Asynchronous distributed denial of service attack test method and test instrument thereof

Abstract

The invention provides an asynchronous distributed denial of service attack test method and a test instrument thereof. The invention provides a security test system based on an asynchronous distributed low-rate denial of service (ADLDoS) aiming at the problems that an existing network traffic test instrument is limited in processing capacity, not modularized enough in hardware design, unfriendly in user interface and neglected in security test aiming at an upper-layer network traffic environment due to the fact that functions are concentrated on a performance level and the like. The system comprises a client host connection test module, a data flow configuration module, a starting performance test module, a security test module and the like, has the advantages of high performance, modular design, real-time performance, data driving and the like, and comprehensively improves the performance and security of a network.

Description

Technical Field

[0001] The present invention belongs to the field of testing instruments, and in particular, relates to a comprehensive network flow testing instrument and a testing method for asynchronous distributed denial of service attacks, especially a comprehensive network flow testing instrument and an asynchronous distributed low-rate denial of service attack generation method. Background Art

[0002] Comprehensive network traffic testing equipment is mainly developed to meet the testing requirements of network systems and network equipment, such as security performance, protocol consistency, forwarding performance, forwarding function, network data processing capability, and business simulation.

[0003] The results of technical research and equipment development of network comprehensive flow testing instruments can be used by network equipment manufacturers, information security assessment agencies, confidentiality technology inspection departments, public security or national security information departments, network equipment research institutes, communication network research and development units, shooting range construction units, military information system support departments and other units to meet the functional status, performance indicators, protocol consistency, interoperability, security, service processing capabilities and other testing needs of information system networks and their equipment.

[0004] The test scenarios, network scale, interface performance, protocol type and complexity, port density, etc. of this type of test equipment may be different. Therefore, during the application process, this type of network test equipment may face difficulties such as device stacking (cascading), port expansion, and software and firmware upgrades.

[0005] In addition, the increasing business demands have put forward new requirements for the security testing of network communication systems. The existing test instruments are difficult to meet these testing requirements, which are specifically reflected in the following aspects:

[0006] 1. The processing power of existing network traffic testing instruments is limited, which restricts the ability to process high-speed data streams, especially when processing large amounts of data or performing complex analysis, the processing efficiency will be reduced.

[0007] 2. The hardware design of existing test instruments is not modular enough, which makes it difficult to add new functions or upgrade existing components. As network speeds increase, the network interfaces of traditional test instruments can no longer support the latest high-speed network standards.

[0008] 3. The functions of traditional testing instruments are mainly concentrated on testing the network performance level. However, with the complexity of the network environment, the network traffic at the upper layers such as the application layer is increasing sharply, and the network security risks are also increasing. This has given rise to the demand for testing the upper-layer network traffic environment such as network security testing. These functions need to be supplemented urgently.

[0009] 4. The user interface of traditional testing instruments is not friendly enough, complicated and difficult to use, and not intuitive enough, resulting in high learning and operation costs for users, high requirements for user experience and difficulty in getting started.

[0010] 5. The software installed on traditional test instruments is updated slowly. The difficulty in quickly updating the software makes it difficult to support new network protocols or test standards in a timely manner, which limits the applicability of the test instruments.

[0011] 6. The software used by traditional test instruments is difficult to integrate with other systems or tools, and has poor compatibility and integration, which limits its application in complex network environments.

[0012] 6. Denial of Service (DoS) attacks are used in security testing of traditional testing instruments. This is one of the most commonly used attack methods by network attackers.

[0013] According to the traffic volume, DoS attacks are divided into high-rate flood attacks and low-rate denial of service (LDoS). The latter's traffic only accounts for 10% to 20% of normal traffic.

[0014] Because the average rate of this attack in the time domain is low, the traffic occupies a small bandwidth, and it has excellent ability to evade detection, it is one of the most commonly used attack methods by cyber criminals.

[0015] Traditional testing instruments are only capable of high-rate flood attacks, which have obvious traffic characteristics and can be easily detected and blocked by conventional detection methods.

[0016] Therefore, a test method using asynchronous distributed denial of service attacks is proposed as one of the ways of network security testing. However, in the existing test methods of asynchronous distributed denial of service attacks, the simulation implementation of attacks has the following deficiencies:

[0017] 1. Since the traffic sending rate is low, it is necessary to accurately control the traffic sending frequency to avoid being detected and blocked, and high time accuracy is required.

[0018] 2. The attack intensity of a single attack source is not high enough. To ensure the effectiveness of the attack, the attack must be continuous.

[0019] 3. It is not applicable to various network environments and requires different attack methods and strategies.

