CN110661763A - DDoS reflection attack defense method, device and equipment - Google Patents

Abstract

The application provides a DDoS reflection attack defense method, a device and equipment thereof, wherein the method comprises the following steps: determining whether DDoS reflection attack aiming at the specified service type occurs according to the quantity difference between the response data packet of the specified service type and the request data packet of the specified service type; and if so, discarding the response data packet for the specified service type. Through the technical scheme of the application, a more reliable defense mode aiming at DDoS reflection attack is provided, and the problem of a large number of DDoS reflection attacks can be solved.

Description

DDoS reflection attack defense method, device and equipment

Technical Field

The present application relates to the field of internet technologies, and in particular, to a method, an apparatus, and a device for defending against DDoS (Distributed Denial of Service) reflection attacks.

Background

DDoS attacks refer to: by means of client/server technology, several computers are combined to serve as an attack platform and DDoS attack is performed on the attacked, so that the power of denial of service attack is increased exponentially. DDoS reflection attacks refer to: aiming at a server which is open for some services in the Internet, an attacker sends a request message to the server by forging the address of the attacked, triggers the server to send a response message aiming at the request message to the attacked, and can trigger the server to send a large amount of response messages to the attacked when the attacker sends a large amount of request messages to the server, thereby carrying out DDoS reflection attack on the attacked.

DDoS attacks differ from DDoS reflection attacks in that: DDoS attacks are attacks directly by attackers on attackers, whereas DDoS reflection attacks are attacks by attackers on attackers by means of servers.

At present, a defense mode aiming at DDoS attack already exists, but a defense mode aiming at DDoS reflection attack does not exist, and a more reliable defense mode aiming at DDoS reflection attack needs to be provided.

Disclosure of Invention

The application provides a DDoS reflection attack defense method, which comprises the following steps:

determining whether DDoS reflection attack aiming at the specified service type occurs according to the quantity difference between the response data packet of the specified service type and the request data packet of the specified service type;

and if so, discarding the response data packet for the specified service type.

The application provides a DDoS reflection attack defense method, which comprises the following steps:

monitoring a response data packet of a specified service type and a request data packet of the specified service type of the host;

determining whether DDoS reflection attack aiming at the specified service type occurs according to the quantity difference between the response data packet of the specified service type and the request data packet of the specified service type;

and if so, performing current limiting processing on the response data packet of the specified service type sent to the host.

The application provides a DDoS reflection attack defense device, include:

the determining module is used for determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the response data packet of the specified service type and the request data packet of the specified service type;

and the processing module is used for discarding the response data packet aiming at the specified service type when the determining module determines that the DDoS reflection attack aiming at the specified service type occurs.

The application provides a DDoS reflection attack defense device, include:

the monitoring module is used for monitoring a response data packet and a request data packet of a specified service type of the host;

a determining module, configured to determine whether a DDoS reflection attack aiming at the specified service type occurs according to a difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type;

and the processing module is used for performing flow limiting processing on a response data packet of the specified service type sent to the host when the determined result is that the DDoS reflection attack aiming at the specified service type occurs.

The application provides a DDoS reflection attack defense equipment, includes: a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor; the processor is configured to execute machine-executable instructions to perform the method steps described above.

Based on the technical scheme, in the embodiment of the application, whether the DDoS reflection attack aiming at the specified service type occurs or not can be determined according to the difference between the number of the response data packet of the specified service type and the number of the request data packet of the specified service type, and the response data packet aiming at the specified service type is discarded when the DDoS reflection attack aiming at the specified service type occurs, so that a more reliable defense mode aiming at the DDoS reflection attack is provided, the problem of a large number of DDoS reflection attacks can be solved, and an effective defense mode is provided.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments of the present application or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art according to the drawings of the embodiments of the present application.

FIG. 1 is a schematic diagram of an application scenario in an embodiment of the present application;

FIG. 2 is a flow chart of a DDoS reflection attack defense method in one embodiment of the present application;

fig. 3 is a flowchart of a DDoS reflection attack defense method in another embodiment of the present application;

fig. 4 is a block diagram of a DDoS reflection attack defense apparatus according to an embodiment of the present application;

fig. 5 is a block diagram of a DDoS reflection attack defense apparatus according to another embodiment of the present application.

Detailed Description

The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein is meant to encompass any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present application. Depending on the context, moreover, the word "if" as used may be interpreted as "at … …" or "when … …" or "in response to a determination".

