DDoS attack source detection method and network server system

Abstract

The application discloses a DDoS attack source detection method, judges whether a communication network is subjected to a DDoS attack, extracts a source IP address and a TTL value if not, calculates a TTL confidence interval according to the source IP address, stores the source IP address and the TTL confidence interval into a global TTL mapping database, extracts an attack source IP address and a TTL value if yes, queries whether the attack source IP address exists in the global TTL mapping database, judges whether the TTL value corresponding to the attack source IP address exceeds an attack source TTL confidence interval if yes, adds 1 to an abnormal count of the attack source IP address if yes, intercepts the attack source IP address when the abnormal count of the attack source IP is greater than or equal to a preset threshold, clears the abnormal count if not, and performs C segment layered active scanning detection if not, extracts a scanning detection IP address and a corresponding TTL value if a detection response is returned, calculates a corresponding TTL confidence interval according to the scanning detection IP address, and stores the scanning detection IP address and the corresponding TTL confidence interval into the global TTL mapping database.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a DDoS attack source detection method and network server system. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks occur when multiple attackers in different locations simultaneously launch attacks against one or more targets, or when a single attacker controls multiple machines in different locations and uses them to attack the victim simultaneously. Because the attack originates from different places, it's called a distributed denial-of-service attack, and there can be multiple attackers involved. DDoS attacks can forge source IP addresses, making them highly stealthy and difficult to detect, thus making them extremely difficult to defend against.

[0003] Traditional DDoS defense primarily employs three methods: abnormal traffic scrubbing and filtering, distributed cluster defense, and high-defense intelligent DNS resolution. Scrubbing and filtering abnormal traffic through DDoS hardware firewalls, using techniques such as packet rule filtering, data flow fingerprinting, and customized packet content filtering, can accurately determine whether incoming traffic is legitimate and further block abnormal traffic. However, traditional DDoS defense relies on traffic thresholds, feature matching, or reputation-based blacklists, which suffer from high false positive rates and an inability to identify new types of attacks. Especially against reflection / amplification attacks with spoofed source IPs, existing methods struggle to accurately identify the attack source in the early stages of the attack. Summary of the Invention

[0004] Based on the above situation, the main objective of this invention is to provide a DDoS attack source detection method that combines passive traffic collection and analysis with active scanning and detection to construct a global IP-TTL mapping database covering all IPs on the network. When an attack occurs, the method can achieve high-precision attack source identification by comparing the deviation between the TTL in the IP data packet and the pre-stored TTL confidence interval.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A method for detecting DDoS attack sources, comprising the following steps:

[0007] S100 determines whether the communication network is under a DDoS attack.

[0008] S101, when the communication network is not under DDoS attack, extract the source IP address of the IP data packet and the TTL value corresponding to the source IP address, calculate the TTL confidence interval corresponding to the source IP address based on the source IP address, and store the source IP address and the TTL confidence interval corresponding to the source IP address in the global TTL mapping database;

[0009] S102, when the communication network is subjected to a DDoS attack, extract the attack source IP address and the TTL value corresponding to the attack source IP address, and query the global TTL mapping database to see if the attack source IP address exists.

[0010] S201, if the attack source IP address exists in the global TTL mapping database, then determine whether the TTL value corresponding to the attack source IP address exceeds the TTL confidence interval corresponding to the attack source IP address. If so, the abnormal count of the attack source IP address is incremented by 1. When the abnormal count of the attack source IP is greater than or equal to a preset threshold, the attack source IP address is marked and the attack source IP address is blocked. Otherwise, the abnormal count is cleared to zero.

[0011] S202, if the attack source IP address does not exist in the global TTL mapping database, then perform a C-segment layered active scanning and probing. If the scanning and probing IP address returns a probing response, then extract the scanning and probing IP address and the TTL value corresponding to the scanning and probing IP address, calculate the TTL confidence interval corresponding to the scanning and probing IP address based on the scanning and probing IP address, and store the scanning and probing IP address and the TTL confidence interval corresponding to the scanning and probing IP address in the global TTL mapping database. If the scanning and probing IP address does not return a probing response, then determine that the scanning and probing IP address is an invalid IP address.

[0012] Preferably, step S100, determining whether the communication network is under a DDoS attack, involves:

[0013] The real-time traffic of the communication network is collected. If the real-time traffic is within a preset traffic threshold, it is determined that the communication network is not under DDoS attack; otherwise, it is determined that the communication network is under DDoS attack.

[0014] Preferably, calculating the TTL confidence interval in steps S101 and S202 includes:

[0015] Calculate the average TTL of the IP address based on the n historical TTL values ​​corresponding to the IP address;

[0016] The TTL fluctuation value of the IP address is calculated based on the average TTL value of the IP address and n historical TTL values ​​corresponding to the IP address;

[0017] The TTL confidence interval is calculated based on the average TTL value and the TTL fluctuation value of the IP address;

[0018] The IP address includes the source IP address in step S101 or the scanning probe IP address in step S202.

