Method and device for detecting and defending against ddos attacks

Abstract

According to one embodiment of the present disclosure, a computer program stored on a computer-readable storage medium is disclosed. The computer program performs the following methods for responding to a DDoS attack, wherein the method may include: generating a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol from flow information collected from a backbone router; determining that the traffic of the flow group is a Distributed Denial of Service (DDoS) attack if the traffic of the flow group exceeds a preset threshold within a set time; diverting the traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a set path before being delivered to a customer network; and filtering the DDoS attack traffic detected by the DDoS defense device to deliver only normal traffic to the customer network.

Description

Technology Field

[0001] The present invention relates to the field of network security, and in particular to a method for detecting and responding to Distributed Denial of Service (DDoS) attacks. Background Technology

[0002] In network environments such as the Internet, a DDoS attack is an attack in which multiple distributed systems simultaneously send excessive traffic to a target server or network, disrupting the provision of normal services. Such attacks generate massive traffic and exhaust the resources of the target network, causing a denial of service.

[0003] As illustrated in FIG. 1, the existing DDoS defense system is installed inside the customer network to monitor traffic and defend against attacks. In the example of FIG. 1, the customer network (300) may include DDoS defense equipment (200), a firewall (30), and customer network equipment (40). In the example illustrated in FIG. 1, the backbone router (10) of the IDC provider and the customer switch (20) may be equipment of the service provider. As illustrated in FIG. 1, since the DDoS defense equipment (200) is included in the customer network (300), a process of identifying attack patterns through TCP / IP Layer 7 traffic analysis was required for DDoS detection, and a large amount of resources were required for large-scale traffic analysis.

[0004] Therefore, building a system to analyze large-scale traffic in real-time and block attacks requires significant cost and infrastructure, and realistically, this structure presents a problem in that it is difficult to apply to all customers.

[0005] Furthermore, depending on the network structure, there may be cases where DDoS attacks go undetected or efficient traffic diversion paths are not established to defend against attack traffic. Existing systems feature defense frameworks concentrated on specific equipment and suffer from the problem of being unable to adapt to real-time fluctuating traffic.

[0006] These problems highlight the importance of defending against DDoS attacks from outside the customer network, and efficient traffic analysis and filtering technologies are required to address this. In this regard, Korean Registered Patent No. 10-2575526 discloses a method for detecting distributed denial-of-service attacks using learned historical data. The problem to be solved

[0007] The present disclosure is derived from the aforementioned background technology and is intended to prevent the inflow of DDoS attack traffic into a customer network by detecting and blocking DDoS attacks from outside the customer network in advance, and to provide a DDoS defense system on the part of the IDC service provider. means of solving the problem

[0008] In order to solve the aforementioned problem, a computer program stored on a computer-readable storage medium is disclosed according to one embodiment of the present disclosure. The computer program performs the following methods for responding to a DDoS attack, wherein the method may include: a step of generating a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol from flow information collected from a backbone router; a step of determining that the traffic of the flow group is a Distributed Denial of Service (DDoS) attack if the traffic of the flow group exceeds a preset threshold within a set time; a step of diverting the traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a set path before being delivered to a customer network; and a step of filtering the DDoS attack traffic detected by the DDoS defense device and delivering only normal traffic to the customer network.

[0009] Alternatively, the step of generating the flow group may include the step of generating the flow group by classifying traffic data based on a Netmask and grouping them into 24-bit or 32-bit subnet units.

[0010] Alternatively, the threshold value is set based on the normal traffic pattern of the customer network and can be adjusted according to normal traffic fluctuations of the customer network.

[0011] Alternatively, the threshold value may be set independently for each time period according to the traffic for each time period by dividing the traffic of the customer network into predetermined time units.

[0012] Alternatively, the threshold value may be set as the maximum traffic value recorded in each time period based on the analysis of traffic data during a predetermined period for each time period of the customer network.

[0013] Alternatively, the threshold value may be set differently depending on the nature of the customer network.

[0014] Alternatively, the step of diverting traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a configured path before being delivered to the customer network may include the step of diverting traffic determined to be a DDoS attack from the backbone router to the IDC provider's DDoS defense device so that the diverted traffic passes through the DDoS defense device and is delivered to the customer network through the customer switch.

[0015] Alternatively, the step of diverting traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a set path before being delivered to the customer network may include the step of diverting to a DDoS defense device determined according to the protocol or amount of traffic of the traffic.

[0016] Alternatively, the step of diverting traffic of the flow group identified as the above DDoS attack to DDoS defense equipment through a configured path before being delivered to the customer network can be performed according to the path configuration control of the backbone router of the operation center.

[0017] Alternatively, the operation center may further include the step of controlling the backbone router so that traffic is transmitted to the normal path to the customer network after the DDoS attack has ended.

[0018] Alternatively, the DDoS defense equipment may compare traffic with a preset DDoS attack pattern, block traffic that matches the DDoS attack pattern, and forward normal traffic to the customer network.

[0019] Alternatively, the DDoS defense equipment can block DDoS attack traffic and deliver normal traffic to the customer network by filtering traffic through protocol-specific analysis of the traffic and applying different filtering rules for each protocol.

[0020] Alternatively, the DDoS defense equipment may record DDoS attack traffic in a security log and update filtering rules based on the recorded DDoS attack traffic.

[0021] Alternatively, the step of diverting traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a set path before being delivered to the customer network may include a step of controlling predetermined traffic to be delivered to the customer network without diverting to the DDoS defense device.

[0022] Alternatively, it may further include a step of generating a traffic analysis report and providing real-time notifications to the client in the event of a DDoS attack.

[0023] Alternatively, a method for responding to a DDoS attack is disclosed. The method may include: generating a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol from flow information collected from a backbone router; determining that the traffic of the flow group is a Distributed Denial of Service (DDoS) attack if the traffic of the flow group exceeds a preset threshold within a set time; diverting the traffic of the flow group determined to be a DDoS attack to a DDoS defense device through a set path before it is delivered to a customer network; and filtering the DDoS attack traffic detected by the DDoS defense device to deliver only normal traffic to the customer network.

[0024] Alternatively, a computer device is disclosed. The computer device includes one or more processors; and a memory for storing instructions executable on the one or more processors. The one or more processors generate a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol from flow information collected from a backbone router. If the traffic of the flow group exceeds a preset threshold within a set time, it is determined to be a Distributed Denial of Service (DDoS) attack. The traffic of the flow group determined to be a DDoS attack is diverted to a DDoS defense device through a set path before being delivered to a customer network. The DDoS defense device can filter the detected DDoS attack traffic and deliver only normal traffic to the customer network. Effects of the invention

[0025] By detecting and blocking DDoS attacks from outside the customer network in advance, the inflow of DDoS attack traffic into the customer network can be blocked, and the IDC service provider can provide a DDoS defense system. Brief explanation of the drawing

[0026] Figure 1 is an example diagram of a network configuration for a conventional DDoS defense system. FIG. 2 is an example diagram of a network configuration for a DDoS defense system of one embodiment of the present disclosure. FIG. 3 is a flowchart illustrating a method for responding to a DDoS attack in one embodiment of the present disclosure. FIG. 4 illustrates a brief and general schematic diagram of an exemplary computing environment in which embodiments of the present disclosure may be implemented. Specific details for implementing the invention

[0027] Various embodiments are now described with reference to the drawings. In this specification, various descriptions are provided to provide an understanding of the present disclosure. However, it is evident that these embodiments can be practiced without such specific descriptions.

[0028] As used herein, terms such as “component,” “module,” “system,” etc. refer to computer-related entities, hardware, firmware, software, combinations of software and hardware, or executions of software. For example, a component may be, but is not limited to, a procedure executed on a processor, a processor, an object, an execution thread, a program, and / or a computer. For example, both an application executed on a computer device and the computer device itself may be a component. One or more components may reside within a processor and / or an execution thread. A component may be localized within a single computer. A component may be distributed among two or more computers. Additionally, these components may be executed from various computer-readable media having various data structures stored therein. Components may communicate through local and / or remote processes, for example, according to signals having one or more data packets (e.g., data from a component interacting with another component in a local system or distributed system, and / or data transmitted through signals to other systems and networks such as the Internet).

