CN100589489C

CN100589489C - Defense method and device for DDOS attack on web server

Info

Publication number: CN100589489C
Application number: CN200610034795A
Authority: CN
Inventors: 雷奕康; 王宁; 张日华; 齐志; 朱志强
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2006-03-29
Filing date: 2006-03-29
Publication date: 2010-02-10
Anticipated expiration: 2026-03-29
Also published as: CN101047697A

Abstract

The invention provides a firewall defense method and equipment for DDOS attacks on web servers. Described firewall is arranged before web server, and described method comprises steps: receive the tcp connection request that user initiates to web server; Described request is forwarded to web server; Receive and check the response message of web server; When response message When the error code is included, the tcp connection corresponding to the tcp connection request is disconnected.

Description

Carry out defence method and the equipment that DDOS attacks at the web server

Technical field

The present invention relates to the web server, the DDOS that is related to specifically at the web server attacks the method and apparatus that defence is provided.

Background technology

When the user network browser obtains the Internet (Internet) station network information, in the ordinary course of things, must directly connect its Web server, webpage is sent the request of reading.Web server responds the user, and information is transmitted.Under a lot of situations, the user also can connect the web server by acting server.

Acting server is the station server between browser and Web server.When using acting server, browser does not directly read webpage to the Web server request, but sends request to acting server.Request can be delivered to acting server earlier.By the request of acting server initiation to Web server, and the webpage that Web server is responded sends user browser to.And most of acting server all has the function of high-speed cache, and it has very big memory space, constantly will newly obtain data storing to the memory of acting server.If the data that user browser is asked have existed on the memory of its this machine and have been up-to-date, it does not just fetch data from Web server again so, and directly the data on the memory is sent to user's browser.So just can significantly improve surfing and efficient.

Utilize this characteristic of acting server, at Web server, occurred a kind of novel distributed denial of service (DDoS) attack pattern on the network: its principle is to utilize the visit of numerous acting server simulation a large number of users, to server dynamic page (asp, php.aspx, jsp etc.) send in a large number and ask.These pages can be and the non-existent page.The assailant hides its real Internet protocol (IP) address by acting server, therefore is difficult to real assailant is on the defensive.And because webpage does not exist, acting server can't directly directly be issued the assailant with this machine data in buffer, assailant's request can only be issued the web server process.And the expense of these requests of web server process is bigger, can carry out operations very consuming time such as data base querying usually.Because these operations can not be finished at once, the web server can be gone into the formation buffer memory with the request of failing to finish dealing with, thereby takes the linking number of web server application layer service very soon, reaches the purpose of refusal normal users visit.For example, the concurrent connection number that a lot of apache servers can be handled only is 512 or 1024, by this attack, is easy to cause denial of service (DoS).Even cause the too heavy web of the causing servers go down of web server process load.

Fig. 1 utilizes transmission control protocol (tcp) to connect the schematic diagram that interactive information is carried out the canonical process of ddos attack.The assailant by acting server in same tcp connects, constantly to non-existent page of web server requests.Connect if the assailant starts a plurality of attacks simultaneously, can make that the web server is busy with handling the request that the assailant initiates, thereby reach the linking number of seizing and take the service of web server application layer, finally cause the purpose of DoS.

Because this type of attacks the normal visit behavior of simulation normal users, current firewall box can not effectively be defendd this type of attack.

Because this type of attacks the normal visit behavior of simulation normal users, so SynFlood defense technique tcp commonly used agency can not effectively take precautions against it.In a kind of prior art; usually can on each acting server, initiate the feature of some connection requests at this attack; can on firewall class equipment, manage by the flow to the user, limit the bandwidth of certain IP, perhaps carry out the restriction of linking number at each IP address.Can defend this type of attack to a certain extent.

Yet, manage by flow the user, limiting the bandwidth of certain IP or limiting each IP address initiation linking number has following limitation:

1. this type of attack is initiated by a large amount of acting servers, and the attack that each acting server is initiated connects may be seldom.If limit the linking number of each IP, linking number need be limited in just may be effectively in the very little scope.But if the acting server quantity that the assailant uses is a lot, the connection of attack server is still a lot of so.The method that flow manages does not just reach the purpose of defence.

2. this type of attack is primarily aimed at the performance bottleneck of server when handling dynamic web page, rather than the bandwidth that consumes server.Therefore less attack traffic still can consume a large amount of server resources, thereby reaches the purpose of attack.

