Multi-dimensional cooperative defense system and method facing DrDoS attack

Abstract

The invention relates to a DrDoS attack-oriented multi-dimensional cooperative defense system and method, and belongs to the technical field of network security, and the system comprises an initialization module which is used for a server to predefine a client identifier and set a maximum continuous request number; the authentication module is used for the server to authenticate the request of the client based on a weak authentication and verification code mechanism; the request control module is used for controlling the number of continuous requests of the client; the collaborative intervention module is used for starting ISP collaborative intervention and recovering network performance when the DrDoS attack is suffered; and the response limiting module is used for performing response control on the server. According to the invention, a cooperative defense system can be constructed from four aspects of an attack source end, a server end, a victim end and a network operator.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a multi-dimensional collaborative defense system and method for DrDoS attacks. Background Technology

[0002] With the widespread deployment of IoT devices, their inherent security vulnerabilities (such as outdated firmware and lack of authentication mechanisms) have led to an increasing prevalence of DrDoS attacks based on the UDP protocol. Attackers forge the victim's IP address and send requests to open UDP services (such as NTP, DNS, SSDP, etc.), leveraging the amplification effect to reflect large amounts of traffic back to the target, causing service outages.

[0003] Existing defense methods mainly fall into two categories: 1. Intrusion detection methods: such as packet filtering, fuzzy logic, entropy change detection, etc., but they often only respond after an attack has occurred, resulting in problems such as large delays, high false positive rates, and high resource consumption.

[0004] 2. Protocol hardening methods: such as weak authentication (e.g., cookies) and increasing the cost of attacks (e.g., client puzzles, falling-together). However, these methods have the following problems: (1) Cookie mechanism is vulnerable to replay attacks and has high communication overhead; (2) Client Puzzle has high computational cost and is easily exploited by attackers to consume resources; (3) Falling-together is only applicable to single-point attacks and cannot cope with distributed attacks.

[0005] Therefore, existing technologies are insufficient to achieve effective, real-time, and multi-dimensional defense against UDP DrDoS attacks while ensuring system performance. Summary of the Invention

[0006] This invention aims to address the problems of slow response, high resource consumption, and limited protection dimensions in existing UDP DrDoS attack defense schemes in IoT environments. Specifically, this invention proposes a multi-dimensional collaborative defense scheme (UDAM) that integrates weak authentication mechanisms and attack cost enhancement strategies. It constructs a collaborative defense system from four levels: the attack source, the server, the victim, and the network operator (ISP), achieving the following objectives: (1) Block forged requests through weak authentication mechanisms before an attack occurs; (2) Limit the scale of the attack by increasing the cost of the attack during the attack; (3) Achieve rapid recovery through ISP collaboration after an attack occurs; (4) While ensuring system throughput, response time and CPU utilization, achieve efficient, real-time and lightweight defense against UDP DrDoS attacks.

[0007] To achieve the above objectives, the present invention provides the following solution: A multi-dimensional collaborative defense system against DrDoS attacks includes: The initialization module is used by the server to predefine client identifiers and set the maximum number of consecutive requests; The authentication module is used by the server to authenticate client requests based on weak authentication and CAPTCHA mechanisms. The request control module is used to control the number of consecutive requests made by the client. The collaborative intervention module is used to enable network operators (ISPs) to coordinate intervention and restore network performance when subjected to DrDoS attacks. The response restriction module is used to control the server's response.

[0008] Optionally, the weak authentication and CAPTCHA mechanism in the authentication module includes: When the client and server establish a connection for the first time, the server generates a session identifier containing a random number and calculates a hash value as a verification code. In subsequent requests, the server verifies the authenticity of the request source by comparing the validity of the verification code attached by the client.

[0009] Optionally, in the request control module: When the number of requests from a client exceeds the set maximum number of consecutive requests, the server clears the corresponding client record and forces the client to re-authenticate.