[0029] Furthermore, the term "or" is intended to mean an implicit "or" rather than an exclusive "or." That is, unless otherwise specified or evident from the context, "X uses A or B" is intended to mean one of the natural implicit substitutions. In other words, if X uses A; if X uses B; or if X uses both A and B, "X uses A or B" may apply to any of these cases. Additionally, the term "and / or" as used herein should be understood to refer to and include all possible combinations of one or more of the enumerated related items.

[0030] Additionally, the terms “comprising” and / or “comprising” should be understood to mean that such features and / or components are present. However, the terms “comprising” and / or “comprising” should be understood not to exclude the presence or addition of one or more other features, components and / or groups thereof. Furthermore, unless otherwise specified or clearly evident from the context to indicate a singular form, the singular in this specification and claims should generally be interpreted to mean “one or more.”

[0031] And, the term “at least one of A or B” should be interpreted to mean “a case including only A,” “a case including only B,” or “a combination of A and B.”

[0032] Those skilled in the art should recognize that the various exemplary logical blocks, configurations, modules, circuits, means, logics, and algorithmic steps described in connection with the embodiments disclosed herein may be implemented in electronic hardware, computer software, or a combination of both. To clearly exemplify the interchangeability of hardware and software, various exemplary components, blocks, configurations, means, logics, modules, circuits, and steps have been generally described above in terms of their functionality. Whether such functionality is implemented in hardware or software depends on the specific application and design constraints imposed on the overall system. Skilled technicians may implement the described functionality in various ways for each specific application. However, such decisions regarding implementation should not be construed as going beyond the scope of this disclosure.

[0033] The description of the presented embodiments is provided to enable those skilled in the art to use or practice the present invention. Various modifications to these embodiments will be apparent to those skilled in the art. The general principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present invention is not limited to the embodiments presented herein. The present invention should be interpreted in the broadest possible scope consistent with the principles and novel features presented herein.

[0035] Figure 1 is an example diagram of a network configuration for a conventional DDoS defense system.

[0036] Referring to FIG. 1, the network configuration diagram of the present disclosure can be broadly divided into a network of an IDC (Internet data center) service provider and a network (300) of customers using the same. An IDC is a facility that collects servers, network equipment, etc., necessary for providing internet services, operates and manages them 24 hours a day, ensures a stable flow of internet traffic, and enables a large number of customers to receive services through it.

[0037] The IDC network may include a backbone router (10) and a customer switch (20). The backbone router controls the flow of traffic between the IDC network and the Internet, monitors traffic on the network, and can generate flow information for the traffic. The flow information generated by the backbone router includes source IP, destination IP, port number, and protocol information, which allows for real-time analysis of network traffic.

[0038] The backbone router (10) manages the main paths for internet traffic to enter or exit the IDC network. The backbone router controls the traffic flow of the network and performs the role of managing traffic transmitted to the customer network (300).

[0039] The customer switch (20) is a device that connects the backbone router and the customer network (300) and manages traffic transmitted from the backbone router to the customer network. In general, traffic from the backbone router can be transmitted directly to the customer network through the customer switch. The customer switch can be configured as an L2 or L3 switch and can route traffic entering the customer network to be transmitted to each device in the customer network.

[0040] The customer network (300) may be a network including servers, storage, etc. of individual companies or organizations located in the IDC. The customer network (300) may be configured by occupying a part of the IDC, or it may be configured in the customer's space outside the IDC.

[0041] In existing systems, the DDoS defense equipment (200) is included in the customer network and can perform the role of detecting and blocking DDoS attacks among the traffic flowing into the customer network. When a DDoS attack is detected, the DDoS defense equipment (200) can filter and block only the DDoS traffic and allow normal traffic to be delivered via the original path. The DDoS defense equipment (200) can detect DDoS attacks through pattern analysis of incoming traffic and can filter DDoS traffic and normal traffic from this. In this existing technology, various problems may arise because the DDoS defense equipment is located inside the customer network. For example, since a DDoS attack can only be detected after a large volume of traffic has flowed into the customer network, a response may be made when the network bandwidth has already been exhausted. In addition, since the customer must install and maintain a separate DDoS defense equipment, there may be additional costs and problems with the network infrastructure becoming complex.

[0042] FIG. 2 is an example diagram of a network configuration for a DDoS defense system of one embodiment of the present disclosure.

[0043] To solve the problems of existing technologies, the present invention may be configured such that a DDoS defense device (200) is deployed in an IDC network section outside the customer network to block attack traffic before traffic flows into the customer network. In the system of the present disclosure, traffic is analyzed at the IDC backbone router, and if abnormal traffic is detected, the traffic is diverted to the DDoS defense device, which filters the traffic to block its inflow into the customer network in advance. According to the system of the present disclosure, a system is provided that allows customers to be reliably protected from DDoS attacks without installing separate DDoS defense devices, thereby enabling cost reduction and efficient network management. By blocking attack traffic before it enters the customer network, network bandwidth exhaustion is prevented, and the stability of customer services can be significantly improved. Furthermore, since it is possible to respond to DDoS attacks within the IDC network section, additional settings for DDoS defense services can be made, such as classification by customer or classification by the nature of the customer's service, allowing the IDC operator to provide richer services.

[0044] The DDoS defense system of the present invention may be composed of a backbone router (10), a customer switch (20), DDoS defense equipment (200), a computer device (100) of an operation center, and a customer network (300). The configuration shown in FIG. 2 is a simplified representation of the network equipment necessary for the description of the present disclosure and does not represent the entire network configuration.

[0045] The backbone router (10) is a device that processes traffic flowing in or transmitted through the IDC as a primary path between the IDC network and the customer network. The backbone router (10) can generate flow information and transmit detailed data about the traffic flow to the computer device (100) in the operation center. Through this, the computer device (100) in the operation center can analyze the traffic in real time and detect DDoS attacks.

[0046] The computer device (100) of the operation center can perform monitoring and control of the entire infrastructure of the IDC. The computer device (100) of the operation center can detect DDoS attacks by analyzing flow information received from the backbone router (10) in real time. When a DDoS attack is detected, the computer device (100) of the operation center can control the backbone router (10) to redirect the attack traffic to a bypass path. At this time, the attack traffic is not delivered directly to the customer network (300) but is delivered to the DDoS defense equipment (200) to be blocked or filtered before being delivered to the customer network (300).

[0047] Specifically, the computer device (100) of the operation center collects flow information in real time from the backbone router (10). Flow information is data summarizing the flow of traffic transmitted and received on the network, and specifically, may include a source IP, which is the IP address of the device transmitting the traffic; a destination IP, which is the IP address of the device receiving the traffic; a source port, which is a port number distinguishing the traffic transmission application; a destination port, which is a port number distinguishing the traffic reception application; and protocol information, which is information regarding the protocol being used by the traffic, such as TCP or UDP. The computer device (100) can create a flow group by grouping flows that have the same 5 tuple, which includes the source IP, destination IP, source port, destination port, and protocol information.

[0048] More specifically, a flow may be a set of packets that share identical information, such as the Ingress interface, source IP, destination IP, IP protocol type, source port, destination port, and IP type of service. The total volume of the packets included in the flow, when all sizes are added together, may be traffic.

