DDoS attack detection and protection method for private network core network

Abstract

The invention discloses a DDoS (Distributed Denial of Service) attack detection and protection method for a private network core network, and relates to the technical field of communication, and the method comprises the following specific steps: based on a target edge server deployed on a data communication link between a target base station and a distributed target private core network, obtaining network flow data in real time by using a UPF module on the target edge server; and further according to the obtained network flow data, whether a DDoS attack occurs in the target private network core network is judged by applying an attack detection method built in the target edge server, if yes, the attack type is further determined, and an attack protection method is triggered for protection. According to the invention, dependence on an operator network can be avoided, and higher real-time performance and lower cost are realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method for detecting and protecting a DDoS attack on a private core network. Background Art

[0002] The private core network is an independent network control center for vertical industries. Its lightweight architecture adapts to industry characteristics to meet the requirements of high reliability, low latency, and secure control. A DDoS attack, or distributed denial of service attack, is a common network security attack. It controls a large number of network devices to send a massive number of access requests to the target, which are not for normal business needs. This depletes the resources of the target system or website, preventing users from using the system or accessing the website normally, thereby disrupting the normal operation of the website or online service. Currently used protection measures include end-cloud collaborative scrubbing architecture, elastic bandwidth expansion, and resource isolation. However, their drawbacks are their reliance on operator network resources. The closed nature of private networks can lead to delays in threat intelligence synchronization, affecting real-time response efficiency. Furthermore, expansion costs are high, making it difficult for small and medium-sized private networks to sustain high bandwidth costs. Summary of the Invention

[0003] In order to solve the above technical problems, the present invention provides a method for detecting and protecting DDoS attacks in a private core network.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] A method for detecting and protecting a private core network from DDoS attacks performs attack detection and protection on a target private core network in real time according to the following steps:

[0006] Step S1, based on a target edge server deployed on a data communication link between a target base station and a distributed target dedicated core network, using a UPF module separately deployed on the target edge server, obtain network traffic data in real time;

[0007] In step S2, based on the acquired network traffic data, the built-in attack detection method of the target edge server is applied to determine whether a DDoS attack occurs in the target private network core network. If so, the attack type is further determined and protection is performed using attack protection methods. Otherwise, the process returns to step S1.

[0008] Furthermore, step S2 executes at least one of a traffic detection algorithm and a SYN Flood abnormal handshake detection algorithm to implement attack detection.

[0009] Furthermore, the flow detection algorithm in step S2 includes the following steps:

[0010] Step S21, for the acquired network traffic data, calculate the traffic entropy value within the preset time period, the traffic size within the preset time period from the current moment, and the traffic size within the preset time period from the previous moment, and obtain the traffic mutation rate within the unit window using the following formula:

[0011] ΔR t =(R(t)-R(t-1)) / R(t-1)

[0012] Where R(t) is the flow rate within the preset period from the current moment t; R(t-1) is the flow rate within the preset period from the previous moment t-1; ΔR t is the traffic mutation rate within the unit window;

[0013] Step S22: Define a primary warning flag. Based on the flow entropy value within a preset time period and the flow mutation rate within a unit window, determine whether the decrease in the flow entropy value is greater than a preset decrease value and whether the flow mutation rate is greater than a preset mutation rate. If so, the primary warning flag for the preset time period from the current moment is assigned a value of 1; otherwise, the primary warning flag for the preset time period from the current moment is assigned a value of 0.

[0014] Step S23: Based on the traffic entropy value within the preset time period and the primary warning mark within the preset time period from the current moment, the following formula is used to obtain the current moment's traffic comprehensive score:

[0015] S=0.7×P+0.3×i t

[0016] Among them, S is the comprehensive traffic score, P is the traffic entropy value of the preset period, i t It is a primary warning sign;

[0017] Step S24: Based on the current traffic comprehensive score, determine whether the traffic comprehensive score is greater than the preset comprehensive score. If so, a DDoS attack occurs in the target private network core network, and the attack type is an ultra-large traffic attack; otherwise, return to step S21.