[0020] For example, patent document CN112398781A discloses that during a distributed denial of service (DDoS) attack test, attack traffic is generated and sent by a virtual host managed by a control server to simulate a large-scale DDoS attack.

[0021] This attack testing method, host server and main control server are used to conduct attack tests on the core network service plane. By simulating the attack traffic of distributed denial of service attacks on the access network side and the Internet side, it verifies the ability of 5G network services to defend against distributed denial of service attacks (Anti-DDoS).

[0022] However, this distributed denial of service attack is essentially a flood network attack. As a simulated attack in security testing, it still has the following shortcomings and limitations:

[0023] 1. Easy to be detected and intercepted: The traffic characteristics of distributed denial of service attacks are obvious. Many security systems are already able to identify and filter most of the abnormal traffic, making the attack traffic not concealed enough.

[0024] 2. High cost of attack testing: Launching a DDoS attack test requires setting up a large number of devices and establishing a botnet. Maintaining such a large-scale botnet requires a lot of time and technical costs to establish and maintain. Especially when the target of the attack has strong defense capabilities, the attacker may need to continue to invest resources to maintain the attack, making the testing cost high.

[0025] 3. Weak targeting of attack effects: DDoS attacks have a wide range of effects. If an attack is launched, the bandwidth of the target system will be exhausted, thereby blocking network services. At the same time, the effect of the attack is uncontrollable, and the lack of targeting of network protocols will affect other services that need to run normally in the test environment. If the protection of the network edge is weak, it will even affect the test environment.

[0026] 4. Poor results: Currently, many defense mechanisms are designed for high-traffic attacks, such as traffic rate limiting, threshold-based filtering, etc. Even if the attack is successful, it is usually only temporary, and the target system may recover quickly after the attack stops.

[0027] These shortcomings make the use of this type of DDoS attack testing not an effective testing method for target systems that generally have a high level of network security protection.

[0028] Therefore, there is an urgent need to propose an efficient and comprehensive testing method to address the various deficiencies and defects in current development and testing. Summary of the invention

[0029] In view of the defects in the prior art, the purpose of the present invention is to provide a comprehensive network traffic testing instrument and a testing method for asynchronous distributed denial of service attacks.

[0030] A comprehensive network traffic testing instrument provided by the present invention comprises:

[0031] Module M1: Let the client host log in to the test module;

[0032] Module M2: instructs the test module to add data flow, configure parameters, and count the data flow in real time;

[0033] Module M3: instructing the test module to start the performance test module;

[0034] Module M4: instructs the test module to start the safety test module.

[0035] Preferably, the client host comprises: a module A configured with a CPU, an FPGA, and a DDR, and a module B with distributed computing;

[0036] The module B can work in coordination with the CPU, FPGA, and DDR in the module A and perform data processing through distributed computing;

[0037] The module A can reasonably allocate corresponding functions according to the technical advantages, specifically: allocate the data stream to a high-speed digital logic circuit for implementation, the high-speed digital logic circuit can simulate and generate a rich test data stream, and the rate can reach the line speed, and can perform real-time statistical analysis;

[0038] The module B includes: a data module and a management module;

[0039] The system of the comprehensive network flow test instrument runs in the main control module in the management module, and further controls and manages the high-speed network test module in the management module through the backplane unit in the management module, thereby realizing the high-speed network test task of the data flow;

[0040] The data module is capable of collecting, processing, storing and transmitting the data stream;

[0041] The management module includes: a high-speed network test module and a chassis module; the high-speed network test module and the main control module in the management module are independently designed on the physical unit, and the two communication modes of Ethernet and IPMI are integrated in the system bus in the management module, and data transmission is performed through the CPCI interface;

[0042] The high-speed network test module includes: an onboard CPU and an onboard FPGA;

[0043] Specifically, the high-speed network test module is set as an independent module and configured as needed; the onboard FPGA can realize data flow generation and transmission, data flow capture and storage, data flow statistics and analysis, and benchmark testing functions; the onboard CPU can realize protocol simulation analysis, protocol testing, and application service testing functions;

[0044] The chassis module includes: a main control module, a clock module, a backplane unit, a power module, a fan module, an LCD display control unit, an LED control unit, and a system bus;

[0045] Specifically, the main control module includes: a system management module, a system configuration module, and a user interface module;

[0046] The system management module: monitors the health of the subsystems and units of the chassis module, controls the cooling fans and manages the power supply through a dedicated system controller;

[0047] The system configuration module: can realize the functions of system configuration and statistical test quantity;

[0048] The user interface module: can realize layout, interaction, vision and response functions in real time;

[0049] The clock module: can provide clock and TOD clock information for each internal test module, realize clock synchronization between multiple test modules and coordinated testing between test units, and can also realize multi-machine synchronous testing by introducing a clock signal from the outside as a reference clock;

[0050] The backplane unit: can provide power and system management for each unit, and provide control, data, trigger and timing connections between units;

[0051] The power module is configured accordingly according to the overall power consumption of the whole machine;

[0052] The fan module can ensure that each unit can maintain stable performance under long-term high-load operation;

[0053] The LCD display control unit can display various status information and operation prompts of the device in real time;

[0054] The LED control unit: capable of managing and controlling the status information of each device;

[0055] The system bus includes: a standard IPMI interface.