An embodiment of the present application provides a DDoS reflection attack defense method, which is shown in fig. 1 and is an application scenario diagram of the embodiment of the present application. The host may be a VM (Virtual Machine), a PC (Personal Computer), a terminal device, or the like, and may be used to provide a cloud service, and the type of the host is not limited, and the host is an attack target of an attacker. The ingress device is a device that introduces traffic into the host, where the traffic of the host needs to reach the Internet through the ingress device, and the traffic of the Internet needs to reach the host through the ingress device, which is not limited to the type of the ingress device, for example, the ingress device may be an ingress device of an IDC (Internet data center) room, and at this time, each host is a host of the IDC room. The server is configured to provide a service, and if the server is a DNS (Domain Name System) server, the server is configured to provide the DNS service, and if the server is an NTP (Network Time Protocol) server, the server is configured to provide the NTP service, and the type of the server is not limited.

Referring to fig. 1, the solid line may be the packet direction of DDoS reflection attack, and the dotted line may be the packet direction of normal traffic. Specifically, in order to launch a DDoS reflection attack, an attacker may forge an address of a host and send a request packet to a server, where a source address of the request packet is the address of the host, and based on this, the server may send a response packet to the request packet to the host after receiving the request packet. In addition, in order to initiate normal traffic, the host may also send a request packet to the server, where a source address of the request packet is an address of the host, and based on this, the server may send a response packet to the request packet to the host after receiving the request packet.

As can be seen from fig. 1, for normal traffic, the host receives one response packet every time it sends one request packet, i.e. the number of request packets is the same as the number of response packets. For DDoS reflection attack, the host does not send a request data packet, but receives a response data packet, that is, when an attacker initiates DDoS reflection attack on the host, the host does not send a request data packet, but receives a large number of response data packets.

Based on the characteristics of DDoS reflection attack, when a host computer has DDoS reflection attack, the number of response packets is greater than the number of request packets. Based on the principle, in the embodiment of the application, whether the DDoS reflection attack occurs can be determined according to the difference between the number of the response data packets and the number of the request data packets.

In one example, a host may provide multiple service types, some of which may be subject to DDoS reflection attacks and some of which may not be subject to DDoS reflection attacks, and thus, a service type in which a DDoS reflection attack may occur may be referred to as a designated service type, and a service type in which a DDoS reflection attack does not occur may be referred to as a non-designated service type. Wherein the specified service type may include, but is not limited to: PORTMAP (port mapper), NTP, SSDP (simple service Discovery Protocol), etc., which are just examples, and The specified service type may further include DNS, BitTorrent (bit stream), RIP (Routing information Protocol), CharGEN (Character Generator Protocol), QOTD (query Of The Day), NetBIOS (Network Basic Input Output System), etc., and The specified service type is not limited.

In one example, the host may provide a plurality of specified service types, and the processing flow of each specified service type is the same, so for convenience of description, a specified service type is taken as an example to be described later.

In the above application scenario, referring to fig. 2, a flowchart of a DDoS reflection attack defense method provided in an embodiment of the present application is shown, where the method may be applied to a host, and the method may include:

step 201, determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type. If yes, namely a DDoS reflection attack occurs for the specified service type, executing step 202; if not, that is, DDoS reflection attack does not occur for the specified service type, the conventional flow processing is adopted, and no limitation is made on the conventional flow processing.

In one example, based on the difference between the number of response packets of a specified service type and the number of request packets of the specified service type, if the number of response packets is determined to be greater than the number of request packets, it may be determined that a DDoS reflection attack is occurring for the specified service type.

Wherein, determining whether a DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type may include:

the first method is to count the number of response data packets of a specified service type and the number of request data packets of the specified service type, and obtain the number difference between the number of response data packets and the number of request data packets. If the number difference is greater than a preset first threshold value, it may be determined that a DDoS reflection attack for the specified service type occurs. For example, the host may create the status array shown in table 1, and the host may monitor the request packet sent by the host and the response packet received by the host. The host adds 1 to the number of response packets corresponding to the SSDP each time the host receives a response packet of the SSDP, and adds 1 to the number of request packets corresponding to the SSDP each time the host sends a request packet of the SSDP. Similarly, the host adds 1 to the number of response packets corresponding to the NTP each time the host receives a response packet of the NTP, and adds 1 to the number of request packets corresponding to the NTP each time the host sends a request packet of the NTP. And so on.

TABLE 1

Specifying service types	Number of response packets	Number of request packets
			SSDP	100	20
NTP	20	20
			PORTMAP	10	10

Based on the status array, the host may count the number of response packets of SSDP 100, the number of request packets of SSDP 20, and the difference between the number of response packets and the number of request packets is 80. In addition, the host may count the number 20 of response packets of the NTP and the number 20 of request packets of the NTP, and the difference between the number of response packets and the number of request packets is 0. The host can also count the number 10 of response packets of PORTMAP, the number 10 of request packets of PORTMAP, and the difference between the number of response packets and the number of request packets is 0.