[0018] Furthermore, the SYN Flood abnormal handshake detection algorithm is specifically as follows: obtaining the number of SYN_RCVD state connections that have not completed the three-way handshake within the target time length; if the number of SYN_RCVD state connections is greater than the preset baseline value, a DDoS attack occurs in the target private network core network, and the attack type is a SYN Flood abnormal handshake; otherwise, no DDoS attack occurs.

[0019] Furthermore, a protection method that matches ultra-large traffic attacks is a large traffic protection algorithm, and the large traffic protection algorithm includes the following steps:

[0020] Step T1: The UPF module on the target edge server interacts with the SMF module of the target private network core network, and sends a message containing the DDoS attack type to the SMF module;

[0021] Step T2: After receiving and parsing the message, the SMF module dynamically adjusts the QoS policy of the target private network core network and feeds the adjusted QoS policy back to the UPF module.

[0022] In step T3, the UPF module uses the adjusted QoS policy for protection.

[0023] Furthermore, a protection method matching the SYN Flood abnormal handshake is a SYN Flood abnormal handshake protection algorithm, and the SYN Flood abnormal handshake protection algorithm includes the following steps:

[0024] Step P1: Use the UPF module to identify the IP address corresponding to the SYN Flood abnormal handshake attack in real time, and add the identified IP address to the dynamic blacklist, thereby blocking the operation application of the IP address;

[0025] In step P2, based on a preset time interval, the IP addresses in the dynamic blacklist are moved to the whitelist for re-detection, and each IP address is judged to see whether it still has an abnormal SYN Flood handshake. If so, the IP address is re-added to the dynamic blacklist; otherwise, the IP address is re-connected to the network service.

[0026] The beneficial effects brought about by adopting the above technical solution are:

[0027] (1) The deployment environment of the present invention is a distributed target-specific core network within the same intranet local area network, which solves the problem of relying on operator network resources in the existing technology, resulting in delays in threat intelligence synchronization and affecting real-time response efficiency;

[0028] (2) The present invention utilizes a UPF module that is separately deployed on the target edge server, thereby solving the problem of high capacity expansion cost in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a diagram of the architecture of the present invention;

[0030] Figure 2 This is a flow chart of the attack detection method of the present invention;

[0031] Figure 3 It is a flow chart of the protection method of the present invention. DETAILED DESCRIPTION

[0032] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0033] refer to Figure 1 A method for detecting and protecting a private core network from DDoS attacks performs attack detection and protection on a target private core network in real time according to the following steps:

[0034] Step S1, based on a target edge server deployed on a data communication link between a target base station and a distributed target dedicated core network, using a UPF module separately deployed on the target edge server, obtain network traffic data in real time;

[0035] In step S2, based on the acquired network traffic data, the built-in attack detection method of the target edge server is applied to determine whether a DDoS attack occurs in the target private network core network. If so, the attack type is further determined and protection is performed using attack protection methods. Otherwise, the process returns to step S1.

[0036] Furthermore, step S2 executes at least one of a traffic detection algorithm and a SYN Flood abnormal handshake detection algorithm to implement attack detection, and when the two detection algorithms are executed simultaneously, any one of the detection algorithms determines that a DDoS attack occurs, triggering the attack protection method.