[0019] Preferably, the following formula is used based on the IP address corresponding to... n Calculate the average TTL of the IP address using historical TTL values. m :

[0020] μ = Σt_i / n ,

[0021] Among them, the t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

[0022] Preferably, the following formula is used based on the average TTL of the IP address and the IP address corresponding to... n The TTL fluctuation value of the IP address is calculated based on historical TTL values. s :

[0023] σ= ,

[0024] Among them, the m The average TTL of the IP address, t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

[0025] Preferably, the TTL confidence interval is calculated using the following formula based on the average TTL value and the TTL fluctuation value of the IP address: [μ-Zσ, μ+Zσ]

[0026] Among them, the m The average TTL of the IP address, s The TTL fluctuation value of the IP address, the Z This represents the confidence level factor.

[0027] Preferably, the confidence level factor Z is dynamically adjusted based on the real-time traffic characteristics of the communication network.

[0028] Preferably, the confidence level factor is dynamically adjusted based on the real-time traffic characteristics of the communication network using the following formula. Z：

[0029] Z=α*(S current / S base ）

[0030] in, S current This represents the real-time peak traffic. S base α is the baseline flow rate, and α is the normalization coefficient.

[0031] Preferably, the global TTL mapping database includes a bit array and a key-value database, and steps S101 and S202 further include:

[0032] The IP address is filtered using Bloom and then stored in the bit array;

[0033] The IP address and the TTL confidence interval corresponding to the IP address calculated based on the IP address are stored in the key-value database;

[0034] The IP address includes the source IP address in step S101 or the scanning probe IP address in step S202.

[0035] Preferably, storing the IP address in the bit array after performing Bloom filtering includes:

[0036] The size of the bit array and the number of hash functions k are calculated based on the total number of IP addresses on the network and the preset tolerable false positive rate.

[0037] The extracted IP address is converted into binary format, and the extracted IP address includes the source IP address in step S101 or the scan probe IP address in step S202.

[0038] The k hash functions are used to calculate the position of the binary format IP address in the bit array, and the position is set to 1.

[0039] Preferably, step 102, which involves querying the global TTL mapping database to determine if the attack source IP address exists, includes:

[0040] The position of the attack source IP address in the bit array is calculated using the k hash functions, and the value at that position in the bit array is then queried.

[0041] If the value of the attack source IP address is 1 in all positions of the bit array, it is determined that the attack source IP address may exist in the global TTL mapping database, and then the key-value database is queried to determine whether the attack source IP address exists.

[0042] If the attack source IP address has a value of 0 at any position in the bit array, it is determined that the attack source IP address does not exist in the global TTL mapping database, and it is determined that the attack source IP address may be a forged IP address.

[0043] Preferably, the active scanning detection of segment C in step S202 includes:

[0044] Select a preset number of IP addresses in each C-class IP address range across the entire network;

[0045] Active scanning and probing are performed on the preset number of IP addresses in each of the C-segment IP address ranges.

[0046] Preferably, the preset quantity is calculated by multiplying the number of single C-segment IP addresses by a preset percentage.

[0047] Preferably, the preset quantity is calculated using the following formula:

[0048] Preset quantity = max(3, [number of single C segment IP addresses * preset percentage]).

[0049] Preferably, the active scanning and probing of the preset number of IP addresses in each C-segment IP address segment includes: sending Internet Signalling Control Protocol (ISCP) probe packets to the preset number of IP addresses to achieve active scanning and probing.

[0050] Preferably, step S101 further includes:

[0051] If the TTL value corresponding to the source IP address is different each time within a preset time, then the C-segment hierarchical active scanning and detection is performed on the source IP address.

[0052] If the source IP address returns a probe response, then the source IP address and the TTL value corresponding to the source IP address are extracted, the TTL confidence interval corresponding to the source IP address is calculated based on the source IP address, and the source IP address and the TTL confidence interval corresponding to the source IP address are stored in the global TTL mapping database.

[0053] If the source IP address does not return a probe response, then the source IP address is determined to be an invalid IP address.

[0054] The present invention also discloses a network server system, wherein the system employs the DDoS attack source detection method described in any one of the present invention to enable the network system to intercept the attack source IP address when it is subjected to a DDoS attack.

[0055] This invention proposes a DDoS attack source detection method that analyzes the correlation of IP packet TTL time and the stability of the global network topology. Combining passive traffic collection and analysis with active scanning and probing, it constructs a global IP-TTL mapping database covering all IP addresses in the network. When an attack occurs, it can achieve high-precision attack source identification by comparing the deviation of the TTL in the IP packet from the pre-stored TTL confidence interval. This solution overcomes the limitations of traditional defenses that rely on static rules, and is particularly suitable for the rapid identification of source IP spoofing scenarios.