[0049] A backbone router (10) can collect flows over a unit of time and transmit them to a computer device (100). The collected flows consist of multiple flows collected over a unit of time, and each flow may include information such as time information, source IP, destination IP, source port, destination port and protocol, number and size of packets, and direction. The collected flows may be grouped into fixed time units. For example, when groupsing flows with a fixed time unit of 30 seconds, the flows collected over 30 seconds may be distinguished according to the time information and grouped based on 5-tuples. For example, if each flow is a set of packets over 1 second, there may be 30 flows over 30 seconds, and the 30 flows may be grouped based on the information included in the flows. For example, among the 30 flows, flows with the same source IP, destination IP, source port, destination port and protocol may be grouped to create a flow group. In one embodiment, flows in which all 5 tuples match may be created as a flow group, or flows in which some of them match may be created as a flow group. In the case of a DDoS attack, there may be cases where the source IP is forged or multiple source IPs are used, so the computer device (100) may group flows by prioritizing the destination IP. In addition, as another example, flows in which the source IP and destination IP are the same may be grouped, or flows in which the source IP and destination IP are alternately set may be grouped.

[0050] The computer device (100) can detect a DDoS attack based on received flow information. The computer device (100) can detect a DDoS attack by comparing the received flow information with learned traffic patterns. More specifically, the computer device (100) can determine that it is a DDoS attack if the traffic of a flow group exceeds a preset threshold within a certain period of time. The computer device (100) can learn the normal traffic patterns of the customer network (300) and analyze the difference between the learned pattern and the currently received traffic to determine that an abnormal increase in traffic or traffic concentrated on a specific IP address or port is a sign of a DDoS attack. The computer device (100) can apply a threshold-based detection algorithm to detect a DDoS attack when traffic exceeds a set threshold and can generate a response to the DDoS attack, notifications to the customer, and traffic analysis reports. The threshold can be set based on the characteristics of the customer network and past traffic patterns and can be continuously optimized. The computer device (100) can set different threshold values ​​for determining a DDoS attack depending on the nature of the customer network. For example, the threshold value may be set differently depending on the service used by the customer, or may be set differently depending on the importance of the infrastructure included in the customer network. A threshold value generated based on the characteristics of the customer network and past traffic patterns can be corrected according to the nature of the customer network and used to determine a DDoS attack.

[0051] When an attack is detected, the computer device (100) can control the backbone router (10) to prevent the attack traffic from being directly transmitted to the customer network (300). At this time, the computer device (100) can send a command to set a bypass path to the backbone router (10) to divert the attack traffic to the DDoS defense equipment (200). When the attack traffic is diverted to the DDoS defense equipment (200), the DDoS defense equipment (200) can filter the traffic to block abnormal traffic and ensure that only normal traffic is transmitted to the customer network (300). When the DDoS attack ends, the computer device (100) can control the backbone router (10) to return the traffic to the normal path.

[0052] The computer device (100) can continuously monitor the network status through traffic monitoring. In the event of a DDoS attack, the computer device (100) can report the traffic status and attack information (e.g., attack IP, time of occurrence, type of attack, destination, etc.) to administrators and customers to enable a response. Additionally, the computer device (100) can generate a traffic analysis report during or after the attack to evaluate the impact of the attack and optimize future response strategies.

[0053] The DDoS defense equipment (200) may be included in the network of the IDC service provider and may be located independently of the path connecting the backbone router (10) to the customer network (300). The DDoS defense equipment (200) is a device that blocks attack traffic before it enters the customer network, and processes the attack traffic under the control of the computer device (100) of the operation center, and ensures that only normal traffic is transmitted to the customer network. To this end, the DDoS defense equipment (200) can analyze the pattern of the DDoS attack traffic and filter only the normal traffic.

[0054] The DDoS defense equipment (200) receives traffic diverted from the backbone router (10) and analyzes the received traffic to distinguish between abnormal traffic and normal traffic. For example, the DDoS defense equipment (200) may view traffic having the same source IP as the source IP of the flow group of traffic determined to be a DDoS attack as abnormal traffic.

[0055] The DDoS defense equipment (200) can filter DDoS attack traffic in various ways, such as blocking traffic based on IP, blocking traffic based on protocol, and blocking traffic based on session. For example, the DDoS defense equipment (200) can respond to a DDoS attack by blocking related traffic based on the IP of the traffic determined to be a DDoS attack. The DDoS defense equipment (200) can respond to a DDoS attack through protocol-based filtering using protocol-specific filtering rules.

[0056] The DDoS defense equipment (200) can respond to DDoS attacks by analyzing and blocking traffic at multiple stages through multi-layer filtering. For example, it can respond to DDoS attacks in various ways, such as first filtering that blocks a large amount of traffic based on basic patterns and thresholds, second filtering that detects additional abnormal traffic by analyzing detailed protocols and checking connection status, and third filtering that finally blocks remaining abnormal traffic by performing filtering based on IP addresses or session status.

[0057] The DDoS defense equipment (200) can record a log of the traffic when abnormal traffic is blocked, so that it can be used as data to prepare for future attack patterns. Additionally, the DDoS defense equipment (200) can transmit this log data to a computer device (100) in an operation center so that additional analysis can be performed.

[0058] The customer switch (20) is a device that connects the backbone router and the customer network (300), and is a path that traffic passes through before being delivered to the customer network. Generally, traffic is delivered to the customer network through this switch. The customer switch (20) can receive traffic from the backbone router (10) or the DDoS defense device (200) and deliver it to the customer network (300).

[0059] The customer network (300) may refer to a network area containing network equipment, including servers, storage, etc., of individual companies or organizations located in the IDC. The customer network (300) may be an important asset that exchanges data and traffic through the internet or an external network and must be protected from DDoS attacks.

[0060] The customer network (300) can generally be composed of servers, firewalls, routers, switches, storage equipment, etc. These devices can cooperate to perform roles such as internal applications, data storage, and user access, and can enable the smooth provision of business services on the network.

[0061] The customer firewall (30) can perform the role of filtering traffic entering the customer network. The customer firewall (30) transmits only traffic allowed by security equipment to the internal network and can block abnormal traffic or traffic that poses a security threat. The customer firewall can serve as a line of defense for network security.

[0062] Customer network equipment (40) may include devices such as servers, databases, and application servers within the customer network. These devices perform customer business processes or service operations and may require the provision of a stable communication environment.

[0063] Such customer networks (300) are targets of DDoS attacks, and when a DDoS attack occurs, a large amount of traffic flows into the customer network, exhausting network resources and causing server overload, which can lead to the interruption of customer services. In the present disclosure, the system is configured to respond to DDoS attacks from outside the customer network to prevent the customer network (300) from suffering direct damage from DDoS attacks and to facilitate monitoring and response. The present disclosure enables the customer to safely protect the network without installing separate DDoS defense equipment by responding to DDoS attacks from outside the customer network, and can provide a new service area from the perspective of the service provider.

[0065] FIG. 3 is a flowchart illustrating a method for responding to a DDoS attack in one embodiment of the present disclosure.

[0066] The computer device (100) can generate a flow group based on a 5-tuple including a source IP, destination IP, source port, destination port, and protocol from flow information collected from a backbone router.

[0067] Flows collected from backbone routers consist of multiple flows collected over a unit of time, and each flow may include information such as time information, source IP, destination IP, source port, destination port and protocol, number and size of packets, and direction.

[0068] A computer device (100) can create flow groups by classifying flows with identical 5-tuples into a single flow group based on 5-tuples (S100). A flow group represents traffic where the 5-tuples are identical and represents a specific flow occurring on a network. For example, when an IP address A transmits data to an IP address B through a specific application, that traffic can be defined as a single flow group. Since flow groups are established based on identical 5-tuples, multiple traffic flows on a network can be divided into multiple flow groups. Each flow group collects traffic statistics for a specific period of time, and this data is used for traffic anomaly detection and DDoS attack detection in subsequent steps. A flow group can represent a specific network session as a criterion for subdividing traffic. Flow groups can serve as basic information that allows for the individual analysis of different traffic flows and determination of whether each flow is normal or abnormal. By creating flow groups, abnormal traffic patterns on the network can be identified, and based on this, DDoS attacks can be detected.