In one example, the preset first threshold may be configured empirically, and the configuration is not limited. For example, if the preset first threshold is an integer greater than 0, for example, the preset first threshold is 5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number difference of the SSDPs is 80, it is determined that a DDoS reflection attack against the SSDPs occurs.

In a second mode, when a response data packet of a specified service type is obtained, the number of states corresponding to the specified service type can be added by 1; when the request packet of the specified service type is obtained, the number of states corresponding to the specified service type may be decremented by 1. Further, the state number corresponding to the specified service type can be determined; if the number of states is greater than a preset second threshold, it may be determined that a DDoS reflection attack occurs for the specified service type. For example, the host may create the status array shown in table 2, and the host may monitor the request packets sent by the host and the response packets received by the host. Further, the host may add 1 to the number of states corresponding to the SSDP each time the host receives a response packet of the SSDP, and may subtract 1 from the number of states corresponding to the SSDP each time the host sends a request packet of the SSDP. Similarly, the host may add 1 to the number of states corresponding to the NTP each time a response packet of the NTP is received, and the host may subtract 1 from the number of states corresponding to the NTP each time a request packet of the NTP is sent. And so on.

TABLE 2

Specifying service types	Number of states
		SSDP	80
NTP	0
		PORTMAP	0

Based on this status array, the host adds 1 to the number of statuses corresponding to SSDP each time it receives a response packet of SSDP, and subtracts 1 from the number of statuses corresponding to SSDP each time it sends a request packet of SSDP, so that the number of statuses 80 corresponding to SSDP means that the difference in number between the number of response packets and the number of request packets is 80. Similarly, the NTP corresponds to a status number of 0, which means that the difference between the number of response packets and the number of request packets is 0. The number of states corresponding to the PORTMAP, 0, indicates that the difference between the number of response packets and the number of request packets is 0. And so on.

In an example, the preset second threshold may be configured empirically, and the configuration is not limited. For example, if the preset second threshold is an integer greater than 0, for example, the preset second threshold is 5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number of states of the SSDP is 80, it is determined that DDoS reflection attack against the SSDP occurs.

In a third mode, when a response data packet of the specified service type is obtained, the number of states corresponding to the specified service type can be reduced by 1; when the request packet of the specified service type is obtained, the number of states corresponding to the specified service type may be increased by 1. Further, the state number corresponding to the specified service type can be determined; if the number of states is smaller than a preset third threshold, it may be determined that a DDoS reflection attack for the specified service type occurs. For example, the host may create the status array shown in table 3, and the host may monitor the request packets sent by the host and the response packets received by the host. Further, the host may subtract 1 from the number of states corresponding to the SSDP each time the host receives a response packet of the SSDP, and the host may add 1 to the number of states corresponding to the SSDP each time the host sends a request packet of the SSDP. Similarly, the host may subtract 1 from the number of states corresponding to the NTP each time the host receives a response packet of the NTP, and may add 1 to the number of states corresponding to the NTP each time the host sends a request packet of the NTP. And so on.

TABLE 3

Specifying service types	Number of states
		SSDP	-80
NTP	0
		PORTMAP	0

Based on this status array, the host decrements the number of statuses for SSDP by 1 each time it receives a response packet for SSDP, and increments the number of statuses for SSDP by 1 each time it sends a request packet for SSDP, so that the number of statuses for SSDP of-80 indicates that the difference in number between the number of response packets and the number of request packets is 80. Similarly, the NTP corresponds to a status number of 0, which means that the difference between the number of response packets and the number of request packets is 0. The number of states corresponding to the PORTMAP, 0, indicates that the difference between the number of response packets and the number of request packets is 0. And so on.

In an example, the preset third threshold may be configured empirically, and the configuration is not limited. For example, if the preset third threshold is an integer smaller than 0, and if the preset third threshold is-5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number of states of the SSDP is-80, it is determined that DDoS reflection attack against the SSDP occurs.

In the first, second, and third modes, according to the actual situation, it may also be determined that DDoS reflection attacks for the specified service type do not occur, which is not limited to this, for example, in the second mode, since the number of states of the NTP is 0, it may be determined that DDoS reflection attacks for the NTP do not occur.

In the first, second, and third modes, the request packet may carry information of a specific service type, and the host may determine the specific service type corresponding to the request packet based on the information, and then monitor that the host sends the request packet of the specific service type, which is not described in detail herein. The response data packet may carry information of a specified service type, and the host may determine the specified service type corresponding to the response data packet based on the information, and then monitor that the host receives the response data packet of the specified service type, which is not described in detail herein.