[0056] Preferably, the module M2 comprises the following:

[0057] Module M201: instructs the port to add a data stream, and sets the frame length, source MAC address, and source IP address of the data stream;

[0058] Module M202: Set the sending mode of the data stream to burst mode, and set the number of bursts and the number of burst messages;

[0059] Module M203: Start sending and capturing the data stream;

[0060] Module M204: monitors the data stream, and captures the characteristics and quantity of the data stream that are consistent with the transmission.

[0061] Preferably, the module M3 comprises the following:

[0062] Module M301: configure test parameters to enable the performance test module to add test ports in batches, where the number of the test ports is at least two;

[0063] Module M302: instruct the performance test module to select a source port and a destination port, wherein the source port and the destination port are different ports, and instruct the performance test module to select a protocol layer and a sending direction, and add a test interface with test direction information;

[0064] Module M303: instructing the performance test module to configure the learning frequency, learning level and time parameters, and instructing the performance test module to start back-to-back testing;

[0065] Module M304: instructing the performance test module to start the delay test;

[0066] Module M305: instructing the performance test module to start the packet loss rate test;

[0067] Module M306: instructing the performance test module to start a throughput test;

[0068] Module M307: After the performance test is completed, the test module is made to display the corresponding performance test result;

[0069] The module M4 includes the following:

[0070] Module M401: configure the switch port and connect the security test module;

[0071] Module M402: instructing the security test module to start network detection and capture;

[0072] Module M403: instructing the security test module to open the test port;

[0073] Module M404: configure the physical address, IP address, and basic parameters of the port data flow of the security test module;

[0074] Module M405: configure the attack list of the security test module;

[0075] Module M406: Start the test of the safety test module.

[0076] A method for testing an asynchronous distributed denial of service attack provided by the present invention comprises the following steps:

[0077] Step S1: Let the client host log in to test;

[0078] Step S2: Add data streams, configure parameters, and view statistics;

[0079] Step S3: Start performance test;

[0080] Step S4: Start the safety test.

[0081] Preferably, the step S2 includes the following:

[0082] Step S201: instructing the port to add a data stream, and setting the frame length, source MAC address, and source IP address of the data stream;

[0083] Step S202: setting the transmission mode of the data stream to burst mode, and setting the number of burst times and the number of burst messages;

[0084] Step S203: Start sending and capturing the data stream;

[0085] Step S204: monitor the data stream, and capture the features and quantity of the data stream that meet the requirements for transmission.

[0086] Preferably, the step S3 includes the following:

[0087] Step S301: configure test parameters and add test ports in batches, where the number of the test ports is at least two;

[0088] Step S302: selecting a source port and a destination port, the source port and the destination port being different ports, selecting a protocol layer and a sending direction, and adding a test interface with test direction information;

[0089] Step S303: configuring the learning frequency, learning level and time parameters of the performance test, and starting the back-to-back test;

[0090] Step S304: Instruct the performance test to start a delay test;

[0091] Step S305: instructing the performance test to start a packet loss rate test;

[0092] Step S306: Instruct the performance test to start a throughput test;

[0093] Step S307: After the performance test is completed, the corresponding performance test result is displayed.

[0094] Preferably, the step S4 includes the following:

[0095] Step S401: configuring the switch port and connecting the security test device;

[0096] Step S402: enabling the security test to start network detection and capture;

[0097] Step S403: enabling the security test to open a test port;

[0098] Step S404: configuring the basic parameters of the physical address, IP address, and port data flow of the security test;

[0099] Step S405: configuring the attack list of the security test;

[0100] Step S406: Start the security test.

[0101] According to a flow test device provided by the present invention, the integrated network flow test instrument is used to test the generated asynchronous distributed denial of service attack.

[0102] According to the test equipment for asynchronous distributed denial of service attack provided by the present invention, the comprehensive network traffic test instrument is adopted to form a continuous asynchronous distributed denial of service attack and perform security test.