[0069] The computer device (100) can create flow groups by classifying traffic data based on a Netmask and grouping them into 24-bit or 32-bit subnet units. A Netmask is a method used to distinguish networks based on IP addresses, and is used to distinguish between the network portion and the host portion of an IP address. A subnet mask defines the network size of an IP address, and subnet units such as 24-bit or 32-bit represent a granular range of the network. A 24-bit subnet is commonly referred to as a Class C network, and the network range is limited to 255 hosts. For example, it is displayed in the form of 192.168.0.0 / 24, and devices with IP addresses on the same network can communicate with each other. A 32-bit subnet represents a single host of an IP address. In a 32-bit subnet, each IP address represents an individual device, thereby allowing for the granularization of traffic between specific devices on the network. Before creating flow groups, the computer device (100) undergoes a process of classifying traffic data based on a Netmask. In this process, flow groups are defined by classifying traffic into 24-bit subnets (network ranges) or 32-bit subnets (single IPs). When using 24-bit subnets, traffic occurring within a specific network range is grouped into a single unit. For example, traffic originating from all devices within the 192.168.1.0 / 24 network can be managed as a single flow group. When using 32-bit subnets, traffic originating from specific IP addresses can be analyzed individually, and traffic flow between each IP address can be tracked. By classifying traffic at these subnet levels, large-scale traffic flows on the network can be managed more efficiently. This plays a particularly important role in detecting and blocking large-scale traffic originating from multiple IP addresses, such as in DDoS attacks.Subnet-based grouping enables the management and analysis of network traffic by dividing it into logical zones. This allows for precise analysis of whether traffic originating from specific subnets or IP addresses exhibits abnormal patterns when a DDoS attack occurs.

[0070] A computer device (100) classifies traffic into subnet units based on a netmask and then creates flow groups from the traffic occurring within each subnet. A flow group is a method of managing traffic by grouping it according to 5-tuple information such as the same source IP, destination IP, port, and protocol, and this can be applied at the subnet unit level. Since DDoS attacks often involve large-scale traffic from multiple IP addresses, grouping traffic at the subnet unit level allows for the rapid detection of traffic surges occurring within a specific range.

[0071] The computer device (100) can determine that a DDoS attack occurs if the traffic of a flow group exceeds a preset threshold within a certain period of time (S200). After creating a flow group, the computer device can monitor the amount and pattern of traffic occurring within each flow group. The computer device (100) can determine whether a DDoS attack is occurring based on the amount of traffic.

[0072] The threshold is an upper limit on the volume of traffic set based on normal network traffic patterns and can serve as a criterion for determining whether a DDoS attack is occurring. If the traffic occurring within each flow group exceeds the preset threshold, it is considered an abnormal traffic pattern and may be identified as a DDoS attack.

[0073] The threshold is set based on the usual traffic patterns of the customer network and can be adjusted according to normal traffic fluctuations of the customer network. The computer device (100) can learn by analyzing traffic patterns for the entire IP range of the customer network. The threshold can be learned by summing the traffic for the entire IP range of the customer network, or by learning the highest traffic value among the IP ranges of the customer network as the threshold. The threshold can be set independently for each time zone according to the traffic for each time zone by dividing the traffic of the customer network into predetermined time units. The threshold can be set as the threshold for each time zone based on the maximum traffic value recorded in each time zone during a predetermined period for each time zone of the customer network. For example, the computer device (100) can divide time zones into 15-minute intervals and collect information regarding customer traffic for each 15-minute period. For example, in the case of 6:00 AM to 7:00 AM, it can be divided into four time zones. In this case, traffic information can be collected over a single timeframe of 15 minutes, and the maximum value among the collected traffic can be set as the threshold for that timeframe. For example, the maximum value of traffic recorded for a customer network from 6:00 AM to 6:15 AM can serve as the threshold for determining a DDoS attack during that timeframe. Similarly, the maximum value of traffic recorded for a customer network from 7:00 PM to 7:15 PM can serve as the threshold for determining a DDoS attack during that timeframe. The threshold for the 6:00 AM timeframe and the threshold for the 7:00 PM timeframe may differ because normal network traffic may vary. As such, even for a single customer network, the traffic thresholds for determining a DDoS attack can differ by timeframe.

[0074] These time-based traffic thresholds can be updated at predetermined intervals. For example, when determining the time-based traffic threshold, the computer device (100) can set the maximum value of traffic from the previous 30 days as the threshold. For example, the computer device (100) can set the maximum value of traffic from 6:00 AM to 6:15 AM over 30 days as the threshold. Then, the computer device (100) can update the threshold on the next day by setting the maximum value of traffic from the previous 30 days as the threshold. The threshold can be updated to the maximum value of traffic from the preceding period and adjusted according to normal traffic fluctuations of the customer network. Additionally, if the traffic of the customer network grows rapidly, the period of the preceding period (30 days in the previous example) can be adjusted accordingly. For example, if the traffic of the customer network grows rapidly due to an issue (e.g., ad launch, search engine traffic, social issue, etc.), the stock price used to calculate the maximum value of traffic for determining a DDoS attack can be shortened to match the growth of the customer. For example, if a threshold for determining a DDoS attack is generated based on the analysis of the traffic volume of a customer network over 30 days in a normal environment, in the event of a sudden change in the customer network as described above, the traffic analysis period for calculating the threshold can be adjusted to respond to the change in the customer network, such as by analyzing the traffic of the previous 3 days, the traffic of the previous 1 day, or the previous time period. The aforementioned time intervals and periods are merely examples and the present disclosure is not limited thereto.

[0075] The computer device (100) may determine that a DDoS attack occurs if the traffic of a flow group exceeds the aforementioned threshold within a certain period of time. A DDoS attack may occur if the traffic changes rapidly over a short period of time. For example, the aforementioned certain period of time may be 30 seconds. For example, the computer device (100) may group the flows collected over 30 seconds based on flow information over 30 seconds and determine that a DDoS attack occurs if the traffic of the flow group exceeds a predetermined threshold. The aforementioned time interval is merely an example and the present disclosure is not limited thereto.

[0076] As described above, the computer device (100) can identify the normal traffic range by learning the traffic patterns of the customer network during normal times. Then, it can set a threshold based on the learned traffic patterns. The computer device (100) can determine whether there is abnormal traffic by comparing the traffic flowing in in real time with the threshold. Then, the computer device (100) can classify traffic exceeding the threshold as abnormal traffic when detected, determine it as a DDoS attack, and take measures to respond.

[0077] The threshold for determining the aforementioned DDoS attack can be set differently depending on the nature of the customer network, in addition to the method described above. For example, the threshold can be adjusted upward or downward depending on the nature of the customer network. The threshold can be adjusted based on the characteristics of the services provided by the customer network, business importance, or the services of the IDC being used. This enables the provision of customized security for the customer network and allows for more efficient management of network resources.

[0078] The characteristics of a customer network may vary depending on the volume, type, and pattern of traffic that the network must handle, and customized thresholds can be set accordingly.

[0079] The computer device (100) can adjust the threshold automatically or upon request from the customer when an increase in traffic, such as an event, is expected for the customer network. For example, a customer network providing large-scale web services must handle a large volume of user traffic, and accordingly, the amount of traffic fluctuation may be large. For example, services such as e-commerce sites, social media platforms, and communities must be designed to handle large volumes of traffic during times when user activity is concentrated, and the amount of traffic fluctuation may be large depending on external factors such as customer events (e.g., discount events, advertising execution, etc.) and social issues. In the case of services where there is a high probability of such traffic fluctuations, the set threshold can be raised and applied according to the customer or the customer's situation. For example, in the case of a globally operated e-commerce site, traffic may surge during specific event periods such as Black Friday, and the threshold can be temporarily raised during such events to manage traffic and prevent normal traffic from being falsely detected as a DDoS attack. In addition, in other examples where recurring events with periodicity, such as Black Friday, are scheduled, the threshold for determining a DDoS attack may be adjusted based on the traffic of the previous round of the event rather than the traffic of the immediately preceding period.