At step 202, the response packet for the specified service type is discarded. For example, when the host determines that a DDoS reflection attack against SSDP has occurred, then the response packet against SSDP may be dropped.

In one example, the process for "dropping response packets for the specified service type" may include, but is not limited to, the following: when the host receives the response data packet, the host determines the service type of the response data packet. And if the service type is the specified service type in which the DDoS reflection attack has already occurred, discarding the response data packet. For example, the host, upon receiving a response packet, determines the service type of the response packet. If the service type is SSDP, the response packet is discarded and is not processed any more.

In one example, if the service type is a specific service type (a specific service type in which DDoS reflection attack has occurred/a specific service type in which DDoS reflection attack has not occurred), the host may further add 1 to the number of response packets of the specific service type; for the second mode, the host may also add 1 to the number of states of the specified service type; for approach three, the host may also decrement the number of states for the specified service type by 1.

In one example, upon receipt of a response packet by the host, the host may also parse the destination IP address from the response packet before determining the service type of the response packet. If the destination IP address is not the IP address of the host, the response data packet is directly discarded, and the service type of the response data packet is not determined any more. Optionally, if the destination IP address is the IP address of the host, the service type of the response packet is determined, and then the above steps are performed to further determine whether to discard the response packet, which is not described herein again.

In one example, after determining that a DDoS reflection attack for a specified service type occurs, the host may further send, to the ingress device, a message carrying the specified service type, where the message is used to enable the ingress device to perform flow limiting processing on a response packet of the specified service type sent to the host.

For example, after determining that a DDoS reflection attack against SSDP occurs, the host may also send a message carrying SSDP to the ingress device. When receiving the message, the ingress device parses the SSDP from the message and performs a current limiting process, such as 50% current limiting, on the SSDP response packet sent to the host.

That is, the ingress device receives 100 response packets of SSDP that need to be sent to the host within a preset time (e.g. 1 minute), and only 50 response packets of the received response packets are sent to the host, and the other 50 response packets are discarded, so that the number of response packets sent to the host can be reduced.

In the above embodiment, the response packet may be a response packet based on UDP (User Datagram Protocol); the request packet may be a UDP-based request packet.

In the above embodiment, after determining that a DDoS reflection attack for a specific service type occurs, the host may further set a timer for the specific service type, and the aging time of the timer is configured empirically. The host discards the response packet for the specified service type before the timer expires. After the timer expires, the host may clear the statistics for the specified service type (e.g., the number of response packets, the number of request packets, and the number of states in table 2 or table 3 in table 1), and then, the host may re-determine whether a DDoS reflection attack for the specified service type occurs in step 201, and so on.

In an example, Netfilter may be deployed in the host, and the DDoS reflection attack defense method is implemented by Netfilter, but Netfilter is only an example, and the implementation manner is not limited.

Netfilter is a Linux-based kernel firewall framework, and can implement many functions in security policy application, such as packet filtering, packet processing, address masquerading, transparent proxy, dynamic network address translation, MAC address-based filtering, state-based filtering, packet rate limiting, and the like. On the basis of the functions, the DDoS reflection attack defense method can be realized through Netfilter.

Based on the technical scheme, in the embodiment of the application, whether the DDoS reflection attack aiming at the specified service type occurs or not can be determined according to the difference between the number of the response data packet of the specified service type and the number of the request data packet of the specified service type, and the response data packet aiming at the specified service type is discarded when the DDoS reflection attack aiming at the specified service type occurs, so that a more reliable defense mode aiming at the DDoS reflection attack is provided, the problem of a large number of DDoS reflection attacks can be solved, and an effective defense mode is provided.

Referring to fig. 3, a flowchart of a DDoS reflection attack defense method proposed in an embodiment of the present application is shown, where the method may be applied to an ingress device (e.g., an ingress device of an IDC room), and the method may include:

step 301, monitoring response data packets and request data packets of the specified service types of the host.

The inlet device can be connected with a plurality of hosts, and for each host, the inlet device can monitor response data packets and request data packets of the specified service types of the host. Since the processing flow for each host is the same, for convenience of description, the processing flow for one host will be described as an example.

Step 302, according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type, determining whether DDoS reflection attack aiming at the specified service type occurs. If yes, namely DDoS reflection attack happens to the specified service type, executingstep 303; if not, that is, DDoS reflection attack does not occur for the specified service type, the conventional flow processing is adopted, and no limitation is made on the conventional flow processing.

In one example, based on the difference between the number of response packets of a specified service type and the number of request packets of the specified service type, if the number of response packets is determined to be greater than the number of request packets, it may be determined that a DDoS reflection attack is occurring for the specified service type.