[0056] Other beneficial effects of the present invention will be explained in detail through the introduction of specific technical features and technical solutions in specific embodiments. Those skilled in the art should be able to understand the beneficial technical effects brought about by these technical features and technical solutions through the introduction of these technical features and technical solutions. Attached Figure Description

[0057] The preferred embodiments of the DDoS attack source detection method and network server system according to the present invention will be described below with reference to the accompanying drawings. In the figures:

[0058] Figure 1 This is a flowchart of a DDoS attack source detection method according to a preferred embodiment of the present invention. Detailed Implementation

[0059] To provide a more detailed description of the technical solutions of this application and to facilitate a better understanding of this application, specific embodiments of this application are described below in conjunction with the accompanying drawings. However, it should be understood that all illustrative embodiments and their descriptions are used to explain this application and do not constitute the sole limitation of this application.

[0060] Figure 1 A flowchart of a DDoS attack source detection method according to a preferred embodiment of the present invention includes:

[0061] Step S100: Determine whether the communication network is under DDoS attack.

[0062] There are two main types of DDoS attacks: one is a traffic attack, which mainly targets network bandwidth, meaning that a large number of attack packets cause network bandwidth to be blocked, and legitimate network packets are overwhelmed by fake attack packets and cannot reach the host; the other is a resource exhaustion attack, which mainly targets server hosts, meaning that a large number of attack packets cause the host's memory to be exhausted or the CPU to be fully occupied by the kernel and applications, resulting in the inability to provide network services.

[0063] In a specific implementation, real-time traffic data from the communication network can be collected to determine whether the network is under a DDoS attack. Specifically, if the real-time traffic is within a preset traffic threshold, the network is considered not to be under a DDoS attack; otherwise, it is considered to be under attack. The traffic volume of a DDoS attack can range from hundreds of Gbps to several Tbps. In practice, historical traffic data (such as average and peak normal traffic) can be analyzed to set a preset traffic threshold that is 2-4 times the normal traffic. For example, if the daily peak traffic for a service is 50 Mbps, the preset traffic threshold can be set to 100-200 Mbps. When setting the preset traffic threshold for DDoS attack detection, it is necessary to consider service characteristics, historical traffic data, and protection capabilities to avoid missed detections due to an excessively high threshold or false alarms due to an excessively low threshold.

[0064] For example, real-time traffic acquisition of a communication network can be achieved by deploying traffic mirroring with a sampling rate set to 100% (full capture). Traffic mirroring allows for the replication of network traffic for analysis or monitoring. This is extremely useful in areas such as network security, performance monitoring, and fault diagnosis. Specific network devices or software are typically used to implement traffic mirroring. For instance, a router can be configured to mirror traffic. One interface of the router can be set as a monitoring interface, and traffic can be redirected to another interface to achieve real-time traffic acquisition.

[0065] S101, when the communication network is not under DDoS attack, extract the source IP address of the IP data packet and the TTL value corresponding to the source IP address, calculate the TTL confidence interval corresponding to the source IP address based on the source IP address, and store the source IP address and the TTL confidence interval corresponding to the source IP address in the global TTL mapping database.

[0066] In specific implementations, if the communication network is not under DDoS attack, then it is generally considered a normal IP service request. Extracting the source IP address and its corresponding TTL value from the IP packet is typically referred to as passive traffic collection and analysis. In IPv4, TTL (Time To Live) is an abbreviation for "Time to Live," referring to the maximum time an IP packet is allowed to exist in the network. TTL is a value in the IP protocol packet, set by the sending host, to prevent packets from endlessly looping on the IP network. The maximum TTL value is 255. Each time a packet passes through a router, the TTL value is decremented by 1. TTL typically represents the maximum number of routers a packet can pass through before being discarded. When the count reaches 0, the router decides to discard the packet and sends an ICMP (Internet Control Messages Protocol) message to the original sending host. The initial TTL value is usually the system default value, an 8-bit field in the packet header. In IPv6, TTL is called the "hop count limit."

[0067] S102, When the communication network is under DDoS attack, extract the attack source IP address and the TTL value corresponding to the attack source IP address, and query the global TTL mapping database to see if the attack source IP address exists.

[0068] S201, if the attack source IP address exists in the global TTL mapping database, then determine whether the TTL value corresponding to the attack source IP address exceeds the TTL confidence interval corresponding to the attack source IP address. If so, the anomaly count of the attack source IP address is incremented by 1. When the anomaly count of the attack source IP address is greater than or equal to a preset threshold, the attack source IP address is marked as a forged source IP address and intercepted. Otherwise, the anomaly count is cleared to zero. In a specific implementation, the preset threshold can be set according to user needs, for example, 3 or 4.