[0080] Depending on the nature of the customer network, if certain traffic plays a business-critical role, enhanced protection may be required for that traffic. In this case, the computer device (100) can apply a more customized threshold to high-importance services by adjusting the threshold based on business importance. For example, if a specific service on the network is the core of the business, traffic flowing into that service must be managed more strictly. For example, since financial services handle highly sensitive data, high security and availability levels must be maintained for related traffic. Since traffic related to financial transactions requires enhanced protection against DDoS attacks, a lower threshold can be set for such traffic to enable rapid detection and response to even weak anomalies. In another example, traffic where response speed is critical, such as VOLTE or live streaming, may be affected by response speed when passing through DDoS defense equipment. Furthermore, the fluctuation rate of these traffic may be high. In such cases, the computer device (100) can adjust the threshold to be slightly higher to minimize the impact on the response speed of the traffic. The computer device (100) may, for example, adjust the threshold to a low value in the case of traffic where availability or blocking of error occurrence is very important, and may adjust the threshold to a high value in the case of traffic where real-time is important.

[0081] Network resources can be managed efficiently by setting customized thresholds based on network characteristics and applying weights according to business importance. This ensures a balance between the processing of normal traffic and the detection of abnormal traffic, guaranteeing business continuity while minimizing network performance degradation. Setting thresholds tailored to network characteristics prevents false positives, where normal traffic is mistakenly identified as abnormal. Weighted threshold settings enable intensive protection for critical customers and critical traffic, thereby contributing to the optimization of network resources. Stricter security measures can be applied to critical traffic, while maintaining a standard level of security for non-critical traffic.

[0082] The computer device (100) can divert traffic from a flow group identified as a DDoS attack to a DDoS defense device via a configured path before it is delivered to the customer network (S300). As described above, the DDoS defense device can be located separately in the network path between the backbone router (10) and the customer switch (20). The computer device (100) can divert traffic from the flow group identified as a DDoS attack from the path to the customer network and deliver it to the DDoS defense device via a diversion path.

[0083] The computer device (100) can divert traffic determined to be a DDoS attack from the backbone router to the IDC service provider's DDoS defense equipment, so that the diverted traffic passes through the DDoS defense equipment and is transmitted to the customer network through the customer switch. In this case, the computer device (100) can divert the traffic to a DDoS defense equipment determined by the protocol and volume of the diverted traffic. The DDoS defense equipment may be composed of one or more network devices, and the response performance against DDoS attacks may differ depending on the resources of each device. The computer device (100) can determine which DDoS defense equipment will respond to the attack traffic based on the nature of the traffic determined to be a DDoS attack, such as the volume or protocol, and can control the backbone router (10) so that each traffic is transmitted to each corresponding equipment.

[0084] The computer device (100) can control the backbone router (10) to divert traffic identified as a DDoS attack from the normal path to a defense path. The computer device (100) can control the path settings of the backbone router to forward traffic from the backbone router (10) to the DDoS defense equipment. When the computer device (100) determines that the DDoS attack has ended, it can control the backbone router (10) to send traffic to the normal path to the customer network. In this case as well, the path settings of the backbone router (10) can be controlled in the same way to change the forwarding path of the traffic. Through this, the impact of the DDoS attack on the customer network can be minimized.

[0085] The computer device (100) can control the backbone router (10) so that predetermined traffic is delivered to the customer network without bypassing the DDoS defense equipment. If a DDoS attack is detected, the backbone router (10) can be controlled to deliver the entire traffic to the customer network or traffic related to the flow detected as a DDoS attack to the DDoS defense equipment. Traffic passing through the DDoS defense equipment may experience problems such as increased latency or filtering compared to normal cases. Therefore, it may be necessary for predetermined traffic to be delivered directly to the customer network without bypassing the DDoS defense equipment, even in the event of a DDoS attack.

[0086] Predetermined traffic refers to data that is likely to be misidentified as attack traffic, such as business-critical traffic or traffic that frequently occurs during normal activities. This traffic may be designed to be delivered directly to the customer network without filtering. Predetermined traffic may include, for example, the following examples. For instance, traffic originating from a trusted source, such as communication between the customer's internal servers or traffic originating from a trusted partner network, may not be attack traffic. Additionally, critical traffic from business applications operated by the customer (e.g., traffic from online payment systems or services with a large volume of regular transactions) may be included in normal activities. If the customer designates specific IP addresses or traffic types as trusted through presets, the trusted traffic designated by the customer may be delivered to the customer network without filtering. Information regarding this predetermined traffic may be shared between the backbone router (10) and the DDoS defense equipment (200). The predetermined traffic can be delivered to the customer network without being diverted from the backbone router (10) to the DDoS defense equipment, and the DDoS defense equipment can also utilize the information to deliver it to the customer network without going through a filtering process.

[0087] Predetermined traffic can be determined based on normal traffic patterns learned by analyzing the network normally through the system or by the customer specifying them via the management console. The customer can pre-configure frequently occurring transactions or trusted IP addresses to prevent such traffic from being diverted to the DDoS defense equipment. Additionally, the computer device (100) of the operation center can analyze the network traffic normally for each customer to learn frequently occurring normal traffic patterns, and based on these learned traffic patterns, designate business-critical traffic or normal traffic as predetermined traffic. In this case, the computer device (100) may transmit analysis information regarding the predetermined traffic, which is an exception to the DDoS attack judgment on the customer network, to the customer and undergo a confirmation process with the customer.

[0088] This offers the advantage of maintaining necessary security while preventing service interruptions caused by false positives. Additionally, since this traffic bypasses defense equipment, processing times are reduced, which can contribute to the optimization of service performance. In particular, for services where real-time processing performance is critical, it offers the benefit of handling traffic without delay while responding to DDoS attacks.

[0089] DDoS attack traffic detected by the DDoS defense equipment (200) can be filtered so that only normal traffic is transmitted to the customer network (300) (S400). The computer device (100) can set the filtering rules of the DDoS defense equipment (200), and the DDoS defense equipment (200) can perform filtering on DDoS attack traffic accordingly, blocking attack traffic and transmitting normal traffic to the customer network.

[0090] The DDoS defense equipment (200) can receive traffic that has been diverted before entering the customer network, analyze it in real time, and perform the function of distinguishing between normal traffic and abnormal traffic. The DDoS defense equipment (200) can recognize attack patterns by utilizing various traffic analysis algorithms and policies, block attack traffic, and transmit only normal traffic to the customer network.

[0091] The DDoS defense equipment (200) can compare traffic with a preset DDoS attack pattern to block traffic that matches the DDoS attack pattern and forward normal traffic to the customer network (300). Pattern-based filtering is a method of detecting and blocking abnormal traffic that deviates from the normal traffic flow by comparing normal traffic patterns with abnormal attack patterns.

[0092] Normal traffic patterns can exhibit predictable behavior on a network. For example, if traffic increases during a specific time of day, this pattern tends to repeat consistently. On the other hand, DDoS attack traffic involves a massive influx of packets into the network within a short period, which can display an abnormal flow.

[0093] While traffic on a customer's network may fluctuate depending on the time of day or business conditions, these changes can occur within a regular or predictable range. For example, e-commerce sites may experience relatively high traffic from 9 AM to 6 PM, while traffic tends to decrease at night. Such patterns exhibit a certain regularity and can be predictable depending on the characteristics of the business.

[0094] Conversely, a DDoS attack is traffic designed to consume network resources by generating a concentrated, large volume of traffic over a short period. This traffic exhibits abnormal forms that deviate from typical usage patterns and aims to paralyze the network, particularly by simultaneously transmitting massive packets. For example, the pattern of massive traffic generated over a short duration in a DDoS attack is distinguishable from normal user activity, and DDoS defense equipment can identify attack traffic based on surges in traffic occurring over a certain period. DDoS attacks often attempt frequent connection requests to the same IP address or port; since this pattern does not occur in normal traffic, DDoS defense equipment can recognize these frequent requests as abnormal activity and block them.