Wherein, determining whether a DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type may include:

the first method is to count the number of response data packets of a specified service type and the number of request data packets of the specified service type, and obtain the number difference between the number of response data packets and the number of request data packets. If the number difference is greater than a preset first threshold value, it may be determined that a DDoS reflection attack for the specified service type occurs. For example, the ingress device may create a status array as shown in table 4, and the ingress device may monitor for request packets sent by each host, and response packets received by each host. For example, each time the host receives a response packet of the SSDP, the number of response packets corresponding to the SSDP of the host may be increased by 1, and each time the host sends a request packet of the SSDP, the number of request packets corresponding to the SSDP of the host may be increased by 1. Similarly, each time the host receives a response packet of the NTP, the number of response packets corresponding to the NTP of the host is increased by 1, and each time the host sends a request packet of the NTP, the number of request packets corresponding to the NTP of the host is increased by 1. And so on.

TABLE 4

Based on the status array, the ingress device counts the number of response packets 100 for SSDP of host a, the number of request packets 20 for SSDP, and the difference in number between the number of response packets and the number of request packets is 80. Further, the number 20 of response packets of the NTP of the host a and the number 20 of request packets of the NTP are counted, and the difference in number between the number of response packets and the number of request packets is 0. The number 10 of response packets of PORTMAP of the host A and the number 10 of request packets of PORTMAP are counted, and the difference between the number of response packets and the number of request packets is 0.

In one example, the preset first threshold may be configured empirically, and the configuration is not limited. For example, if the preset first threshold is an integer greater than 0, for example, the preset first threshold is 5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number difference of the SSDPs is 80, it is determined that a DDoS reflection attack against the SSDPs occurs.

In a second mode, when a response data packet of a specified service type is obtained, the number of states corresponding to the specified service type can be added by 1; when the request packet of the specified service type is obtained, the number of states corresponding to the specified service type may be decremented by 1. Further, the state number corresponding to the specified service type can be determined; if the number of states is greater than a preset second threshold, it may be determined that a DDoS reflection attack occurs for the specified service type. For example, the ingress device may create a status array as shown in table 5 and monitor each host for request packets sent and each host for response packets received. For example, the number of states corresponding to the SSDP of the host may be increased by 1 each time the host receives a response packet of the SSDP, and the number of states corresponding to the SSDP of the host may be decreased by 1 each time the host transmits a request packet of the SSDP. Similarly, the state number corresponding to the NTP of the host is incremented by 1 each time the host receives a response packet of the NTP, and the state number corresponding to the NTP of the host is decremented by 1 each time the host sends a request packet of the NTP. And so on.

TABLE 5

Based on this status array, the host adds 1 to the number of statuses corresponding to SSDP each time it receives a response packet of SSDP, and subtracts 1 from the number of statuses corresponding to SSDP each time it sends a request packet of SSDP, so that the number of statuses 80 corresponding to SSDP means that the difference in number between the number of response packets and the number of request packets is 80. Similarly, the NTP corresponds to a status number of 0, which means that the difference between the number of response packets and the number of request packets is 0. The number of states corresponding to the PORTMAP, 0, indicates that the difference between the number of response packets and the number of request packets is 0. And so on.

In an example, the preset second threshold may be configured empirically, and the configuration is not limited. For example, if the preset second threshold is an integer greater than 0, for example, the preset second threshold is 5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number of states of the SSDP is 80, it is determined that DDoS reflection attack against the SSDP occurs.

In a third mode, when a response data packet of the specified service type is obtained, the number of states corresponding to the specified service type can be reduced by 1; when the request packet of the specified service type is obtained, the number of states corresponding to the specified service type may be increased by 1. Further, the state number corresponding to the specified service type can be determined; if the number of states is smaller than a preset third threshold, it may be determined that a DDoS reflection attack for the specified service type occurs. For example, the ingress device may create a status array as shown in table 6 and monitor each host for request packets sent and each host for response packets received. For example, the number of states corresponding to the SSDP of the host may be decremented by 1 each time the host receives a response packet of the SSDP, and the number of states corresponding to the SSDP of the host may be incremented by 1 each time the host transmits a request packet of the SSDP. Similarly, the number of states corresponding to the NTP of the host is decremented by 1 each time the host receives a response packet of the NTP, and the number of states corresponding to the NTP of the host is incremented by 1 each time the host sends a request packet of the NTP. And so on.

TABLE 6

Based on this status array, the number of statuses corresponding to SSDP is decremented by 1 each time the host receives a response packet of SSDP, and the number of statuses corresponding to SSDP is incremented by 1 each time the host transmits a request packet of SSDP, so that the-80 number of statuses corresponding to SSDP indicates that the difference in number between the number of response packets and the number of request packets is 80. Similarly, the NTP corresponds to a status number of 0, which means that the difference between the number of response packets and the number of request packets is 0. The number of states corresponding to the PORTMAP, 0, indicates that the difference between the number of response packets and the number of request packets is 0. And so on.