[0069] S202, if the attack source IP address does not exist in the global TTL mapping database, then perform a C-segment layered active scanning and probing. If the scanning and probing IP address returns a probe response, then extract the scanning and probing IP address and the TTL value corresponding to the scanning and probing IP address. Calculate the TTL confidence interval corresponding to the scanning and probing IP address based on the scanning and probing IP address, and store the scanning and probing IP address and the TTL confidence interval corresponding to the scanning and probing IP address in the global TTL mapping database. If the scanning and probing IP address does not return a probe response, then determine that the scanning and probing IP address is an invalid IP address.

[0070] This invention proposes a DDoS attack source detection method that analyzes the correlation of IP packet TTL time and the stability of the global network topology. Combining passive traffic collection and analysis with active scanning and probing, it constructs a global IP-TTL mapping database covering all IP addresses in the network. When an attack occurs, it can achieve high-precision attack source identification by comparing the deviation of the TTL in the IP packet from the pre-stored TTL confidence interval. This solution overcomes the limitations of traditional defenses that rely on static rules, and is particularly suitable for the rapid identification of source IP spoofing scenarios.

[0071] Step S101 includes calculating the TTL confidence interval corresponding to the source IP address based on the source IP address, and step S202 includes calculating the TTL confidence interval corresponding to the scan probe IP address based on the scan probe IP address. Both can be implemented by the following preferred methods to calculate the TTL confidence interval corresponding to the IP address based on the IP address:

[0072] According to the IP address n Calculate the average TTL of the IP address using historical TTL values. m Based on the average TTL of the IP address m The IP address corresponding to n The TTL fluctuation value of the IP address is calculated based on historical TTL values. s Based on the average TTL of the IP address m and the TTL fluctuation value of the IP address s Calculate the TTL confidence interval; wherein the IP address includes the source IP address in step S101 or the scan probe IP address in step S202. n Users can choose according to their needs, such as selecting 4 or 5. If no data is stored... n A historical TTL value, which can be crawled via web crawler during program execution. n One historical TTL value.

[0073] In a preferred embodiment, the following formula can be used based on the IP address corresponding to... n Calculate the average TTL of the IP address using historical TTL values. m :

[0074] μ = Σt_i / n ,

[0075] in, t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

[0076] In a preferred embodiment, the following formula can be used based on the average TTL of the IP address. m The IP address corresponding to n The TTL fluctuation value of the IP address is calculated based on historical TTL values. s :

[0077] σ= ，

[0078] Among them, the m The average TTL of the IP address, t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

[0079] In a preferred embodiment, the following formula can be used based on the average TTL of the IP address. m and the TTL fluctuation value of the IP address s Calculate the TTL confidence interval ( ValidRange) :

[0080] ValidRange = [μ-Zσ, μ+Zσ]

[0081] Among them, the m The average TTL of the IP address, s The TTL fluctuation value of the IP address, the Z This is the confidence level factor. It can be determined through... Z Adjust the size of the TTL confidence interval. Z The larger the value, the wider the TTL confidence interval, which helps avoid false positives. Z The smaller the value, the smaller the TTL confidence interval, and the stricter the judgment criteria. For example... Z When the TTL confidence interval is 2, it will contain approximately 95% of the normal data.

[0082] For example, if the four historical TTL values ​​of a source IP address or a scanning probe IP address are 64, 63, 65, and 64, first calculate the average TTL value using the algorithm described above. m The value is 64, indicating that the TTL of this IP address is typically 64. Next, calculate the difference between each TTL value and the average, square these differences (eliminating negative numbers), average them, and then take the square root to obtain the TTL fluctuation value of the IP address. s A TTL value of 0.82 indicates that the TTL value of this IP fluctuates very little, typically remaining stable within 64 ± 0.82. Finally, based on the average TTL value... m 64, TTL fluctuation value sThe confidence level factor is 0.82. Z Calculate the TTL confidence interval ValidRange The value is [62.36, 65.64] (assuming Z=2). This means that if the TTL value of this IP exceeds 62.36~65.64, it may be spoofed. For example, the TTL may suddenly become 128 during an attack.

[0083] In a preferred embodiment, the confidence level factor can be dynamically adjusted based on the real-time traffic characteristics of the communication network. Z The confidence level factor is dynamically adjusted based on real-time traffic, thereby dynamically adjusting the TTL confidence interval, enabling real-time detection of DDoS attack sources and improving detection accuracy.

[0084] Specifically, the confidence level factor can be dynamically adjusted based on the real-time traffic characteristics of the communication network using the following formula. Z：

[0085] Z=α*(S current / S base ）

[0086] in, S current This represents the real-time peak traffic. S base Let α be the baseline traffic, and α be the normalization coefficient. α can be obtained through training on historical attack data; for example, α ∈ [0.8, 1.2] represents the baseline traffic. S base This can be a sliding window average of traffic over the same period in the past 30 days. Understandably, this is relevant when traffic surges (when an attack occurs). Z Automatically increases the TTL confidence interval, reducing the likelihood of false positives for legitimate IPs, especially when traffic decreases (when no attack occurs). Z The TTL confidence interval is automatically reduced, and the judgment is strictly enforced. Abnormal IPs are quickly identified by using the TTL confidence interval.