[0095] Pattern-based filtering is a method that detects abnormal traffic patterns by analyzing network traffic patterns in real time. The system learns from past data on normal traffic and analyzes currently incoming traffic based on this.

[0096] Pattern-based filtering detects changes in traffic in real time and can determine that traffic is abnormal when it increases rapidly or shows a flow that deviates from a normal pattern. For example, if traffic on a network typically generates 100 packets per second but suddenly generates 1,000 packets per second, this can be considered a possibility of a DDoS attack, and the DDoS defense equipment (200) can filter traffic showing rapid changes.

[0097] The DDoS defense equipment (200) can block DDoS attack traffic and transmit normal traffic to the customer network (300) by filtering traffic through protocol-specific analysis of traffic and applying different filtering rules for each protocol. Protocol-specific analysis is an analysis method that distinguishes between the use of normal protocols and the abuse of abnormal protocols by analyzing the characteristics of each network protocol.

[0098] Each network protocol has unique traffic characteristics, and abnormal traffic can be detected based on these characteristics. Protocols such as TCP, UDP, and ICMP are intended for normal network communication, but attackers can abuse these protocols to carry out DDoS attacks. Protocol analysis-based filtering is a method of responding to DDoS attacks by comparing normal traffic patterns and abnormal traffic patterns for each protocol. DDoS defense equipment can pre-define the normal usage range and packet characteristics for each protocol, and can block abnormal traffic based on this. For example, in the case of TCP packets, DDoS attack traffic can be filtered by analyzing the ratio of SYN packets or the frequency of connection attempts. In addition, DDoS defense equipment (200) can analyze multiple protocols simultaneously to determine whether abnormal traffic occurring in a specific protocol shows an abnormal pattern when compared to other protocols.

[0099] For example, a SYN flood attack is an attack that occurs by exploiting the 3-way handshake of the TCP protocol. The attacker sends a large number of SYN packets to the server, and the server sends a SYN-ACK response to this and waits for an ACK packet. However, since the attacker does not send an ACK packet, the server maintains the connection for a long time and consumes resources. The DDoS defense device (200) can analyze the ratio of SYN packets in real time for DDoS attack traffic and filter the traffic by considering it a DDoS attack if an abnormally high number of SYN packet requests occur.

[0100] Protocol analysis-based filtering can detect abnormal protocol activity based on the characteristics of each protocol used in the network, enabling more precise defense against DDoS attacks.

[0101] The DDoS defense equipment (200) can record DDoS attack traffic in a security log and update filtering rules based on the recorded DDoS attack traffic. The log includes information such as the source IP address, destination IP address, port number, protocol, and time of attack of the attack traffic, and can generate information about the characteristics of the attack.

[0102] Recorded security logs can be used as primary data for analysis. DDoS defense equipment continuously analyzes recorded data to derive the patterns and characteristics of DDoS attacks. Recorded security logs play a crucial role in analyzing how DDoS attacks occurred. For example, such data can be analyzed if repetitive SYN flood attacks occurred from a specific IP address or if there was a complex attack using multiple protocols simultaneously. Through security log analysis, information can be obtained regarding the methods used by the attacker and at what stage the attack was blocked, which allows for the development of scenarios to prepare for similar future attacks.

[0103] DDoS defense equipment can update filtering rules based on DDoS attack data recorded in security logs. This serves to continuously improve the defense performance of the equipment to prepare for new attack methods. Since DDoS attacks can evolve into new forms, existing filtering rules alone may not be able to effectively detect all attacks. Based on security logs, DDoS defense equipment can supplement existing filtering rules and apply enhanced rules that reflect new attack patterns. If a previously unseen attack pattern is discovered in the log data, the defense equipment can generate new filtering rules based on that data. For example, if a new type of attack occurring on a specific port is detected, a new blocking rule corresponding to it can be added. Filtering rules are updated automatically, and when new rules are created, they are immediately applied to the defense equipment, enabling a rapid response to future attacks.

[0104] The computer device (100) can generate a traffic analysis report and provide real-time notifications to the client company when a DDoS attack occurs. This report includes detailed information regarding the characteristics, scope, and affected network resources of the attack, and may include information to support the client company and the operations center in immediately understanding and responding to the attack.

[0105] The traffic analysis report may include the source IP address, destination IP address, port number, protocol, and the time and duration of the attack traffic. This allows for the identification of the characteristics of the attack traffic.

[0106] DDoS attacks are characterized by traffic volumes that significantly exceed typical levels, and reports can analyze the scale of the attack (e.g., traffic volume, packets per second, number of attackers, etc.). This enables the rapid identification of the potential impact the attack could have on the customer network.

[0107] The traffic analysis report may include an analysis of the types of attacks used in the DDoS attack. For example, various types of DDoS attacks, such as SYN flood, UDP flood, and ICMP flood, are recorded in the report, and it may include information to understand how the attack occurred.

[0108] Traffic analysis reports can be configured to enable customers to understand the details of network attacks and optimize future security strategies. The traffic analysis reports may include information such as the source and destination of DDoS attacks, traffic volume and change patterns, and attack detection and response records.

[0109] When a DDoS attack is detected, the operations center can provide real-time alerts to client companies. These alerts may include information regarding the occurrence of the DDoS attack and details related to immediate response. Alerts can be delivered in various ways. For example, the operations center can notify customers of the attack situation via methods such as email, SMS, or dashboard notifications.

[0110] Real-time alerts provided to clients may include information necessary for analysis and response, such as the time of the attack, the volume of attack traffic, and the location where the attack was detected. Clients can assess the network status through this information.

[0111] The present invention provides a system and method for responding to DDoS attacks, and implements an efficient defense mechanism capable of detecting large-scale attack traffic occurring on a network in real time and blocking it before it affects the customer network.

[0112] The present invention maximizes the stability of a customer network by detecting, filtering, and blocking DDoS attack traffic before it enters the customer network. This prevents unnecessary consumption of customer network resources and ensures continuous business operations without service interruption. In particular, it maintains the stability of customer services by preventing in advance problems such as network bandwidth exhaustion and server overload that may occur due to DDoS attacks.

[0113] This invention performs real-time detection of DDoS attacks and immediately alters the traffic route upon detection to prevent attack traffic from directly entering the customer network. By diverting traffic to DDoS defense equipment via a bypass route, abnormal attack traffic is blocked in real time, and only legitimate traffic is delivered to the customer network. This real-time response mechanism minimizes the impact of attack traffic on the network and enables rapid recovery.

[0114] This invention provides flexible DDoS defense tailored to the characteristics of each network by setting customized thresholds according to the nature of the customer network. For example, large-scale services generating massive traffic can have high thresholds set to prevent false positives of legitimate traffic, while smaller networks can use low thresholds to enable more sensitive detection. This allows for sophisticated protection based on the business importance of the network and contributes to ensuring business continuity.

[0115] The DDoS defense system of the present disclosure prevents business-critical traffic from being incorrectly blocked by directly delivering predetermined traffic to the customer network without filtering. This ensures business continuity and guarantees that critical traffic can be processed without interruption. This feature is essential for maintaining service stability and enhances network operational efficiency by minimizing false positives.

[0116] The present invention provides an automated security enhancement function capable of preparing for new attacks by recording security logs when a DDoS attack occurs and dynamically updating filtering rules based on them. This enables real-time response to changing attack patterns and allows for the continuous improvement of the defense system's performance. This automated security enhancement minimizes manual intervention by network administrators and contributes to establishing an efficient network defense system.

[0117] The present invention supports customers in quickly recognizing attack situations and formulating response strategies by generating a traffic analysis report from an operations center and providing real-time notifications to clients in the event of a DDoS attack. This report includes attack characteristics, traffic volume, and duration, enabling clients to take swift action based on accurate information. Furthermore, since network administrators can respond immediately through real-time notifications, service interruptions can be minimized.