[0037] Further, refer to Figure 2 , the flow detection algorithm in step S2 includes the following steps:

[0038] Step S21, for the acquired network traffic data, calculate the traffic entropy value within the preset time period, the traffic size within the preset time period from the current moment, and the traffic size within the preset time period from the previous moment, and obtain the traffic mutation rate within the unit window using the following formula:

[0039] ΔR t =(R(t)-R(t-1)) / R(t-1)

[0040] Where R(t) is the flow rate within the preset period from the current moment t; R(t-1) is the flow rate within the preset period from the previous moment t-1; ΔR t is the traffic mutation rate within the unit window;

[0041] Step S22: Define a primary warning flag. Based on the flow entropy value within a preset time period and the flow mutation rate within a unit window, determine whether the decrease in the flow entropy value is greater than a preset decrease value and whether the flow mutation rate is greater than a preset mutation rate. If so, the primary warning flag for the preset time period from the current moment is assigned a value of 1; otherwise, the primary warning flag for the preset time period from the current moment is assigned a value of 0.

[0042] Step S23: Based on the traffic entropy value within the preset time period and the primary warning mark within the preset time period from the current moment, the following formula is used to obtain the current moment's traffic comprehensive score:

[0043] S=0.7×P+0.3×i t

[0044] Among them, S is the comprehensive traffic score, P is the traffic entropy value of the preset period, i t It is a primary warning sign;

[0045] Step S24: Based on the comprehensive traffic score at the current moment, determine whether the comprehensive traffic score is greater than the preset comprehensive score. If so, a DDoS attack occurs in the target private network core network, and the attack type is an ultra-large traffic attack. The attack type is fed back to the protection method through feedback optimization, and the local feature library is used to record the relevant information of the DDoS attack; otherwise, return to execute step S21.

[0046] Furthermore, the SYN Flood abnormal handshake detection algorithm is specifically as follows: obtaining the number of SYN_RCVD state connections that have not completed the three-way handshake within the target time length; if the number of SYN_RCVD state connections is greater than the preset baseline value, a DDoS attack occurs in the target private network core network, and the attack type is a SYN Flood abnormal handshake; otherwise, no DDoS attack occurs.

[0047] Further, refer to Figure 3 The protection method that matches the ultra-large flow attack is a large flow protection algorithm, and the large flow protection algorithm includes the following steps:

[0048] Step T1: Use the N4 interface to interact with the UPF module on the target edge server and the SMF module of the target private network core network, and send a message containing the DDoS attack type to the SMF module;

[0049] Step T2: After receiving and parsing the message, the SMF module dynamically adjusts the QoS policy of the target private network core network and feeds the adjusted QoS policy back to the UPF module.

[0050] In step T3, the UPF module uses the adjusted QoS policy for protection.

[0051] Specifically, based on a preset number of UPF modules, the present invention is deployed in a video surveillance private network, and the UPF modules are deployed on different servers respectively. When all UPF modules work together, after any UPF detects an ultra-large traffic attack, it will first trigger the local traffic speed limit, that is, the flow rate ≤ 500pps / terminal; further report to the SMF through the N4 interface to update the QoS policy of the contracted user; finally, use the N9 interface communication in the core network to synchronize the attack characteristics to the adjacent UPF to form a collaborative protection.

[0052] Further, refer to Figure 3The protection method that matches the SYN Flood abnormal handshake is the SYN Flood abnormal handshake protection algorithm, and the SYN Flood abnormal handshake protection algorithm includes the following steps:

[0053] Step P1: Use the UPF module to identify the IP address corresponding to the SYN Flood abnormal handshake attack in real time, and add the identified IP address to the dynamic blacklist, thereby blocking the operation application of the IP address;

[0054] In step P2, based on a preset time interval, the IP addresses in the dynamic blacklist are moved to the whitelist for re-detection, and each IP address is judged to see whether it still has an abnormal SYN Flood handshake. If so, the IP address is re-added to the dynamic blacklist; otherwise, the IP address is re-connected to the network service.

[0055] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any simple modification, change and equivalent structural change made to the above embodiment based on the technical essence of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for detecting and protecting a private core network DDoS attack, characterized in that: Perform attack detection and protection on the target private network core network in real time according to the following steps: Step S1, based on a target edge server deployed on a data communication link between a target base station and a distributed target dedicated core network, using a UPF module on the target edge server to obtain network traffic data in real time; In step S2, based on the acquired network traffic data, the built-in attack detection method of the target edge server is applied to determine whether a DDoS attack occurs in the target private network core network. If so, the attack type is further determined and protection is performed using attack protection methods. Otherwise, the process returns to step S1.