[0087] In a preferred embodiment, the global TTL mapping database may include a bit array and a key-value database. Therefore, steps S101 and S202 may further include: storing the IP address in the bit array after performing a Bloom filter, and storing the IP address and the TTL confidence interval corresponding to the IP address calculated based on the IP address in the key-value database; wherein the IP address includes the source IP address in step S101 or the scan probe IP address in step S202.

[0088] A Bloom filter is a space-efficient data structure used to determine whether an element exists in a set. It maps elements to multiple positions in a bit array (bit vector) using a series of hash functions, and determines the likelihood of an element being in the original set based on the presence of these positions. Compared to common hash table storage (hashmap / list), it is probabilistic, allowing it to determine whether a target is definitely not present or likely to exist. Its advantages lie in its significantly improved space utilization and faster query time compared to general algorithms. Traditional hash tables store IP-TTL key-value pairs, requiring at least 4 bytes (IPv4) or 16 bytes (IPv6) per IP, resulting in extremely high memory consumption when dealing with millions or even tens of millions of IPs. A Bloom filter, using a bit array, requires only about 1.2 bytes per element, reducing memory usage by over 90%. Compared to data structures like hash tables, it can represent a large set with a smaller memory footprint. When performing DDoS attack detection, it's necessary to compare the TTL of IP packets within the confidence interval in real time. The query time complexity of a Bloom filter is O(k) (where k is the number of hash functions). The query process of a Bloom Filter requires performing k hash calculations sequentially, followed by checking if the corresponding k positions in the bit array are 1. Therefore, the query time is linearly related to the number of hash functions, k, meaning the time complexity is O(K). For example, if k=7, each query requires calling 7 hash functions. In contrast, traditional database queries (such as those using disk storage) typically involve disk I / O operations, with time complexities potentially reaching O(logN) (B+ tree index) or even O(N) (full table scan), resulting in a significant performance bottleneck. In contrast, all operations of a Bloom Filter are performed in memory, requiring only k hash calculations and k memory bit checks. Even with k=7, the total time is equivalent to only 7 memory accesses, with actual execution time in the hundreds of nanoseconds, far lower than traditional database disk queries.

[0089] In a preferred embodiment, storing the IP address in the bit array after Bloom filtering includes: calculating the size m of the bit array and the number of hash functions k based on the total number of IP addresses N and a preset tolerable false positive rate p; converting the extracted IP address into binary format, wherein the extracted IP address includes the source IP address in step S101 or the scan probe IP address in step S202; using the k hash functions to calculate the position of the binary format IP address in the bit array, and setting the position to 1.

[0090] In specific implementations, the total number of IP addresses N can be the global number of IP addresses or the domestic number of IP addresses. The global number of IPv4 addresses is approximately 4.3 billion, while the number of IPv4 addresses in my country is approximately 392.39 million. For example, the optimal bit array size can be calculated using the following algorithm based on the total number of IP addresses (N) and the tolerable false positive rate (p). m ) and the number of hash functions ( k ):

[0091] ,

[0092] For example, to store 10 million IPs (N=10^7), with p=1%, m≈114 million bits (approximately 13.6MB), and k=7. Double hashing (such as...) can be used. MurmurHash + Fowler-Noll-Vo It can generate k independent hash functions, reducing the probability of collisions.

[0093] For example, in step S101, after extracting the source IP address from the IP packet, the source IP address is converted to binary format (IPv4 to 32 bits, IPv6 to 128 bits), and its corresponding position (h1, h2, ..., hk) in the bit array is calculated using k hash functions. The positions (h1, h2, ..., hk) in the bit array are then set to 1. The calculation and storage method for the probe scan IP address in step 202 is similar and will not be described further here.

[0094] In a preferred embodiment, step 102, querying the global TTL mapping database to determine if the attack source IP address exists, may include: calculating the position of the attack source IP address in the bit array using the k hash functions, and querying the value of that position in the bit array; if the value of all positions of the attack source IP address in the bit array is 1, it is determined that the attack source IP address may exist in the global TTL mapping database, and then querying the key-value database to determine if the attack source IP address exists; if the value of any position of the attack source IP address in the bit array is 0, it is determined that the attack source IP address does not exist in the global TTL mapping database, and it is determined that the attack source IP address may be a spoofed IP address. Spoofed source IPs account for a very high proportion in DDoS attacks. Using a bit table can quickly filter out "unfamiliar IPs" that do not appear in historical mappings, reducing invalid queries and improving query efficiency.

[0095] In a specific implementation, when the bit array fill rate exceeds a threshold (e.g., 80%), the bit array can be dynamically expanded and the number of hash functions recalculated to maintain a low false positive rate. For low-frequency IPs (e.g., those not appearing for 72 hours), a counting Bloom filter can be enabled to periodically clean up expired data.