[0010] Optionally, in the collaborative intervention module: When a victim detects that they are under a DrDoS attack, they send a distress signal to their ISP. After verifying the victim's identity, the ISP proactively intervenes and filters or blocks the attack traffic at the network level, assisting the victim in restoring network performance within a preset time.

[0011] Optionally, in the response limiting module: Length and frequency limits are added to the response messages of the preset UDP service to prevent amplification attacks; at the same time, a verification mechanism is used to either not respond to unverified requests or return a very small response packet.

[0012] A multi-dimensional collaborative defense method against DrDoS attacks includes: The server predefines client identifiers and sets the maximum number of consecutive requests; The server authenticates client requests based on weak authentication and CAPTCHA mechanisms. The server verifies the number of requests made by the client; When subjected to a DrDoS attack, enable ISP-coordinated intervention to restore network performance; Control the server's response.

[0013] Optionally, the server authenticates the client's request based on a weak authentication and CAPTCHA mechanism, including: The client sends a request to the server; The server determines that this is the first request, generates a session identifier containing a random number, and calculates a hash value; The server returns a session identifier, the first request sent by client i to the server, and its hash value to the client. The server verifies whether the hash values ​​match.

[0014] Optionally, validating the number of client requests includes: When the number of requests from a client exceeds the set maximum number of consecutive requests, the server clears the corresponding client record and forces the client to re-authenticate.

[0015] Optionally, in the event of a DrDoS attack, enabling ISP-coordinated intervention to restore network performance includes: When a victim detects that they are under a DrDoS attack, they send a distress signal to their ISP. After verifying the victim's identity, the ISP proactively intervenes and filters or blocks the attack traffic at the network level, assisting the victim in restoring network performance within a preset time.

[0016] Optionally, server response control includes: Length and frequency limits are added to the response messages of the preset UDP service to prevent amplification attacks; at the same time, a verification mechanism is used to either not respond to unverified requests or return a very small response packet.

[0017] The beneficial effects of this invention are as follows: The UDAM scheme proposed in this invention exhibits significant advantages in both defense effectiveness and system performance: Extremely high attack suppression rate: The attack traffic suppression rate is as high as 99.97% when the attacker does not obtain the verification code; even if the attacker obtains the verification code by illegal means, the suppression rate can still reach 94.47%, effectively reducing DrDoS attacks to manageable small-scale DoS attacks; Rapid system recovery capability: Relying on the ISP collaboration mechanism, the system can restore key indicators such as TCP throughput, round-trip time, and CPU utilization to more than 90% of normal levels within 8 seconds after being attacked; Superior overall performance: Experimental data shows that after adopting the UDAM solution, the average TCP throughput of the system increased to 64.026 Mbps, the round-trip time was reduced by more than 40%, and the average CPU utilization increased by no less than 1%, thus optimizing resource utilization efficiency while ensuring security. Quantitative Security Enhancement: Quantitative analysis based on the AHP model shows that the overall security of the UDAM protocol is 5.58 times better than that of the original UDP protocol, with the strength of the defense mechanism contributing 47.4% and the reduction of protocol risk contributing 17.3%. Good compatibility and scalability: This invention is not only applicable to the NTP protocol, but can also be extended to various vulnerable UDP-based protocols such as DNS, SSDP, and Charge, and has broad application prospects in the Internet of Things. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram illustrating the sequence of establishing a connection between the client and the server according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a multi-dimensional scheme model according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the message interaction process between multiple roles according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the experimental network topology in an embodiment of the present invention; Figure 5 This is a schematic diagram comparing performance indicators before and after an attack according to an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] This embodiment proposes a multi-dimensional collaborative defense system against DrDoS attacks, including: The initialization module is used by the server to predefine client identifiers and set the maximum number of consecutive requests; The authentication module is used by the server to authenticate client requests based on weak authentication and CAPTCHA mechanisms. The request control module is used to control the number of consecutive requests made by the client. The collaborative intervention module is used to enable network operators (ISPs) to coordinate intervention and restore network performance when subjected to DrDoS attacks. The response restriction module is used to control the server's response.

