records, including: Try to retrieve historical alerts; If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for the preset time period before the corresponding historical alert. DDoS attack determination is based on the second historical P2P business traffic data. If the DDoS attack is deemed successful, the second historical P2P service traffic data marked with the DDoS attack determination result will be used as a historical DDoS attack record. If the attempt to retrieve historical alerts fails, retrieve the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route; Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template; Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features; If the extraction attempt is successful, determine the third historical P2P business traffic data and DDoS attack processing characteristics of the corresponding target routing record; The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
3. The device for port-based DDoS attack defense in P2P services as described in claim 1, characterized in that, Also includes: The pre-verification subsystem is used to pre-verify P2P business parties before statistically analyzing P2P business traffic data.
4. The device for port-based DDoS attack defense in P2P services as described in claim 3, characterized in that, Before the pre-verification subsystem collects P2P service traffic data, it performs pre-verification of the P2P service providers, including: Obtain risk business identification records; Based on the risk business identification record, identify the parties involved in historical risky business; Obtain the second risky business prior to the first risky business identified in the risky business identification record by the historical risky business party; Establish the relationship between the second risk business and the first risk business; Calculate the relationship similarity of the first risk business corresponding to the same business type; If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship. Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business party, we attempt to identify risk correlations. If the risk association is successfully identified, the P2P business party will be pre-verified based on the risk business feature set of the risk association.
5. A method for defending against DDoS attacks by port in P2P services, characterized in that, include: P2P business traffic data is statistically analyzed based on the five-tuple flow and uploaded to the central database; Define the statistical rules, and based on the statistical rules, summarize and count the corresponding records from the central database according to the target IP and target port, and filter the target IP and port combinations with a record number greater than the set threshold; Configure the ingress firewall's blocking rules based on the target IP and target port combination; Firewall defense against DDoS attacks based on real-time configuration of blocking rules; Among these, defining the statistical rules includes: Retrieve historical DDoS attack records; Analyze historical DDoS attack records to obtain the first historical P2P business traffic data and historical DDoS attack data; Based on the preset attack trigger relationship feature extraction template, and according to the first historical P2P business traffic data and historical DDoS attack data, an attempt is made to extract the attack trigger relationship feature set. If the extraction attempt is successful, the timing for statistical analysis will be determined based on the P2P business traffic data and the attack trigger relationship feature set. If the extraction attempt fails, statistics will be performed based on the preset statistical period.
6. The method for defending against DDoS attacks per port in P2P services as described in claim 5, characterized in that, Retrieve historical DDoS attack records, including: Try to retrieve historical alerts; If the historical alert attempt is successful and the historical alert is a target type alert, retrieve the second historical P2P business traffic data for the preset time period before the corresponding historical alert. DDoS attack determination is based on the second historical P2P business traffic data. If the DDoS attack is deemed successful, the second historical P2P service traffic data marked with the DDoS attack determination result will be used as a historical DDoS attack record. If the attempt to retrieve historical alerts fails, retrieve the target route record; the target route record includes: the usage record of the black hole route and the cleaning record of the bypass route; Based on the record type of the target routing record, obtain the DDoS attack handling feature extraction template; Based on the target routing records and the DDoS attack handling feature extraction template, attempt to extract DDoS attack handling features; If the extraction attempt is successful, determine the third historical P2P business traffic data and DDoS attack processing characteristics of the corresponding target routing record; The third historical P2P business traffic data and DDoS attack processing characteristics are used as historical DDoS attack records.
7. The method for defending against DDoS attacks per port in P2P services as described in claim 5, characterized in that, Also includes: Before collecting P2P business traffic data, pre-verification of P2P business parties should be conducted.
8. The method for defending against DDoS attacks per port in P2P services as described in claim 7, characterized in that, Before collecting P2P business traffic data, pre-verification of P2P business providers is required, including: Obtain risk business identification records; Based on the risk business identification record, identify the parties involved in historical risky business; Obtain the second risky business prior to the first risky business identified in the risky business identification record by the historical risky business party; Establish the relationship between the second risk business and the first risk business; Calculate the relationship similarity of the first risk business corresponding to the same business type; If the relationship similarity is greater than or equal to the preset relationship similarity threshold, the corresponding relationship will be regarded as a risky relationship. Based on the fourth historical P2P business traffic data and P2P business traffic data of the P2P business party, we attempt to identify risk correlations. If the risk association is successfully identified, the P2P business party will be pre-verified based on the risk business feature set of the risk association.
Citation Information
Patent Citations
Flow log based DDoS attack event detection method and system
CN108712365A