| After the emergence of the Internet, we move into the information age. Web services is one of the information age’s core services. Online games, e-commerce, portals, social networking sites and other Web services greatly enrich people’s lives, improve the efficiency of the society, promote the flow of information. As the importance of Web services, it’s necessary to protect Web services. DDoS attacks is one of the main threats to Web services, high concealment and strong strength make it difficult to defend against.In this paper, we mainly research defense technology against Web Service DDoS attacks. First, introduce the principle of DDoS attacks, divide DDoS attacks into three categories:network layer attacks, transport layer attacks, application layer attacks, analysis typical DDoS attacks in detail, research common DDoS attacks’defense technology.This single point of defense technology performance bottlenecks exist in dealing with a large number of DDoS attack traffic. Then we propose Web service’s distributed defense model, the model distributed deploy the Web services at the outset, also deploy detection and defense module in each Web service subsystem. In the model, we study intelligent DNS mechanism to guide users to various Web subsystem. Study Web synchronization mechanism to ensure that the site content in the the Web subsystem same with site content in the source Web system. Research database access mechanism when the user requests a website dynamic content. Research cluster and load balance mechanism in DNS servers cluster deployment, Web servers cluster deployment and database servers cluster deployment. In the detection and defense module, we study four types of typical DDoS attacks against Web Service, put forward a detection mechanism based on information entropy. We make behavior contrastive analysis of attack tools and browsers, and on this basis, propose three defense strategy:does not respond the SYN packet, replies packet with wrong ACK number and HTTP redirect.Finally, this paper design and implement a distributed defense model-based system, implement load balancer under netfilter framework, implement intelligent DNS based on BIND9view, elaborate the algorithm and process of defense system’s detection mechanism and defense mechanism, test key parts of the system. |