[0118] This invention ensures business continuity and optimizes service performance by providing customized protection based on the business importance of the customer network. In particular, it enables the processing of normal traffic without delays in customer service, thereby maintaining customer satisfaction. This protection mechanism is particularly effective in services with high business sensitivity, such as finance, e-commerce, and real-time services.

[0120] FIG. 4 illustrates a brief and general schematic diagram of an exemplary computing environment in which embodiments of the present disclosure may be implemented.

[0121] Although the present disclosure has been described as generally being implementable by a computer device, those skilled in the art will understand that the present disclosure may be implemented in combination with computer-executable instructions and / or other program modules that can be executed on one or more computers and / or as a combination of hardware and software.

[0122] Generally, a program module includes routines, programs, components, data structures, etc., that perform a specific task or implement a specific abstract data type. Furthermore, those skilled in the art will be well aware that the method of the present disclosure may be implemented in other computer system configurations, including single-processor or multi-processor computer systems, minicomputers, mainframe computers, as well as personal computers, handheld computer devices, microprocessor-based or programmable consumer electronics, etc. (each of which may be connected to and operated with one or more associated devices).

[0123] The embodiments described in this disclosure may also be implemented in a distributed computing environment in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

[0124] Computers typically include various computer-readable media. Any medium accessible by a computer may be a computer-readable medium, and such computer-readable media include volatile and non-volatile media, transitory and non-transitory media, and removable and non-removable media. By example, but not limiting, computer-readable media may include computer-readable storage media and computer-readable transmission media. Computer-readable storage media include volatile and non-volatile media, transitory and non-transitory media, and removable and non-removable media implemented by any method or technique for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, DVD (digital video disk) or other optical disk storage devices, magnetic cassettes, magnetic tapes, magnetic disk storage devices or other magnetic storage devices, or any other media that can be accessed by a computer and used to store desired information.

[0125] Computer-readable transmission media typically include all information transmission media that implement computer-readable instructions, data structures, program modules, or other data, etc., on a modulated data signal, such as a carrier wave or other transport mechanism. The term modulated data signal means a signal in which one or more of the characteristics of the signal are set or modified to encode information within the signal. By example, not limiting, computer-readable transmission media include wired media, such as wired networks or direct-wired connections, and wireless media, such as acoustic, RF, infrared, and other wireless media. Any combination of the media described above is also considered to be within the scope of computer-readable transmission media.

[0126] An exemplary environment (1100) for implementing various aspects of the present disclosure, including a computer (1102), is shown, wherein the computer (1102) includes a processing unit (1104), system memory (1106), and a system bus (1108). The system bus (1108) connects system components, including system memory (1106) (but not limited thereto), to the processing unit (1104). The processing unit (1104) may be any processor among various commercial processors. Dual processor and other multiprocessor architectures may also be used as the processing unit (1104).

[0127] The system bus (1108) may be any of several types of bus structures that can be additionally interconnected to a local bus using any of the memory bus, peripheral bus, and various commercial bus architectures. System memory (1106) includes read-only memory (ROM) (1110) and random access memory (RAM) (1112). The basic input / output system (BIOS) is stored in non-volatile memory (1110), such as ROM, EPROM, EEPROM, etc., and this BIOS includes basic routines that help transfer information between components within the computer (1102) at times such as during startup. The RAM (1112) may also include high-speed RAM, such as static RAM, for caching data.

[0128] The computer (1102) also includes an internal hard disk drive (HDD) (1114) (e.g., EIDE, SATA)—this internal hard disk drive (1114) may also be configured for external use within a suitable chassis (not shown)—a magnetic floppy disk drive (FDD) (1116) (e.g., for reading from or writing to a removable diskette (1118)), and an optical disk drive (1120) (e.g., for reading from a CD-ROM disk (1122) or reading from or writing to other high-capacity optical media such as a DVD). The hard disk drive (1114), the magnetic disk drive (1116), and the optical disk drive (1120) may each be connected to the system bus (1108) by a hard disk drive interface (1124), a magnetic disk drive interface (1126), and an optical drive interface (1128). The interface (1124) for implementing an external drive includes at least one or both of USB (Universal Serial Bus) and IEEE 1394 interface technologies.

[0129] These drives and associated computer-readable media provide non-volatile storage of data, data structures, computer-executable instructions, etc. In the case of a computer (1102), the drives and media correspond to storing any data in a suitable digital format. Although the description of computer-readable media above refers to HDDs, removable magnetic disks, and removable optical media such as CDs or DVDs, those skilled in the art will know that other types of computer-readable media, such as zip drives, magnetic cassettes, flash memory cards, cartridges, etc., may also be used in exemplary operating environments and that any of these media may contain computer-executable instructions for performing the methods of the present disclosure.

[0130] A number of program modules, including an operating system (1130), one or more application programs (1132), other program modules (1134), and program data (1136), may be stored in the drive and RAM (1112). All or part of the operating system, application, module and / or data may also be cached in RAM (1112). It will be well known that the present disclosure may be implemented in various commercially available operating systems or combinations of operating systems.

[0131] The user can input commands and information into the computer (1102) through one or more wired / wireless input devices, such as a pointing device like a keyboard (1138) and a mouse (1140). Other input devices (not shown) may include a microphone, an IR remote control, a joystick, a game pad, a stylus pen, a touch screen, etc. These and other input devices are often connected to the processing unit (1104) via an input device interface (1142) connected to the system bus (1108), but may also be connected via other interfaces such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR interface, etc.

[0132] A monitor (1144) or other type of display device is also connected to the system bus (1108) via an interface such as a video adapter (1146). In addition to the monitor (1144), the computer generally includes other peripheral output devices (not shown), such as speakers, a printer, and so on.

[0133] The computer (1102) may operate in a networked environment using a logical connection to one or more remote computers, such as remote computer(s) (1148), via wired and / or wireless communication. The remote computer(s) (1148) may be a workstation, a computing device computer, a router, a personal computer, a portable computer, a microprocessor-based entertainment device, a peer device, or other conventional network node, and generally include many or all of the components described for the computer (1102), but for brevity, only the memory storage device (1150) is illustrated. The illustrated logical connection includes a wired / wireless connection to a local area network (LAN) (1152) and / or a larger network, e.g., a wide area network (WAN) (1154). Such LAN and WAN networking environments are common in offices and companies and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a global computer network, e.g., the Internet.

[0134] When used in a LAN networking environment, the computer (1102) is connected to a local network (1152) via a wired and / or wireless communication network interface or adapter (1156). The adapter (1156) may facilitate wired or wireless communication to the LAN (1152), and the LAN (1152) may also include a wireless access point installed therein to communicate with the wireless adapter (1156). When used in a WAN networking environment, the computer (1102) may include a modem (1158), be connected to a communication computing device on the WAN (1154), or have other means to establish communication through the WAN (1154), such as through the Internet. The modem (1158), which may be an internal or external and a wired or wireless device, is connected to the system bus (1108) via a serial port interface (1142). In a networked environment, the program modules described for the computer (1102) or parts thereof may be stored in a remote memory / storage device (1150). It will be well known that the illustrated network connection is exemplary and that other means of establishing a communication link between computers may be used.

[0135] The computer (1102) operates to communicate with any wireless device or object that is deployed and operated via wireless communication, for example, a printer, scanner, desktop and / or portable computer, PDA (portable data assistant), communication satellite, any equipment or place associated with a wireless detectable tag, and a telephone. This includes at least Wi-Fi and Bluetooth wireless technologies. Accordingly, the communication may be a predefined structure as in a conventional network, or simply ad hoc communication between at least two devices.