[0023] The core of this embodiment lies in proposing a multi-dimensional defense mechanism called UDAM (UDP DrDoS Attack Mitigation). This mechanism organically combines three technical means—weak authentication, request frequency control, and cross-domain collaboration—to construct a defense system covering the entire path from attacker to server to victim to ISP. The multi-dimensional solution model proposed in this embodiment is as follows: Figure 2 As shown.

[0024] Furthermore, the weak authentication and CAPTCHA mechanisms in the authentication module include: When a client and server establish a connection for the first time, the server generates a session identifier containing a random number (such as SNi, RTi) and calculates a hash value Hi = HASH(SNi || CiPi) based on the MD5 algorithm as a verification code. The client must include this verification code in subsequent requests. The server verifies the authenticity of the request source by comparing the validity of the verification code, thereby effectively identifying and rejecting malicious requests with spoofed IP addresses.

[0025] Figure 1 The sequence diagram for establishing a connection between the client and the server illustrates the interaction flow when the client first establishes a connection with the server, including the CAPTCHA generation and verification process. Figure 1 in,Request i1 The first request initiated by client i to the server, Response i1 For the server to respond to the request i1 SN's reply i RT is the random value corresponding to client i. i For the request time of client i, SN j CIP generates random values ​​for the server. i For the IP address of client i This is a hash function.

[0026] Furthermore, a dynamic request frequency control mechanism is adopted in the request control module: The server maintains a request counter Ci for each client, with a maximum consecutive request count N. If Ci > N, the server clears the client's record and forces it to re-authenticate. This mechanism significantly increases the resource and time costs for attackers to launch continuous reflection attacks, thus deterring attack motivation from an economic perspective.

[0027] Furthermore, the collaborative intervention module employs an ISP collaborative intervention and rapid recovery mechanism: When a victim detects a DrDoS attack, they can send a distress signal to their ISP. After verifying the victim's identity through a weak authentication process, the ISP will proactively intervene and filter or block the attack traffic at the network level, assisting the victim in restoring network performance within 8 seconds, achieving an integrated "detection-verification-blocking-recovery" response.

[0028] Furthermore, the response limiting module employs server-side response control and traffic shaping mechanisms: For easily exploitable UDP services (such as NTP and DNS), this invention adds length and frequency limits to their response messages to prevent amplification attacks; at the same time, it combines a verification mechanism to not respond to unverified requests or return extremely small response packets, fundamentally weakening the attack amplification effect.

[0029] The system workflow in this embodiment is as follows: (1) Initialization phase: The server predefines client identification fields (IP, random number, first access time, etc.) and sets the global maximum number of requests N; (2) Initial connection establishment: The client sends a request. i1 To the server; Server generates SN i With H i Store it as a new record and set the SN. i Send back to the client; Client responds to Request i1 (The first request sent by client i to the server), SN i and H i For server verification; (3) Request processing and verification: Server verification H i Legality, and check C i Does it exceed the limit? If the verification passes and C i If the value is less than or equal to N, then the request will be responded to normally, and C will be incremented. i ; Otherwise, reject the request, mark the client as malicious, and clear its records; (4) ISP Collaboration Process: The victim sent a Help message to the ISP. j ; The ISP returns verification parameters, and the victim replies with "Help". j SN j and H′ = HASH(SN) j || C i P); Once the ISP verifies the request, it will issue a Responsej and assist in blocking the attack flow.

[0030] Message interaction process between multiple roles, such as Figure 3 As shown, Figure 3 This demonstrates the collaborative defense process among the victim, ISP, and NTP server after the attacker obtains the CAPTCHA. This embodiment also proposes a multi-dimensional collaborative defense method against DrDoS attacks, including: The server predefines client identifiers and sets the maximum number of consecutive requests; The server authenticates client requests based on weak authentication and CAPTCHA mechanisms. The server verifies the number of requests made by the client; When subjected to a DrDoS attack, enable ISP-coordinated intervention to restore network performance; Control the server's response.