2. The method for detecting and protecting a private core network DDoS attack according to claim 1, wherein: Step S2 executes at least one of a traffic detection algorithm and a SYN Flood abnormal handshake detection algorithm to implement attack detection.

3. The method for detecting and protecting a private core network DDoS attack according to claim 2, wherein: The flow detection algorithm in step S2 includes the following steps: Step S21, for the acquired network traffic data, calculate the traffic entropy value within the preset time period, the traffic size within the preset time period from the current moment, and the traffic size within the preset time period from the previous moment, and obtain the traffic mutation rate within the unit window using the following formula: ΔR t =(R(t)-R(t-1)) / R(t-1) Where R(t) is the flow rate within the preset period from the current moment t; R(t-1) is the flow rate within the preset period from the previous moment t-1; ΔR t is the traffic mutation rate within the unit window; Step S22: Define a primary warning flag. Based on the flow entropy value within a preset time period and the flow mutation rate within a unit window, determine whether the decrease in the flow entropy value is greater than a preset decrease value and whether the flow mutation rate is greater than a preset mutation rate. If so, the primary warning flag for the preset time period from the current moment is assigned a value of 1; otherwise, the primary warning flag for the preset time period from the current moment is assigned a value of 0. Step S23: Based on the traffic entropy value within the preset time period and the primary warning flag within the preset time period from the current moment, the following formula is used to obtain the current moment's traffic comprehensive score: S=0.7×P+0.3×i t Among them, S is the comprehensive traffic score, P is the traffic entropy value of the preset period, i t It is a primary warning sign; Step S24: Based on the current traffic comprehensive score, determine whether the traffic comprehensive score is greater than the preset comprehensive score. If so, a DDoS attack occurs in the target private network core network, and the attack type is an ultra-large traffic attack; otherwise, return to step S21.

4. The method for detecting and protecting a DDoS attack on a private core network according to claim 2, wherein: The SYNFlood abnormal handshake detection algorithm is specifically as follows: obtaining the number of SYN_RCVD state connections that have not completed the three-way handshake within the target time length; if the number of SYN_RCVD state connections is greater than the preset baseline value, a DDoS attack occurs in the target private network core network, and the attack type is a SYN Flood abnormal handshake; otherwise, no DDoS attack occurs.

5. The method for detecting and protecting a private network core network DDoS attack according to claim 2 or claim 3, wherein: The protection method that matches the ultra-large traffic attack is a large traffic protection algorithm, and the large traffic protection algorithm includes the following steps: Step T1: The UPF module on the target edge server interacts with the SMF module of the target private network core network, and sends a message containing the DDoS attack type to the SMF module; Step T2: After receiving and parsing the message, the SMF module dynamically adjusts the QoS policy of the target private network core network and feeds the adjusted QoS policy back to the UPF module. In step T3, the UPF module uses the adjusted QoS policy for protection.

6. The method for detecting and protecting a private core network DDoS attack according to claim 2 or claim 4, wherein: The protection method that matches the SYN Flood abnormal handshake is the SYN Flood abnormal handshake protection algorithm, and the SYN Flood abnormal handshake protection algorithm includes the following steps: Step P1: Use the UPF module to identify the IP address corresponding to the SYN Flood abnormal handshake attack in real time, and add the identified IP address to the dynamic blacklist, thereby blocking the operation application of the IP address; In step P2, based on a preset time interval, the IP addresses in the dynamic blacklist are moved to the whitelist for re-detection, and each IP address is judged to see whether it still has an abnormal SYN Flood handshake. If so, the IP address is re-added to the dynamic blacklist; otherwise, the IP address is re-connected to the network service.

Images