[0096] Assuming an attacker forges the source IP 198.18.1.100 to launch a DDoS attack, this method extracts the IP and calculates its position in a bit array. If the corresponding position in the bit array contains a 0, the IP address does not exist in the global TTL mapping database, eliminating the need to query the key-value database and saving over 90% of query time. If all corresponding positions in the bit array are 1s, it is determined that the IP may exist in the global TTL mapping database, and the key-value database is then queried. Table 1 compares the performance of using a Bloom Filter bit array with that of a traditional hash table.

[0097] Table 1

[0098] ,

[0099] In a preferred embodiment, the C-segment hierarchical active scanning and probing in step S202 may include: selecting a preset number of IP addresses in each C-segment IP address segment of the entire network; and actively scanning and probing the preset number of IP addresses in each C-segment IP address segment.

[0100] An IP address, short for Internet Protocol address, is a unique address used to identify every device on a network. It consists of 32 bits of binary data, typically divided into four segments of 8 bits each, represented in decimal and separated by dots, such as 192.168.1.1. The A, B, and C segments of an IP address refer to different parts of the IP address used to identify the network address and host address.

[0101] Class A IP addresses refer to IP addresses where the first segment is the network address, and the remaining three segments are the local computer's address. In binary representation, a Class A IP address consists of a 1-byte network address and a 3-byte host address, with the highest bit of the network address being "0". The network identifier in a Class A IP address is 8 bits long, and the host identifier is 24 bits long. Class A IP addresses range from 1.0.0.1 to 127.255.255.254 (binary representation: 0000000100000000 00000000 00000001 - 01111111 11111111 11111111 11111110), with the last segment being the broadcast address.

[0102] Class B IP addresses refer to IP addresses where the first two segments are the network address. In binary representation, a Class B IP address consists of a 2-byte network address and a 2-byte host address, with the highest bit of the network address being "10". The network identifier in a Class B IP address is 16 bits long. The address range for Class B IP addresses is 128.0.0.1-191.255.255.254 (binary representation: 10000000 00000000 00000000 00000001----1011111111111111 11111111 11111110), with the last segment being the broadcast address.

[0103] Class C IP addresses are those where the first three segments of the four-segment IP address represent the network address, and the remaining segment represents the local computer's address. In binary representation, a Class C IP address consists of a 3-byte network address and a 1-byte host address; the highest bit of the network address must be "110". The network identifier in a Class C IP address is 24 bits long, and the host identifier is 8 bits long. The range of Class C IP addresses is 192.0.0.1-223.255.255.254 (binary representation: 11000000 00000000 00000000 00000001 - 11011111 11111111 11111111 11111110).

[0104] Choosing segment A or B would result in insufficient scanning accuracy due to the large range, affecting the precision of the global TTL mapping database. Scanning each IP address individually would lead to an excessively large scanning workload, placing a significant burden on computation and storage. Therefore, this invention selects a predetermined number of IP addresses within each segment C of the entire network for active probing. For example, with approximately 4.3 billion IPv4 addresses globally, there are 4.3 / 25.5 billion segment C addresses worldwide. my country has approximately 392.39 million IPv4 addresses, meaning there are roughly 392.39 / 25.5 million segment C addresses domestically.

[0105] In a preferred embodiment, the preset number is calculated by multiplying the number of single C-class IP addresses by a preset percentage. For example, if the number of single C-class IP addresses is 255 and the preset percentage is 5%, then the preset number is 255 * 5%, which is equivalent to selecting approximately 12 IP addresses in each C-class for active scanning and probing.

[0106] In a preferred embodiment, the preset quantity can be calculated using the following formula:

[0107] Preset quantity = max(3, [number of single C-class IP addresses * preset percentage])

[0108] The formula above indicates that the preset number is the maximum value between the number of single C-class IP addresses multiplied by the preset percentage and 3. That is, if the number obtained by multiplying the number of single C-class IP addresses by the preset percentage is less than three, it should be selected as three; if the number obtained by multiplying the number of single C-class IP addresses by the preset percentage exceeds three, it should be reduced to three. This design improves scanning efficiency while ensuring coverage of single C-class IP addresses.

[0109] In specific implementations, users can choose to perform a global C-segment scan or only a domestic C-segment scan, depending on their needs. Furthermore, they can configure the scan to run at fixed intervals, for example, every 6 hours. This ensures the real-time nature of proactive scanning and probing, thereby guaranteeing that the global TTL mapping database is updated promptly and ensuring the accuracy of DDoS attack source detection.

[0110] In a preferred embodiment, actively scanning and probing the preset number of IP addresses in each C-segment IP address range includes: sending ICMP (Internet Protocol version 8) signals to the preset number of IP addresses.

[0111] Control Messages Protocol (CRM) probe packets to enable proactive scanning and probing.