[0103] Compared with the prior art, the present invention has the following beneficial effects:

[0104] 1. High performance: It can handle higher-rate network traffic and provide more accurate test results. It can be used to measure performance indicators such as bandwidth, latency, and packet loss rate of high-speed networks, helping network administrators monitor and optimize network performance.

[0105] 2. Possess network security testing function: It can be used to conduct security tests such as denial of service attacks and real-time security attacks, help discover security risks in the network and strengthen network security protection.

[0106] 3. Modular design: Modular hardware design allows users to add or replace components as needed, improving the scalability and flexibility of the system. Components are developed in accordance with the interface specifications of the framework so that they can be easily integrated into the entire framework. At the same time, object-oriented programming is adopted and there is rich support for component development tools to quickly develop new functions.

[0107] 4. Improve user experience: Develop and use intuitive and easy-to-use web-based interfaces to simplify operation processes and reduce user learning costs.

[0108] 5. Enhance the real-time performance of the software: A flexible software architecture has been established to facilitate rapid updates and addition of new functions, and to support new network protocols and testing standards.

[0109] 6. Framework: Improves compatibility and integration, ensures that the software can be seamlessly integrated with other systems or tools, supports a wider range of network environments and application scenarios, and has a better framework structure to adapt to the needs of parameter changes and function expansion of different objects under test, while providing interface specifications for integrating various components. The framework part realizes engineering data management, process configuration, overall interface and navigation functions as a whole.

[0110] 7. With automation function: Provide powerful automated testing scripts and processes to reduce manual operations and improve testing efficiency.

[0111] 8. Data-driven: Each part is connected through data (including files), which can ensure the independence of each component. In addition, the data-driven system well reflects the MVC model, separates data from specific control and display, facilitates platform maintenance and upgrades, and integrates advanced data analysis and visualization tools to help users better understand and use test results.

[0112] 9. Low rate: The attack traffic of the present invention can be kept at a low rate to simulate normal traffic. This attack is achieved by sending incomplete requests or creating bottlenecks at the protocol level. Due to the low traffic, traditional DDoS defense mechanisms based on traffic statistics are not easy to identify these attacks.

[0113] 10. Persistence and concealment: The attack method proposed by the present invention can be carried out for a long time without being detected. Since the traffic of this attack method is dispersed and simulates normal user behavior, traditional DDoS defense strategies, such as traffic thresholds and IP blacklists, are difficult to defend effectively. More advanced behavioral analysis and machine learning technologies are needed to identify and defend against such attacks. At the same time, the present invention takes advantage of the complexity and distributed characteristics of modern networks, making it more threatening than traditional high-traffic DDoS attacks in some cases. Therefore, in security testing, the attack method proposed by the present invention can more comprehensively and effectively evaluate the security of the target system. BRIEF DESCRIPTION OF THE DRAWINGS

[0114] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0115] Figure 1 This is a schematic diagram of the LDoS attack method;

[0116] Figure 2 A schematic diagram of a testing method for asynchronous distributed denial of service attacks;

[0117] Figure 3 This is a schematic diagram of the working principle of the comprehensive network traffic test instrument;

[0118] Figure 4 A schematic diagram of the hardware solution structure of the test method for asynchronous distributed denial of service attacks;

[0119] Figure 5 Schematic diagram of security testing of comprehensive network traffic testing instrument.

[0120] The figure shows:

[0121] Rate indicates the attack rate;

[0122] Time means time;

[0123] L represents the pulse width;

[0124] R represents the pulse amplitude. DETAILED DESCRIPTION

[0125] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0126] The present invention proposes a comprehensive network flow test instrument, such as Figure 3 and Figure 4 As shown in the figure, the architecture adopts the CPU+FPGA+DDR design scheme, and the corresponding functions are reasonably allocated according to the technical implementation advantages.

[0127] The above-mentioned reasonable allocation of corresponding functions according to the advantages of technical implementation indicates that functions such as data stream generation and transmission, data stream capture and storage, data stream statistics and analysis, and benchmark testing are allocated to high-speed digital logic circuits with high-speed processing capabilities for implementation. Based on high-speed digital logic circuits, large-scale and rich test data streams can be simulated, and the rate can reach line speed, and real-time statistical analysis can be performed. Specifically, functions such as real-time security attack testing are allocated to processors with operating systems installed for implementation, which can make full use of existing protocol testing technology achievements and related software resources, quickly develop and implement new protocol testing functions, and break away from the software system of dedicated hardware platforms, which can be flexibly upgraded and expanded.

[0128] The overall hardware solution of the design adopts a distributed computing architecture, which is logically divided into a data plane and a management plane, and the test module and the main control module are designed independently in the physical unit. It is necessary to integrate the two communication modes of Ethernet and IPMI in the system bus and transmit them through the connector of the CPCI interface.