[0031] Furthermore, the server authenticates client requests based on weak authentication and CAPTCHA mechanisms, including: The client sends a request to the server; The server determines that this is the first request, generates a session identifier containing a random number, and calculates a hash value; The server returns a session identifier, and the client replies with Requesti1, the session identifier, and a hash value. The server verifies whether the hash values ​​match.

[0032] Furthermore, verifying the number of client requests includes: When the number of requests from a client exceeds the set maximum number of consecutive requests, the server clears the corresponding client record and forces the client to re-authenticate.

[0033] Furthermore, in the event of a DrDoS attack, enabling ISP-coordinated intervention to restore network performance includes: When a victim detects that they are under a DrDoS attack, they send a distress signal to their ISP. After verifying the victim's identity, the ISP proactively intervenes and filters or blocks the attack traffic at the network level, assisting the victim in restoring network performance within a preset time.

[0034] Furthermore, server response control includes: Length and frequency limits are added to the response messages of the preset UDP service to prevent amplification attacks; at the same time, a verification mechanism is used to either not respond to unverified requests or return a very small response packet.

[0035] The following uses the NTP protocol as an example to illustrate the specific implementation process of the UDAM scheme: 1. System initialization: The server predefines client identifiers (such as IP address, random number, first access time, etc.) and sets the maximum number of consecutive requests N.

[0036] 2. Client's first request: (1) The client sends a monlist request to the NTP server; (2) The server determines that this is the first request and generates a serial number. i And calculate H i = HASH(SN i || CiP i ); (3) The server returns the SN i The client responded with a Request. i1 SN i and H i .

[0037] 3. Verification and Response: (1) Server verification H i Does it match? If it matches and C i If ≤ N, then return Response. i1 ; (2) Otherwise, reject the request and mark it as a malicious client.

[0038] 4. ISP intervention process: (1) The victim sends a help request to the ISP. j ; (2) The ISP returns verification information, and the victim replies with Help. j SN j and H′ = HASH(SN) j || C i P); (3) After the ISP verifies the data, it will assist in blocking the attack traffic.

[0039] Through the above process, UDAM effectively suppresses UDP DrDoS attacks while ensuring legitimate communication, achieving multi-dimensional collaborative defense.

[0040] The experimental network topology in this embodiment is as follows: Figure 4 As shown, the experimental environment topology includes a core switch, an edge switch, a malicious node, a victim, an ISP, and normal nodes. Figure 5 The presentation showed a comparison of performance metrics before and after the attack, including changes in TCP throughput, round-trip time, and CPU utilization.

[0041] The UDAM scheme proposed in this invention exhibits significant advantages in both defense effectiveness and system performance: Extremely high attack suppression rate: The attack traffic suppression rate is as high as 99.97% when the attacker does not obtain the verification code; even if the attacker obtains the verification code by illegal means, the suppression rate can still reach 94.47%, effectively reducing DrDoS attacks to manageable small-scale DoS attacks; Rapid system recovery capability: Relying on the ISP collaboration mechanism, the system can restore key indicators such as TCP throughput, round-trip time, and CPU utilization to more than 90% of normal levels within 8 seconds after being attacked; Superior overall performance: Experimental data shows that after adopting the UDAM solution, the average TCP throughput of the system increased to 64.026 Mbps, the round-trip time was reduced by more than 40%, and the average CPU utilization increased by no less than 1%, thus optimizing resource utilization efficiency while ensuring security. Quantitative Security Enhancement: Quantitative analysis based on the AHP model shows that the overall security of the UDAM protocol is 5.58 times better than that of the original UDP protocol, with the strength of the defense mechanism contributing 47.4% and the reduction of protocol risk contributing 17.3%. Good compatibility and scalability: This invention is not only applicable to the NTP protocol, but can also be extended to various vulnerable UDP-based protocols such as DNS, SSDP, and Charge, and has broad application prospects in the Internet of Things.