[0112] ICMP (Internet Control Message Protocol) is the "sentinel system" of the IP protocol suite, used for network status monitoring and anomaly feedback. One of its main functions is network diagnostics: quickly locating connectivity problems through active probing (such as ping). ICMP messages adopt a very simple design, directly embedded in IP data packets for transmission, as shown in Table 2 (ICMP message format):

[0113] Table 2

[0114]

[0115] The ICMP active probing mechanism works as follows: the source sends a Type=8 (Echo Request) packet, and the target responds with a Type=0 (Echo Reply) packet, calculating the RTT (Round-Trip Time) using timestamps. Therefore, by sending ICMP probe packets, if the target IP address is not spoofed, it will send a response packet (IP data packet). The number of routers the message passed through, i.e., the TTL value, can be determined from the data field of the response packet. In this invention, the server performing the active scanning and probing sends ICMP probe packets to a selected preset number of IP addresses. If the IP address is not spoofed, it will return a Type=0 response packet; otherwise, it will not return a response packet. In other embodiments, TCP probe packets can also be used for active scanning and probing.

[0116] In a preferred embodiment, step S101 may further include: if the TTL value corresponding to the source IP address is different each time within a preset time, it is determined that the source IP address may be a spoofed IP, and the C-segment layered active scanning and probing is performed on the source IP address; if the source IP address returns a probing response, the source IP address and the TTL value corresponding to the source IP address are extracted, the TTL confidence interval corresponding to the source IP address is calculated based on the source IP address, and the source IP address and the TTL confidence interval corresponding to the source IP address are stored in the global TTL mapping database; if the source IP address does not return a probing response, it is determined that the source IP address is an invalid IP address.

[0117] When the network is not under DDoS attack, if the method detects that the TTL value of a certain source IP address is different every time within a preset time period, such as 72 hours, it indicates that the source IP address may be spoofed. In this case, a C-segment layered active scan is performed on the source IP address. This is equivalent to actively scanning and probing abnormal source IP addresses during the passive scan process, thereby supplementing the global TTL mapping database with the source IP address and its corresponding TTL confidence interval. This makes the global TTL mapping database in this invention more complete and further enhances the performance of the DDoS attack source detection method.

[0118] Specifically, based on the embodiments disclosed above in this application, reference is made to... Figure 1 The processes described in the flowcharts of the embodiments can be implemented as computer programs. For example, embodiments of this application also provide a computer program product including a computer program carried on a computer-readable medium, the computer program comprising methods for executing... Figure 1The flowchart of the embodiment describes the program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network via a communication interface, or installed from memory. When the computer program is executed by a processor, it performs the functions defined in the method of the above embodiment.

[0119] It should be noted that the aforementioned computer-readable media may include, but is not limited to: volatile memory, such as random access memory (RAM); non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); and combinations of the above types of memory.

[0120] In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0121] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0122] The present invention also discloses a network server system, wherein the system employs the DDoS attack source detection method described in any one of the present invention to enable the network system to intercept the attack source IP address when it is subjected to a DDoS attack.

[0123] It should be noted that the use of step numbers (letter or number) to refer to certain specific method steps in this invention is merely for the purpose of convenience and brevity in description, and is by no means intended to restrict the order of these method steps. Those skilled in the art will understand that the order of the relevant method steps should be determined by the technology itself and should not be unduly restricted by the existence of step numbers.

[0124] Those skilled in the art will understand that, without conflict, the above-mentioned preferred solutions can be freely combined and superimposed.

[0125] It should be understood that the above embodiments are merely exemplary and not restrictive. Various obvious or equivalent modifications or substitutions that can be made by those skilled in the art regarding the above details without departing from the basic principles of the present invention will be included within the scope of the claims of the present invention.