[0129] The design scheme mainly consists of two parts: a high-speed network test module and a chassis module (including a main control module, a clock module, a backplane unit, a power module, a fan module, an LCD display control unit and an LED control unit, etc.).

[0130] The design scheme includes the following contents:

[0131] In the hardware structure, the system test application software runs in the main control module, and controls and manages the network test module through the backplane unit to achieve high-speed network test tasks. The high-speed network test module is designed as an independent module, which can be flexibly plugged in and out and configured as needed. The power supply module of the whole machine can also be configured accordingly according to the overall power consumption of the whole machine.

[0132] The main control module is mainly composed of the system management module, system configuration module and user interface module. The system management module uses the standard IPMI interface to monitor the health of the chassis system and units, control the cooling fan and manage the power supply of the chassis through a dedicated system controller. The system configuration module implements functions such as system configuration and statistical test quantity.

[0133] The backplane module provides power and system management for each unit, and provides control, data, trigger and timing connections between units.

[0134] The clock module provides accurate clock and TOD and other clock information for each internal test module, realizing clock synchronization between multiple test modules and collaborative testing between test units. It can also realize multi-machine synchronous test application by introducing clock signals from the outside as the reference clock.

[0135] like Figure 5 As shown in the figure, the high-speed network test module is the most critical functional unit in the tester, which mainly realizes the sending and receiving, analysis, statistics, and verification of messages. At the same time, it completes the protocol layer functions, including protocol distribution and analysis. Through FPGA, it realizes functions such as data flow generation and transmission, data flow capture and storage, data flow statistics and analysis, and benchmark testing. The onboard CPU on the test module realizes functions such as protocol simulation analysis, protocol testing, and application business testing.

[0136] The present invention will be described in more detail below.

[0137] The present invention provides a comprehensive network flow test instrument, comprising the following:

[0138] Module M1: Ensure that the client host is connected to the control network port of the test system through a network cable. After starting the comprehensive network traffic test system, log in to the test web page through the browser of the client host. After logging in, you can perform related test tasks.

[0139] Module M2: Traffic test: Enter the traffic test page, add regular traffic, configure related parameters, and perform real-time statistics.

[0140] Specifically, module M2 includes the following modules:

[0141] Module M201: Add a data stream to the port, set the data stream frame length, source MAC address, source IP address, and keep other parameters as default settings.

[0142] Module M202: Set the sending mode to burst mode, set the number of bursts and the number of burst messages.

[0143] Module M203: Enable sending and capturing.

[0144] Module M204: Check that the captured data conforms to the data flow characteristics and quantity sent by the comprehensive network traffic test system.

[0145] Module M3: Benchmark test: Select RFC2544 performance test, configure test items, perform back-to-back test, latency test, packet loss rate test and throughput test in sequence, and view the results.

[0146] Specifically, module M3 includes the following modules:

[0147] Module M301: Configure test parameters; in the RFC2544 performance test item selection column on the RFC2544 performance test page, check the "Back-to-back test" option, and then select and add test ports in batches, adding at least two ports in batches.

[0148] Module M302: Select different ports as the source port and destination port in "Source port" and "Destination port", select the protocol layer and sending direction in the basic configuration, and then add a test interface with test direction information.

[0149] Module M303: Open the configuration information, and configure the learning frequency, learning level and time parameters in the RFC2544 performance test configuration page; enter the "Back-to-Back Test Configuration" setting window at the same time, set the number of tests and test duration; set the frame length change mode to custom mode, and set the custom frame length; set the packet rate parameter mode to custom mode, and set the custom rate. After the configuration is completed, save the configuration and close the configuration page, and start the test in the main test page.

[0150] Module M304: On the test page, select the "Delay Test" option; at the same time, enter the "Delay Test Configuration" setting window, set the number of tests and test duration; set the frame length change mode to custom mode, and set a custom frame length; set the packet rate parameter mode to custom mode, and set a custom rate.

[0151] Module M305: On the test page, select the "Packet Loss Rate Test" option; at the same time, enter the "Packet Loss Rate Test Configuration" setting window, set the number of tests and test duration; set the frame length change mode to custom mode, and set a custom frame length; set the packet rate parameter mode to custom mode, and set a custom rate.

[0152] Module M306: On the test page, select the "Throughput Test" option; enter the "Throughput Test Configuration" setting window at the same time, and configure the number of tests and test duration on the page for configuring basic test parameters; select binary method for load mode, and configure the initial rate, upper rate limit, lower rate limit, and accuracy; set the frame length change mode to custom mode and set a custom frame length.

[0153] Module M307: After the test is completed, the corresponding test results will be displayed.