In an example, the preset third threshold may be configured empirically, and the configuration is not limited. For example, if the preset third threshold is an integer smaller than 0, and if the preset third threshold is-5, which indicates that the number of response packets is 5 more than the number of request packets, it is considered that the DDoS reflection attack occurs.

Since the number of states of the SSDP is-80, it is determined that DDoS reflection attack against the SSDP occurs.

In the first, second, and third modes, according to the actual situation, it may also be determined that DDoS reflection attacks for the specified service type do not occur, which is not limited to this, for example, in the second mode, since the number of states of the NTP is 0, it may be determined that DDoS reflection attacks for the NTP do not occur.

In the first, second, and third modes, the request packet may carry information of a specified service type, and the ingress device may determine the specified service type corresponding to the request packet based on the information, and then monitor that the host sends the request packet of the specified service type, which is not described herein again. The response data packet may carry information of a specified service type, and the ingress device may determine, based on the information, a specified service type corresponding to the response data packet, and then monitor that the host receives the response data packet of the specified service type, which is not described herein again.

Step 303, performing a current limiting process on the response packet of the specified service type sent to the host.

For example, when the ingress device determines that host a has a DDoS reflection attack on the SSDP, the ingress device may perform flow limiting processing on a response packet of the SSDP sent to host a.

For example, assuming that the current limit policy is 50% current limit, the ingress device may send 50% of the response packet to host a. Assuming that 100 response packets of SSDP that need to be sent to the host a are received within a preset time (e.g., 1 minute), the ingress device only sends 50 response packets to the host a, and the other 50 response packets are discarded, thereby reducing the number of response packets sent to the host a.

In one example, the process for "the ingress device performs the throttling processing on the response packet of the specified service type sent to the host" may include, but is not limited to, the following ways: counting the number of response data packets of the specified service type to be sent to the host; determining the flow intervals to which the quantity belongs, and determining the flow limiting level corresponding to the flow intervals; and performing current limiting processing on the response data packet based on the current limiting level.

For example, the inlet device may create a mapping table shown in table 7, which is used to record the correspondence between the flow rate intervals and the flow limit levels, where the flow limit level 1 represents 30% of the flow limit, the flow limit level 2 represents 50% of the flow limit, the flow limit level 3 represents 70% of the flow limit, and the flow limit level 4 represents 90% of the flow limit.

TABLE 7

Interval of flow	Level of current limiting
		Flow interval (0, 100)]	Current limiting level 1
Flow interval (100, 300)]	Current limiting level 2
		Flow interval (300,800)]	Current limiting level 3
Flow interval (800,10000)]	Current limiting level 4

The ingress device may count the number of SSDP response packets, e.g., 1000, to be sent to the host a within a preset time (e.g., 1 minute). Then, it may be determined that the number of traffic intervals to which the 1000 belongs is a traffic interval (800,10000), and it may be determined that the throttling level 4 corresponding to the traffic interval represents 90% throttling, and thus, the ingress device may transmit 10% of the response packets to the host a, that is, the throttling portion reaches 90%.

In one example, the host may further send a message carrying a specified service type to the ingress device, where the message is used to enable the ingress device to perform flow limiting processing on a response packet of the specified service type sent to the host. Based on this, the ingress device may parse the specified service type from the message when receiving the message, and perform the current limiting process on the response packet of the specified service type sent to the host.

In the above embodiment, the response packet may be a response packet based on UDP (User Datagram Protocol); the request packet may be a UDP-based request packet.

In the above embodiment, after determining that a DDoS reflection attack for a specified service type occurs, the ingress device may further set a timer for the specified service type of the host, where an aging time of the timer is configured empirically. Before the timer is over, the inlet device performs the current limiting process on the response data packet of the specified service type sent to the host. After the timer expires, the ingress device may clear the statistics of the specified service type for the host (e.g., the number of response packets, the number of request packets, and the number of states in table 5 or table 6 in table 4), and then the ingress device may re-determine whether a DDoS reflection attack for the specified service type occurs, usingsteps 301 and 302, and so on.

In an example, Netfilter may be deployed in the entrance device, and the DDoS reflection attack defense method is implemented by Netfilter, but Netfilter is only an example, and the implementation manner is not limited.

Based on the technical scheme, in the embodiment of the application, whether the DDoS reflection attack aiming at the specified service type occurs or not can be determined according to the difference between the number of the response data packet of the specified service type and the number of the request data packet of the specified service type, and the response data packet of the specified service type sent to the host is subjected to flow limiting processing when the DDoS reflection attack occurs, so that a more reliable defense mode aiming at the DDoS reflection attack is provided, the problem of a large number of DDoS reflection attacks can be solved, and an effective defense mode is provided.