[0136] Wi-Fi (Wireless Fidelity) enables connectivity to the Internet and other sources without wires. Wi-Fi is a wireless technology, similar to a cell phone, that allows devices, such as computers, to transmit and receive data indoors and outdoors—that is, anywhere within the coverage area of ​​a base station. Wi-Fi networks use a wireless technology called IEEE 802.11 (a, b, g, etc.) to provide secure, reliable, and high-speed wireless connections. Wi-Fi can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 or Ethernet). Wi-Fi networks can operate in unlicensed 2.4 and 5 GHz wireless bands, for example, at data rates of 11 Mbps (802.11a) or 54 Mbps (802.11b), or in products that include both bands (dual band).

[0137] Those skilled in the art of the present disclosure will understand that information and signals may be represented using any various different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced in the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0138] Those skilled in the art will understand that the various exemplary logic blocks, modules, processors, means, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented by electronic hardware, various forms of programs or design code (referred to herein as software for convenience), or a combination of all such. To clearly illustrate this interoperability between hardware and software, various exemplary components, blocks, modules, circuits, and steps have been generally described above in relation to their functions. Whether such functions are implemented as hardware or software depends on the design constraints imposed on the specific application and the overall system. Those skilled in the art may implement the functions described in various ways for each specific application, but such implementation decisions should not be interpreted as being outside the scope of this disclosure.

[0139] The various embodiments presented herein may be implemented as methods, devices, or articles manufactured using standard programming and / or engineering techniques. The term "article manufactured" includes a computer program, a carrier, or a medium accessible from any computer-readable storage device. For example, computer-readable storage media include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic strips, etc.), optical discs (e.g., CDs, DVDs, etc.), smart cards, and flash memory devices (e.g., EEPROMs, cards, sticks, key drives, etc.). Additionally, the various storage media presented herein include one or more devices and / or other machine-readable media for storing information.

[0140] It should be understood that the specific order or hierarchy of steps in the presented processes is an example of exemplary approaches. It should be understood that the specific order or hierarchy of steps in the processes may be rearranged within the scope of this disclosure based on design priorities. The appended method claims provide elements of various steps in a sample order, but do not imply being limited to the specific order or hierarchy presented.

[0141] Description of the presented embodiments is provided so that a person skilled in the art may use or practice the present disclosure. Various modifications to these embodiments will be apparent to a person skilled in the art, and the general principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present disclosure is not limited to the embodiments presented herein, but should be interpreted in the broadest possible scope consistent with the principles and novel features presented herein.

Claims

Claim 1 A computer program stored on a computer-readable storage medium, wherein the computer program performs the following methods for responding to a Distributed Denial of Service (DDoS) attack, the method comprising: generating a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol from flow information collected from a backbone router; designating predetermined traffic that is not diverted to a DDoS defense device among traffic transmitted to a customer network based on at least one of traffic pre-configured by a customer and a learned normal traffic pattern of the collected flow information; sharing information regarding the predetermined traffic with the backbone router or the DDoS defense device; determining that it is a DDoS attack if the amount of traffic in the flow group exceeds a preset threshold within a certain period of time; and controlling the backbone router to divert the traffic of the flow group determined to be a DDoS attack to the DDoS defense device through a set path before being transmitted to the customer network, while ensuring that the predetermined traffic is transmitted to the customer network without diverting to the DDoS defense device. A computer program stored on a computer-readable storage medium, comprising the step of filtering and blocking DDoS attack traffic detected by the above DDoS defense equipment and transmitting normal traffic to the above customer network. Claim 2 A computer program stored on a computer-readable storage medium, wherein, in claim 1, the step of generating the flow group comprises the step of generating the flow group by classifying traffic data based on a Netmask and grouping them into 24-bit or 32-bit subnet units. Claim 3 A computer program stored on a computer-readable storage medium, wherein the threshold value in claim 1 is set based on the normal traffic pattern of the customer network and is adjusted according to normal traffic fluctuations of the customer network. Claim 4 In claim 1, the threshold value is a computer program stored on a computer-readable storage medium, which divides the traffic of the customer network into predetermined time units and is independently set for each time unit according to the traffic for each time unit. Claim 5 In claim 4, the threshold is a computer program stored on a computer-readable storage medium, wherein the maximum traffic value recorded in each time zone is set as the threshold for that time zone based on the analysis of traffic data for a predetermined period for each time zone of the customer network. Claim 6 In claim 1, the threshold value is a computer program stored on a computer-readable storage medium, which is set differently depending on the nature of the customer network. Claim 7 A computer program stored on a computer-readable storage medium, wherein, in claim 1, the step of controlling the backbone router comprises the step of diverting traffic determined to be a DDoS attack from the backbone router to the IDC provider's DDoS defense equipment so that the diverted traffic passes through the DDoS defense equipment and is transmitted to the customer network through a customer switch. Claim 8 A computer program stored on a computer-readable storage medium, wherein the step of controlling the backbone router comprises the step of diverting traffic to a DDoS defense device determined according to the protocol or amount of traffic of the traffic. Claim 9 In claim 7, the step of controlling the backbone router is a computer program stored on a computer-readable storage medium, which is performed according to the routing control of the backbone router of the operation center. Claim 10 A computer program stored on a computer-readable storage medium, further comprising, in claim 9, the step of the operation center controlling the backbone router so that traffic is transmitted to the normal path to the customer network after the DDoS attack has ended. Claim 11 In claim 1, the DDoS defense equipment is a computer program stored on a computer-readable storage medium that compares traffic with a preset DDoS attack pattern, blocks traffic matching the DDoS attack pattern, and transmits normal traffic to a customer network. Claim 12 In claim 1, the DDoS defense equipment is a computer program stored on a computer-readable storage medium that blocks DDoS attack traffic and transmits normal traffic to a customer network by filtering traffic through protocol-specific analysis of the traffic and applying filtering rules differently for each protocol. Claim 13 In claim 1, the DDoS defense equipment is a computer program stored on a computer-readable storage medium that records DDoS attack traffic in a security log and updates filtering rules based on the recorded DDoS attack traffic. Claim 14 delete Claim 15 A computer program stored on a computer-readable storage medium, further comprising the step of generating a traffic analysis report and providing real-time notifications to a client company in the event that a DDoS attack occurs in claim 1. Claim 16 A method for responding to a DDoS attack, comprising: generating a flow group based on a 5-tuple including a source IP, a destination IP, a source port, a destination port, and a protocol in flow information collected from a backbone router; designating predetermined traffic that is not bypassed by a DDoS defense device among traffic transmitted to a customer network based on at least one of traffic pre-configured by a customer and a learned normal traffic pattern of the collected flow information; sharing information regarding the predetermined traffic with the backbone router or the DDoS defense device; determining that it is a DDoS attack if the amount of traffic in the flow group exceeds a preset threshold within a certain period of time; controlling the backbone router to bypass the traffic of the flow group determined to be a DDoS attack to the DDoS defense device through a set path before being transmitted to the customer network, while ensuring that the predetermined traffic is transmitted to the customer network without bypassing to the DDoS defense device; and filtering and blocking the DDoS attack traffic detected by the DDoS defense device and transmitting normal traffic to the customer network. Claim 17 As a computer device, one or more processors; and memory for storing instructions executable on the one or more processors; wherein the one or more processors generate a flow group based on a 5-tuple including a source IP, destination IP, source port, destination port, and protocol from flow information collected from a backbone router, designate predetermined traffic that is not diverted to a DDoS defense device among the traffic transmitted to the customer network based on at least one of traffic pre-configured by the customer and a learned normal traffic pattern of the collected flow information, share information regarding the predetermined traffic with the backbone router or the DDoS defense device, and if the amount of traffic of the flow group exceeds a preset threshold within a certain period of time, determine it to be a DDoS attack, divert the traffic of the flow group determined to be a DDoS attack to the DDoS defense device through a set path before being transmitted to the customer network, but control the backbone router so that the predetermined traffic is transmitted to the customer network without diverting to the DDoS defense device, and filter and block the DDoS attack traffic detected by the DDoS defense device and transmit normal traffic to the customer network A computer device that transmits.

Images