[0154] Module M4: Security Test: Select real-time security attack, optionally configure distributed low-rate denial of service attack, configure test items, run, and view the operation status of the device under test.

[0155] Specifically, module M4 includes the following modules:

[0156] Module M401: Configure the switch ports and connect the devices according to Figure 5.

[0157] Module M402: Start the network detection and capture software on the device under test.

[0158] Module M403: Open the comprehensive network traffic test system page on the computer and reserve the corresponding test port.

[0159] Module M404: Enter the "Security Test" menu page and set basic parameters of data flow such as physical address, IP address, port, etc.

[0160] Module M405: Edit the attack list. You can select any attack type from the attack list. After completion, a custom real-time security attack flow will be generated. If you choose a distributed low-rate denial of service attack, you can simulate a large number of attack sources in parallel and then asynchronously initiate a network attack test.

[0161] Module M406: Start the test and view the test results through the network detection software.

[0162] The present invention proposes a method for testing an asynchronous distributed denial of service attack. The method comprises the following contents:

[0163] The test method of an asynchronous distributed denial of service attack can be described by a three-element parameter group (T, L, R). Among them: T is the attack period, that is, the time interval between two consecutive attack pulses, which is calculated by the execution of the TCP timeout retransmission timer estimated from the trusted source; L is the pulse width, which indicates the time period during which the attacker continues to send packets; R is the pulse amplitude, which shows the maximum rate of the attack flow.

[0164] like Figure 1 and Figure 2 The test method of the asynchronous distributed denial of service attack utilizes the two adaptive mechanisms of RTO and AIMD in the TCP congestion control algorithm to intentionally create network congestion so that the congestion control is always in an adjustment state. When the attack intensity (R×L) is large enough, it can cause enough message loss, thereby triggering the congestion control mechanism in the TCP protocol, causing continuous and frequent adaptive adjustments, thereby achieving the effect of the attack.

[0165] Asynchronous Distributed Low-rate Denial of Service Attack (ADLDoS) is a coordinated attack by multiple attack sources, so the attack intensity is greater and the attack characteristics are less obvious. Figure 1 As shown, the attack source sends attack pulses according to a period, that is, the attack period of each source end is nT, corresponding to the pulse amplitude R of the pulse intensity, and finally a complete attack with an attack period of T and a pulse amplitude of R is formed at the victim end. The synchronization accuracy requirement is relatively low, because the ADLDoS attack period is generally 1s to 5s, and the link round-trip delay RTT is generally less than 0.1s, and a slight delay error has little effect on the overall effect of the attack.

[0166] In order to implement the ADLDoS attack, the high-performance traffic generation and control of the comprehensive network traffic test system can achieve precise control of the sending frequency, achieve fine regulation at the nanosecond level, and improve the stability of the time period T, thereby maintaining the effectiveness of the continuous attack.

[0167] The present invention can achieve a high-intensity sending rate through a high-speed multi-port simulated sending source, greatly improving the pulse amplitude R and pulse width L that characterize the attack intensity, and through parallel simulation of tens of thousands of attack sources, it can achieve highly customized parameters such as source IP address, target IP address, source port, target port, protocol type, service type, etc., forming a continuous ADLDoS attack, and has a variety of evasion means to bypass the detection mechanism for security testing.

[0168] In order to conduct security testing, improve the level of network security and ensure network security, the present invention can simulate multiple sending frequencies, provide a large number of attack resources, implement coverage attacks on TCP protocol or UDP protocol and various network environments, and no longer need to determine the vulnerabilities of the target system in advance, thereby realizing rapid deployment of attack services. At the same time, it has flow testing, benchmark testing and security testing functions.

[0169] In more preferred examples, the traffic test function mainly includes sub-functions such as data flow generation and sending, data flow capture and storage, data flow statistics and analysis. The user adds a test data flow in the test application software and configures the data flow frame length, protocol, priority and other related parameters, configures the data flow capture or storage trigger conditions, and sends it to the business CPU. The business CPU receives and parses it, organizes the generation of detailed control instructions and sends them to the business FPGA. The business FPGA is responsible for traffic generation and sending, and receives the data flow according to the capture and storage trigger conditions, and performs real-time statistics. Finally, the statistical results are uploaded to the test application software for display, and the captured data flow is uploaded for parsing and storage according to the test application software data download request.

[0170] In a preferred application scenario, the benchmark test function mainly includes sub-functions such as RFC2544 performance test. The user configures the test parameters of sub-functions such as RFC2544 performance test in the test application software. After being sent to the business CPU, the business CPU receives and parses it, organizes and generates detailed control instructions and sends them to the business FPGA. The business FPGA is responsible for traffic generation and transmission, and real-time statistics at the same time. The business CPU combines the test parameter requirements and statistical values, processes and generates corresponding test results, and uploads them to the test application software for display and storage.