Based on the same application concept as the method, an embodiment of the present application further provides a DDoS reflection attack defense device, which is applied to a host, and is a structural diagram of the DDoS reflection attack defense device, as shown in fig. 4.

A determining module 401, configured to determine whether a DDoS reflection attack aiming at a specified service type occurs according to a difference between a number of response data packets of the specified service type and a number of request data packets of the specified service type;

a processing module 402, configured to discard the response data packet for the specified service type when the determining module determines that the DDoS reflection attack for the specified service type occurs.

The determining module 401 is specifically configured to count the number of response packets of a specified service type and the number of request packets of the specified service type, and obtain a number difference between the number of response packets and the number of request packets; if the quantity difference is larger than a preset first threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; or when a response data packet of the specified service type is obtained, adding 1 to the state number corresponding to the specified service type; when a request data packet of a specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type; determining the state number corresponding to the specified service type; if the number of states is larger than a preset second threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; wherein the preset second threshold is an integer greater than 0; or, when obtaining the response data packet of the specified service type, subtracting 1 from the state number corresponding to the specified service type; when a request data packet of a specified service type is obtained, adding 1 to the state number corresponding to the specified service type; determining the state number corresponding to the specified service type; if the number of states is smaller than a preset third threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; wherein the preset third threshold is an integer smaller than 0.

The processing module 402 is specifically configured to, in a process of discarding a response packet for the specified service type, determine a service type of the response packet when the response packet is received; and if the service type is the specified service type in which the DDoS reflection attack has already occurred, discarding the response data packet.

The processing module 402 is further configured to parse a destination IP address from the response packet; and if the destination IP address is not the IP address of the host, discarding the response data packet.

Based on the same application concept as the method, the embodiment of the present application further provides a DDoS reflection attack defense device, which is applied to an ingress device, and as shown in fig. 5, is a structure diagram of the device.

A monitoring module 501, configured to monitor a response packet and a request packet of a specified service type of a host;

a determining module 502, configured to determine whether a DDoS reflection attack aiming at the specified service type occurs according to a difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type;

a processing module 503, configured to perform, when the determination result is that a DDoS reflection attack for the specified service type occurs, flow limiting processing on a response data packet of the specified service type sent to the host.

In an example, the determining module 502 is specifically configured to count the number of response packets of the specified service type and the number of request packets of the specified service type, and obtain a difference between the number of response packets and the number of request packets; if the quantity difference is larger than a preset first threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; or, when the response data packet of the specified service type is obtained, adding 1 to the state number corresponding to the specified service type; when the request data packet of the specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type; determining the number of states corresponding to the specified service type, and if the number of states is greater than a preset second threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; wherein the preset second threshold is an integer greater than 0; or, when obtaining the response data packet of the specified service type, subtracting 1 from the state number corresponding to the specified service type; when the request data packet of the specified service type is obtained, adding 1 to the state number corresponding to the specified service type; determining the number of states corresponding to the specified service type, and if the number of states is smaller than a preset third threshold value, determining that DDoS reflection attack aiming at the specified service type occurs; wherein the preset third threshold is an integer smaller than 0.

The processing module 503 is specifically configured to count the number of response data packets of the specified service type to be sent to the host in a process of performing flow limiting processing on the response data packets of the specified service type sent to the host; determining the flow intervals to which the quantity belongs, and determining the flow limiting level corresponding to the flow intervals; and performing current limiting processing on the response data packet based on the current limiting level.

Based on the same application concept as the method, the embodiment of the present application provides a DDoS reflection attack defense device (such as the above-mentioned host or ingress device), including a processor and a machine-readable storage medium, where the machine-readable storage medium stores machine-executable instructions capable of being executed by the processor; the processor is used for executing machine executable instructions to realize the DDoS reflection attack defense method.

Based on the same application concept as the method, embodiments of the present application further provide a machine-readable storage medium, where a plurality of computer instructions are stored, and when executed, the computer instructions implement the DDoS reflection attack defense method.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may take the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

Furthermore, these computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims (16)

1. A DDoS reflection attack defense method is characterized by comprising the following steps:

determining whether DDoS reflection attack aiming at the specified service type occurs according to the quantity difference between the response data packet of the specified service type and the request data packet of the specified service type;

and if so, discarding the response data packet for the specified service type.

2. The method of claim 1,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

counting the number of response data packets of a specified service type and the number of request data packets of the specified service type, and obtaining the number difference between the number of response data packets and the number of request data packets;

and if the quantity difference is larger than a preset first threshold value, determining that the DDoS reflection attack aiming at the specified service type occurs.

