Back to results
US 2023/0156035 A1Published application
METHOD AND APPARATUS FOR DETECTING DDoS ATTACKS
AssigneeWINS Co., Ltd.
InventorsJi Baek PARK, Myeong Hwan CHA
Life of this patent
Estimating the term…
Abstract
Disclose are a method and apparatus for detecting DDoS attacks. The DDoS attack detection method of a DDoS attack detection apparatus may include detecting distributed denial-of-service (DDoS) attack and, more particularly, include detecting unknown DDoS attack patterns provided in similar forms on the Internet network and controlling packet transmission or reception.
Claims9
A DDoS attack detection method by a DDoS attack detection apparatus, the method comprising:
- storing a predetermined pattern and a predetermined mask associated with each block of an object for which detection is to be performed, and producing an offset bitmask and a matching mode that correspond to the mask for each block;
- and
- determining whether the pattern matches each sequential block associated with a received packet,
- wherein the determining of whether the pattern and the block match comprises:
- in a byte matching mode among matching modes, determining whether a result of comparison between the block of the received packet and the pattern is identical to the offset bitmask;
- and
- in a bit matching mode among the matching modes, determining whether a result of comparison between the pattern and a result of an operation performed on the mask and block of the received packet is identical to the offset bitmask.
4 more elements
A DDoS attack detection apparatus on a network, the apparatus comprising:
- a policy managing unit configured to store a predetermined pattern and a predetermined mask associated with each block of an object for which detection is to be performed, and to produce an offset bitmask and a matching mode that correspond to the mask associated with each block;
- and
- a packet processing unit configured to determine whether the pattern and each sequential block of a received packet match, and according to the matching mode, to perform a byte matching mode for determining whether a result of comparison between the block of the received packet and the pattern is identical to the offset bitmask, and to perform a bit matching mode for determining whether a result of comparison between the pattern and a result of an operation performed on the mask and the block of the received packet is identical to the offset bitmask.
Dependencies are inferred from the claim text.