[0171] In another preferred application scenario, the security testing function mainly includes sub-functions such as denial of service attack test and real-time security attack test. The user configures the test parameters of sub-functions such as denial of service attack test and real-time security attack test in the test application software. The test application software then obtains the attack library script data according to the test parameters, generates test instructions and sends them to the business CPU, which then receives and parses them, organizes the generation of detailed control instructions and sends them to the business FPGA. The business FPGA is responsible for generating and sending security attack traffic, and performs real-time statistics at the same time. The business CPU combines the test parameter requirements and statistical values, processes and generates corresponding test results, and uploads them to the test application software for display and storage.

[0172] In summary, the comprehensive network traffic testing instrument and the asynchronous distributed denial of service attack testing method proposed in the present invention are a testing method for complex attack forms that combine asynchronous communication, distributed architecture and low-rate attack characteristics.

[0173] The present invention can be applied to various network environments, including the Internet and industrial networks. Compared with the traditional security testing of high-traffic DDoS attacks, it has some unique advantages, including the following:

[0174] 1. Asynchronous communication: The present invention utilizes the characteristics of asynchronous communication so that each attack node sends attack traffic at different times. By sending asynchronously, the attack traffic is staggered in time, thereby avoiding the formation of obvious traffic peaks, making the attack more difficult to detect for security testing.

[0175] 2. Low rate: The attack traffic of the present invention is kept at a low rate to simulate normal traffic. This attack may be achieved by sending incomplete requests or creating bottlenecks at the protocol level. Due to the low traffic, traditional DDoS defense mechanisms based on traffic statistics are not easy to identify these attacks for security testing.

[0176] 3. Objectives and strategies: The attack of the present invention targets application layer protocols (such as HTTP, DNS, etc.) and attempts to exhaust the processing power or resources of the server for security testing.

[0177] 4. Persistence and concealment: The present invention can be carried out for a long time without being detected. The covert attack mode causes the performance of the target system to degrade over a long period of time, while the root cause of the attack is not easily detected by the administrator for security testing.

[0178] 5. High defense difficulty: The attack traffic of the present invention is dispersed and simulates normal user behavior. Traditional DDoS defense strategies, such as traffic thresholds and IP blacklists, are difficult to defend effectively. More advanced behavioral analysis and machine learning technologies are needed to identify and defend against such attacks. Moreover, the present invention utilizes the complexity and distributed characteristics of modern networks, making it more threatening than traditional high-traffic DDoS attacks in some cases for security testing.

[0179] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0180] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A comprehensive network traffic testing instrument, characterized in that: include: Module M1: Let the client host log in to the test module; Module M2: instructs the test module to add data flow, configure parameters, and collect statistics of the data flow in real time; Module M3: instructing the test module to start the performance test module; Module M4: instructs the test module to start the safety test module.

2. The comprehensive network traffic testing instrument according to claim 1, characterized in that: The client host includes: a module A configured with a CPU, an FPGA, and a DDR, and a module B capable of distributed computing; The module B can work in coordination with the CPU, FPGA, and DDR in the module A and perform data processing through distributed computing; The module A can reasonably allocate corresponding functions according to the technical advantages, specifically: allocate the data stream to a high-speed digital logic circuit for implementation, the high-speed digital logic circuit can simulate and generate a rich test data stream, and the rate can reach the line speed, and can perform real-time statistical analysis; The module B includes: a data module and a management module; The system of the comprehensive network flow test instrument runs in the main control module in the management module, and further controls and manages the high-speed network test module in the management module through the backplane unit in the management module, thereby realizing the high-speed network test task of the data flow; The data module is capable of collecting, processing, storing and transmitting the data stream; The management module includes: a high-speed network test module and a chassis module; the high-speed network test module and the main control module in the management module are independently designed on the physical unit, and the two communication modes of Ethernet and IPMI are integrated in the system bus in the management module, and data transmission is performed through the CPCI interface; The high-speed network test module includes: an onboard CPU and an onboard FPGA; Specifically, the high-speed network test module is set as an independent module and configured as needed; the onboard FPGA can realize data flow generation and transmission, data flow capture and storage, data flow statistics and analysis, and benchmark testing functions; the onboard CPU can realize protocol simulation analysis, protocol testing, and application service testing functions; The chassis module includes: a main control module, a clock module, a backplane unit, a power module, a fan module, an LCD display control unit, an LED control unit, and a system bus; Specifically, the main control module includes: a system management module, a system configuration module, and a user interface module; The system management module: monitors the health of the subsystems and units of the chassis module, controls the cooling fans and manages the power supply through a dedicated system controller; The system configuration module: can realize the functions of system configuration and statistical test quantity; The user interface module: can realize layout, interaction, vision and response functions in real time; The clock module: can provide clock and TOD clock information for each internal test module, realize clock synchronization between multiple test modules and coordinated testing between test units, and can also realize multi-machine synchronous testing by introducing a clock signal from the outside as a reference clock; The backplane unit: can provide power and system management for each unit, and provide control, data, trigger and timing connections between units; The power module is configured accordingly according to the overall power consumption of the whole machine; The fan module can ensure that each unit can maintain stable performance under long-term high-load operation; The LCD display control unit can display various status information and operation prompts of the device in real time; The LED control unit: capable of managing and controlling the status information of each device; The system bus includes: a standard IPMI interface.