3. The method of claim 1,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

adding 1 to the state number corresponding to the specified service type when the response data packet of the specified service type is obtained; when a request data packet of a specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type;

determining the state number corresponding to the specified service type; if the number of states is larger than a preset second threshold value, determining that DDoS reflection attack aiming at the specified service type occurs;

wherein the preset second threshold is an integer greater than 0.

4. The method of claim 1,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

when a response data packet of the specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type; when a request data packet of a specified service type is obtained, adding 1 to the state number corresponding to the specified service type;

determining the state number corresponding to the specified service type; if the number of states is smaller than a preset third threshold value, determining that DDoS reflection attack aiming at the specified service type occurs;

wherein the preset third threshold is an integer smaller than 0.

5. The method of claim 1,

the process of discarding the response packet for the specified service type specifically includes:

determining a service type of a response data packet when the response data packet is received; and if the service type is the specified service type in which the DDoS reflection attack has already occurred, discarding the response data packet.

6. The method of claim 5,

before the determining the service type of the response packet, the method further includes:

analyzing a target IP address from the response data packet;

and if the destination IP address is not the IP address of the host, discarding the response data packet.

7. The method of claim 1,

if the DDoS reflection attack aiming at the specified service type is determined to occur, the method further comprises the following steps:

and sending a message carrying the specified service type to an ingress device, wherein the message is used for enabling the ingress device to perform flow limiting processing on a response data packet of the specified service type sent to the host.

8. A DDoS reflection attack defense method is characterized by comprising the following steps:

monitoring a response data packet of a specified service type and a request data packet of the specified service type of the host;

determining whether DDoS reflection attack aiming at the specified service type occurs according to the quantity difference between the response data packet of the specified service type and the request data packet of the specified service type;

and if so, performing current limiting processing on the response data packet of the specified service type sent to the host.

9. The method of claim 8,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

counting the number of response data packets of a specified service type and the number of request data packets of the specified service type, and obtaining the number difference between the number of response data packets and the number of request data packets;

and if the quantity difference is larger than a preset first threshold value, determining that the DDoS reflection attack aiming at the specified service type occurs.

10. The method of claim 8,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

adding 1 to the state number corresponding to the specified service type when the response data packet of the specified service type is obtained; when a request data packet of a specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type;

determining the number of states corresponding to the specified service type, and if the number of states is greater than a preset second threshold value, determining that DDoS reflection attack aiming at the specified service type occurs;

wherein the preset second threshold is an integer greater than 0.

11. The method of claim 8,

the determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type includes:

when a response data packet of the specified service type is obtained, subtracting 1 from the state number corresponding to the specified service type; when a request data packet of a specified service type is obtained, adding 1 to the state number corresponding to the specified service type;

determining the number of states corresponding to the specified service type, and if the number of states is smaller than a preset third threshold value, determining that DDoS reflection attack aiming at the specified service type occurs;

wherein the preset third threshold is an integer smaller than 0.

12. The method according to claim 8, wherein the process of performing the flow restriction processing on the response packet of the specified service type sent to the host specifically includes:

counting the number of response data packets of the specified service type to be sent to the host;

determining the flow intervals to which the quantity belongs, and determining the flow limiting level corresponding to the flow intervals;

and performing current limiting processing on the response data packet based on the current limiting level.

13. The method of claim 8, further comprising:

when receiving a message carrying a specified service type sent by a host, analyzing the specified service type from the message, and performing current limiting processing on a response data packet of the specified service type sent to the host.

14. A DDoS reflection attack defense apparatus, comprising:

the determining module is used for determining whether DDoS reflection attack aiming at the specified service type occurs according to the difference between the response data packet of the specified service type and the request data packet of the specified service type;

and the processing module is used for discarding the response data packet aiming at the specified service type when the determining module determines that the DDoS reflection attack aiming at the specified service type occurs.

15. A DDoS reflection attack defense apparatus, comprising:

the monitoring module is used for monitoring a response data packet and a request data packet of a specified service type of the host;

a determining module, configured to determine whether a DDoS reflection attack aiming at the specified service type occurs according to a difference between the number of the response data packets of the specified service type and the number of the request data packets of the specified service type;

and the processing module is used for performing flow limiting processing on a response data packet of the specified service type sent to the host when the determined result is that the DDoS reflection attack aiming at the specified service type occurs.

16. A DDoS reflection attack defense apparatus, comprising: a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor; the processor is configured to execute machine executable instructions to perform the method steps of any of claims 1 to 7 or to perform the method steps of any of claims 8 to 13.

Images