| In recent years, with the development of network technology, network isplaying an important role in changing how people communicate, work and livefrom many aspects, such as information, social, and even in the way of payment.Meanwhile, as the performance of network equipment improved, the cost ofnetwork attack greatly reduces so that attackers can attack other hosts by cheapprice, but potentially devastating. The flooding attack is the most popular of alltypes of attack, which is occupying larger percentage of typical network attacks.This paper aims to design a flow cleaning system that defenses application layerflooding attack, based on current TCP/IP layer flood flow cleaning strategy.The essence of the flooding attack is to consume network bandwidth andservice resource by sending large numbers of bogus requests, leading that theserver refuses to process normal request or even gets out of work. Attackerslaunch attacks via puppet hosts in the network. The flooding attack is difficult toguard against because puppet hosts are in large numbers and wide distributed,which makes the flooding attack obtain high performance in concealment andlarge scale.In this paper, according to the characteristics of the flooding attack, thecleaning system of the network application layer flooding flow divides attackpackets into low-layer (network layer and transport layer) packets and high-layer(application layer) packets, and apply different defense strategies for differenttype of packets. For low-layer packets, based on TCP/IP protocol standard, thesystem directly inspects packet header information to verify the legitimacy of themessage. For high-layer packets, packet content needs to be analyzed tospeculate the behavior of the packet and detect the attack. Thus, the systemmainly includes four components: the monitoring and statistics of flow, abnormalflow analysis, flow cleaning platform and log management. To monitor networkflow, we classify the flow by sessions. When attack happens, the system starts theflow traction to lead the flow to the flow cleaning platform. The flow cleaningplatform filters the low-layer attack packets by using the half-connection limitand the network proxy, and defenses the high-layer attack through linearclassification algorithm. After the flow is cleaned, the flow will be returned to the original network. The whole process is transparent for both the server and theclient.As the result of testing, the system can correctly identify the applicationlayer flooding attack and its performance has reached the expected target. Thesystem detects attack perfectly, meaning the detection rate reaches100%, and theerror rate is under5%. In addition, tens of millions of sessions are supported ondevice on which the system deployed. |