3. The comprehensive network traffic testing instrument according to claim 1, characterized in that: The module M2 includes the following: Module M201: instructs the port to add a data stream, and sets the frame length, source MAC address, and source IP address of the data stream; Module M202: Set the sending mode of the data stream to burst mode, and set the number of bursts and the number of burst messages; Module M203: Start sending and capturing the data stream; Module M204: monitors the data stream, and captures the characteristics and quantity of the data stream that are consistent with the transmission.

4. The comprehensive network traffic testing instrument according to claim 1, characterized in that: The module M3 includes the following: Module M301: configure test parameters to enable the performance test module to add test ports in batches, where the number of the test ports is at least two; Module M302: instruct the performance test module to select a source port and a destination port, wherein the source port and the destination port are different ports, and instruct the performance test module to select a protocol layer and a sending direction, and add a test interface with test direction information; Module M303: instructing the performance test module to configure the learning frequency, learning level and time parameters, and instructing the performance test module to start back-to-back testing; Module M304: instructing the performance test module to start the delay test; Module M305: instructing the performance test module to start the packet loss rate test; Module M306: instructing the performance test module to start a throughput test; Module M307: After the performance test is completed, the test module is made to display the corresponding performance test result; The module M4 includes the following: Module M401: configure the switch port and connect the security test module; Module M402: instructing the security test module to start network detection and capture; Module M403: instructing the security test module to open the test port; Module M404: configure the physical address, IP address, and basic parameters of the port data flow of the security test module; Module M405: configure the attack list of the security test module; Module M406: Start the test of the safety test module.

5. A method for testing asynchronous distributed denial of service attacks, characterized in that: The following steps are involved: Step S1: Let the client host log in to test; Step S2: Add data streams, configure parameters, and view statistics; Step S3: start performance test; Step S4: Start the safety test.

6. The method for testing asynchronous distributed denial of service attacks according to claim 5, characterized in that: The step S2 includes the following: Step S201: instructing the port to add a data stream, and setting the frame length, source MAC address, and source IP address of the data stream; Step S202: setting the transmission mode of the data stream to burst mode, and setting the number of burst times and the number of burst messages; Step S203: Start sending and capturing the data stream; Step S204: monitor the data stream, and capture the features and quantity of the data stream that meet the requirements for transmission.

7. The method for testing asynchronous distributed denial of service attacks according to claim 5, characterized in that: The step S3 includes the following: Step S301: configure test parameters and add test ports in batches, where the number of the test ports is at least two; Step S302: selecting a source port and a destination port, the source port and the destination port being different ports, selecting a protocol layer and a sending direction, and adding a test interface with test direction information; Step S303: configuring the learning frequency, learning level and time parameters of the performance test, and starting the back-to-back test; Step S304: Instruct the performance test to start a delay test; Step S305: instructing the performance test to start a packet loss rate test; Step S306: Instruct the performance test to start a throughput test; Step S307: After the performance test is completed, the corresponding performance test result is displayed.

8. The method for testing asynchronous distributed denial of service attacks according to claim 5, characterized in that: The step S4 includes the following: Step S401: configuring the switch port and connecting the security test device; Step S402: enabling the security test to start network detection and capture; Step S403: enabling the security test to open a test port; Step S404: configuring the basic parameters of the physical address, IP address, and port data flow of the security test; Step S405: configuring the attack list of the security test; Step S406: Start the security test.

9. A flow testing device, characterized in that: The integrated network traffic testing instrument described in any one of claims 1 to 4 can be used to test the generated asynchronous distributed denial of service attacks.

10. A test device for asynchronous distributed denial of service attacks, characterized in that: The comprehensive network traffic testing instrument described in any one of claims 1 to 4 can be used to conduct security tests on persistent asynchronous distributed denial of service attacks.

Images