Claims

1. A method for detecting a DDoS attack source, characterized by, Including the following steps: S100 determines whether the communication network is under a DDoS attack. S101, when the communication network is not under DDoS attack, extract the source IP address of the IP data packet and the TTL value corresponding to the source IP address, calculate the TTL confidence interval corresponding to the source IP address based on the source IP address, and store the source IP address and the TTL confidence interval corresponding to the source IP address in the global TTL mapping database; S102, when the communication network is subjected to a DDoS attack, extract the attack source IP address and the TTL value corresponding to the attack source IP address, and query the global TTL mapping database to see if the attack source IP address exists. S201, if the attack source IP address exists in the global TTL mapping database, then determine whether the TTL value corresponding to the attack source IP address exceeds the TTL confidence interval corresponding to the attack source IP address. If so, the abnormal count of the attack source IP address is incremented by 1. When the abnormal count of the attack source IP is greater than or equal to a preset threshold, the attack source IP address is marked and the attack source IP address is blocked. Otherwise, the abnormal count is cleared to zero. S202, if the attack source IP address does not exist in the global TTL mapping database, then perform a C-segment layered active scanning and probing. If the scanning and probing IP address returns a probing response, then extract the scanning and probing IP address and the TTL value corresponding to the scanning and probing IP address. Calculate the TTL confidence interval corresponding to the scanning and probing IP address based on the scanning and probing IP address, and store the scanning and probing IP address and the TTL confidence interval corresponding to the scanning and probing IP address in the global TTL mapping database. If the scanning and probing IP address does not return a probing response, then determine that the scanning and probing IP address is an invalid IP address. The calculation of the TTL confidence interval in steps S101 and S202 includes: According to the IP address n The average TTL of the IP address is calculated from historical TTL values; Based on the average TTL of the IP address and the IP address corresponding to n The TTL fluctuation value of the IP address is calculated based on historical TTL values; The TTL confidence interval is calculated based on the average TTL value and the TTL fluctuation value of the IP address. [μ-Zσ, μ+Zσ] The μ The average TTL of the IP address, σ The TTL fluctuation value of the IP address, the Z The confidence level factor Z is dynamically adjusted based on the real-time traffic characteristics of the communication network. The global TTL mapping database includes a bit array and a key-value database, and steps S101 and S202 include: The size of the bit array and the number of hash functions k are calculated based on the total number of IP addresses on the network and the preset tolerable false positive rate. The extracted IP address is converted into binary format, and the extracted IP address includes the source IP address in step S101 or the scan probe IP address in step S202. The k hash functions are used to calculate the position of the binary format IP address in the bit array, and the position is set to 1; The IP address and the TTL confidence interval corresponding to the IP address calculated based on the IP address are stored in the key-value database; Step 102, which involves querying the global TTL mapping database to determine if the attack source IP address exists, includes: The position of the attack source IP address in the bit array is calculated using the k hash functions, and the value at that position in the bit array is then queried. If the value of the attack source IP address is 1 in all positions of the bit array, it is determined that the attack source IP address may exist in the global TTL mapping database, and then the key-value database is queried to determine whether the attack source IP address exists. If the attack source IP address has a value of 0 at any position in the bit array, it is determined that the attack source IP address does not exist in the global TTL mapping database, and it is determined that the attack source IP address may be a forged IP address.

2. The method of claim 1, wherein, The step S100, determining whether the communication network is under a DDoS attack, is as follows: The real-time traffic of the communication network is collected. If the real-time traffic is within a preset traffic threshold, it is determined that the communication network is not under DDoS attack; otherwise, it is determined that the communication network is under DDoS attack.

3. The DDoS attack source detection method according to claim 1, characterized in that, The following formula is used based on the IP address corresponding to n Calculate the average TTL of the IP address using historical TTL values. μ : μ = Σt_i / n ， Among them, the t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

4. The DDoS attack source detection method according to claim 1, characterized in that, The following formula is used based on the average TTL of the IP address and the corresponding IP address. n The TTL fluctuation value of the IP address is calculated based on historical TTL values. σ : σ= ， Among them, the μ The average TTL of the IP address, t_i For the IP address corresponding to the first i A historical TTL value, i For 1... n .

5. The DDoS attack source detection method according to claim 1, characterized in that, The confidence level factor is dynamically adjusted according to real-time traffic characteristics of the communication network using the following formula Z： Z = α * (S current / S base ） wherein, S current is the real-time flow peak, S base is the baseline flow, and a is a normalization factor.

6. The method of claim 1, wherein, The active scanning detection of segment C in step S202 includes: Select a preset number of IP addresses in each C-class IP address range across the entire network; Active scanning and probing are performed on the preset number of IP addresses in each of the C-segment IP address ranges.

7. The method of claim 6, wherein the method further comprises: The preset quantity is calculated by multiplying the number of single C-class IP addresses by a preset percentage.

8. The method of claim 6, wherein the method further comprises: The preset quantity is calculated using the following formula: Preset quantity = max(3, [number of single C segment IP addresses * preset percentage]).

9. The method of claim 6, wherein the method further comprises: The active scanning and detection of the preset number of IP addresses in each C-segment IP address segment includes: Internet Signalling Control Protocol (ISP) probe packets are sent to the preset number of IP addresses to achieve active scanning and probing.

10. The method of claim 1-9, wherein, Step S101 further includes: If the TTL value corresponding to the source IP address is different each time within a preset time, then the C-segment hierarchical active scanning and detection is performed on the source IP address. If the source IP address returns a probe response, then the source IP address and the TTL value corresponding to the source IP address are extracted, the TTL confidence interval corresponding to the source IP address is calculated based on the source IP address, and the source IP address and the TTL confidence interval corresponding to the source IP address are stored in the global TTL mapping database. If the source IP address does not return a probe response, then the source IP address is determined to be an invalid IP address.

11. A network server system, characterized by The system employs the DDoS attack source detection method as described in any one of claims 1-10, so as to intercept the attack source IP address when the system is subjected to a DDoS attack.

Images