[0042] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A multi-dimensional collaborative defense system against DrDoS attacks, characterized in that, include: The initialization module is used by the server to predefine client identifiers and set the maximum number of consecutive requests; The authentication module is used by the server to authenticate client requests based on weak authentication and CAPTCHA mechanisms. The request control module is used to control the number of consecutive requests made by the client. The collaborative intervention module is used to enable network operators (ISPs) to coordinate intervention and restore network performance when subjected to DrDoS attacks. The response restriction module is used to control the server's response.

2. The multi-dimensional collaborative defense system against DrDoS attacks according to claim 1, characterized in that, The weak authentication and CAPTCHA mechanisms in the authentication module include: When the client and server establish a connection for the first time, the server generates a session identifier containing a random number and a verification code; wherein, the verification code is a hash value. In subsequent requests, the server verifies the authenticity of the request source by comparing the validity of the verification code attached by the client.

3. The multi-dimensional collaborative defense system against DrDoS attacks according to claim 1, characterized in that, In the request control module: When the number of requests from a client exceeds the set maximum number of consecutive requests, the server clears the corresponding client record and forces the client to re-authenticate.

4. The multi-dimensional collaborative defense system against DrDoS attacks according to claim 1, characterized in that, In the collaborative intervention module: When a victim detects that they are under a DrDoS attack, they send a distress signal to their ISP. After verifying the victim's identity, the ISP proactively intervenes and filters or blocks the attack traffic at the network level, assisting the victim in restoring network performance within a preset time.

5. The multi-dimensional collaborative defense system against DrDoS attacks according to claim 1, characterized in that, In the response restriction module: Length and frequency limits are added to the response messages of the preset UDP service to prevent amplification attacks; at the same time, a verification mechanism is used to either not respond to unverified requests or return a very small response packet.

6. A multi-dimensional collaborative defense method against DrDoS attacks, characterized in that, Applied to the system as described in any one of claims 1-5, the method comprises: The server predefines client identifiers and sets the maximum number of consecutive requests; The server authenticates client requests based on weak authentication and CAPTCHA mechanisms. The server verifies the number of requests made by the client; When subjected to a DrDoS attack, enable ISP-coordinated intervention to restore network performance; Control the server's response.

7. The multi-dimensional collaborative defense method against DrDoS attacks according to claim 6, characterized in that, The server authenticates client requests based on weak authentication and CAPTCHA mechanisms, including: The client sends a request to the server; The server determines that this is the first request, generates a session identifier containing a random number, and calculates a hash value; The server returns a session identifier, the first request sent by client i to the server, and its hash value to the client. The server verifies whether the hash values ​​match.

8. The multi-dimensional collaborative defense method against DrDoS attacks according to claim 6, characterized in that, Verification of the number of client requests includes: When the number of requests from a client exceeds the set maximum number of consecutive requests, the server clears the corresponding client record and forces the client to re-authenticate.

9. The multi-dimensional collaborative defense method against DrDoS attacks according to claim 6, characterized in that, When suffering a DrDoS attack, enabling ISP-coordinated intervention to restore network performance includes: When a victim detects that they are under a DrDoS attack, they send a distress signal to their ISP. After verifying the victim's identity, the ISP proactively intervenes and filters or blocks the attack traffic at the network level, assisting the victim in restoring network performance within a preset time.

10. The multi-dimensional collaborative defense method against DrDoS attacks according to claim 6, characterized in that, Controlling server response includes: Length and frequency limits are added to the response messages of the preset UDP service to prevent amplification attacks; at the same time, a verification mechanism is used to either not respond to unverified requests or return a very small response packet.

Images