System and method for determining application layer-based slow distributed denial of service (DDoS) attack
AssigneeElectronics and Telecommunications Research Institute
InventorSeung Yong Yoon
Life of this patent
Estimating the term…
Abstract
A technology for defending a Distributed Denial-of-Service (DDoS) attack is provided. A system for determining an application layer-based slow DDoS attack may include a packet collecting unit to collect a packet in a network, a packet parsing unit to extract at least one header field from the collected packet, and a DDoS attack determining unit to determine whether a DDoS attack against the packet is detected, using a session table and a flow table.
Claims9
A system for determining an application layer-based slow Distributed Denial-of-Service (DDoS) attack, the system comprising:
- a packet collecting unit to collect a packet in a network;
- a packet parsing unit to extract at least one header field from the collected packet;
- and
- a DDoS attack determining unit to generate a flow table including a plurality of entries, track and manage session information for each entry in the flow table, and determine, using an active session count for an entry, whether an application layer-based slow DDoS attack is detected, the session information for each entry including the active session count, wherein
- the session information includes an established session count,
- the session information includes a session trial count, and
- the DDoS attack determining unit determines whether the application layer-based slow DDoS attack is detected based on variations in a time interval of the session trial count, the established session count, a terminated session count, and the active session count of the entry and based on a comparison of the active session count of the entry to a constant.
An operation method of a system for determining an application layer-based slow Distributed Denial-of-Service (DDoS) attack, the operation method comprising:
- collecting, by a packet collecting unit, a plurality of packets in a network;
- extracting, by a packet parsing unit, at least one header field from each of the collected packets;
- generating a flow table including a plurality of entries using the extracted header fields;
- tracking and managing session information for each entry in the flow table using the extracted header fields;
- and
- determining, by a DDoS attack determining unit, whether an application layer-based slow DDoS attack is detected, using an active session count of the session information for an entry,
- wherein the at least one header field comprises at least one of a protocol, a source Internet Protocol (IP), a source port, a destination IP, a destination port, Transmission Control Protocol (TCP) flags, a sequence number, and a window size,
- wherein the session information for each entry includes at least one of a session trial count, an established session count, and a terminated session count, and
- wherein determining whether an application layer-based slow DDOS attack is detected includes comparing a variation during a time interval of the terminated session count of the entry with a variation during the time interval of the session trial count of the entry, and comparing the active session count of the entry to a threshold.
Dependencies are inferred from the claim text.