3. user's flow being managed to influence the normal visit of normal users to server, causes networking speed to wait problem slowly, influences user experience.

In another kind of prior art, because this type of normal visit of attacking the simulation normal users all needs to finish by acting server, detect please adopting of HTML (Hypertext Markup Language) (http) and whether have some the special information that can represent by proxy access in (request) message, and determine that with this this is a proxy access and does filtration accordingly.

This scheme possesses certain anti-attack ability, but also has some problems: 1, this is to really forming erroneous judgement in the request of internal network by the proxy access external network; 2, the behavior of http acting server is unpredictable, can't discern and filter for those requests of not carrying specific information.

Summary of the invention

Can overcome the above problems the method that ddos attack is effectively defendd thereby the purpose of this invention is to provide.

Fire compartment wall is placed on the server front usually server is protected.The present invention will be by detecting the tcp connection status such as http on intermediate equipments such as fire compartment wall, the mechanism of forcing the disconnection assailant to be connected with the tcp of server protects server to avoid the method for Denial of Service attack.

According to first aspect, the invention provides the method that a kind of fire compartment wall defence is attacked at web server DDOS, described fire compartment wall is arranged on before the web server, and described method comprises step: receive the tcp connection request that the user initiates to the web server; Described request is transmitted to the web server; Receive and check the back message using of web server; When comprising error code in the back message using, disconnect the tcp corresponding and connect with described tcp connection request.

According to second aspect, a kind of web of being arranged on server fire compartment wall before is provided, be used to defend DDOS to attack at described web server, described fire compartment wall comprises the device of reception user to the tcp connection request of web server initiation; Described request is transmitted to the device of web server; Receive and check the device of the back message using of web server; When comprising error code in the back message using, disconnect the device that tcp connects.

Technical scheme of the present invention can the defensive attack person be attacked the invalid web pages of http-server initiation, alleviates load of server, makes normal users can be connected to server.

Description of drawings

Below will the present invention will be described in more detail with reference to accompanying drawing by way of example, in the accompanying drawings:

Fig. 1 utilizes tcp to connect the schematic diagram that interactive information is carried out the canonical process of ddos attack;

Fig. 2 is the schematic diagram that utilizes the embodiment of fire compartment wall defending DDoS (Distributed Denial of Service) attacks according to of the present invention.

Embodiment

The present invention protects the web server by intermediate equipments such as fire compartment walls.Hereinafter will specify embodiment of the present invention.

The fire compartment wall supervisory user is connected with tcp between the web server.When the user initiates tcp when connecting to the web server, fire compartment wall is set up conversational list for this tcp connection.Conversational list for example can adopt five-tuple (source IP, source port, protocol type, purpose IP, destination interface) expression.The tcp message of process fire compartment wall is all with detected.If the destination interface of message is a http message port 80, then fire compartment wall judges that this message is the http message, and the protocol type that respective session information therefore is set is http.Need to prove that the Client-initiated web-page requests also can send to fire compartment wall by acting server.

Then, fire compartment wall is transmitted to Web server with message.

For user's request, the web server is made corresponding response.First row of response is a statusline, begins with HTTP version number, and response code is represented in back and then 3 bit digital, is the response phrase of readability at last.Following table is 3 answer codes and the explanation thereof of HTTP.

Response	Explanation
Response	Explanation	200 201 202 204	Success OK asks successful OK, and new resource is set up (post order) request and is accepted, and does not finish OK but handle, but does not have content to return
301 302 304	Be redirected: need the user agent to carry out more action institute requested resource and be designated as new fixing URL institute requested resource and be positioned at other URL document temporarily and do not revise (condition Get)	200 201 202 204
301 302 304		400 401 403 404	The request of user's mistake mistake is uncommitted: this request require the authentification of user unknown cause forbid do not find

500 501 502 503

Server mistake internal server mistake does not realize wrong gateway: the null response service of gateway or upstream server was temporarily lost efficacy

If the message of responding hits conversational list, illustrate that it is the http message.Fire compartment wall carries out depth detection to the http message of web server response, the information such as user's error code in the search web server response message.If what the web server returned is user's error code message, then fire compartment wall is directly removed the user and is connected with tcp between the web server, stops the connection at the web server.By the http session information that keeps on the fire compartment wall, can on fire compartment wall, the name with the user send reset RST or the connection of termination FIN message notifying web server closing to the web server.

If the assailant uses a large amount of acting servers to launch a offensive to same web server, so,, yet have a large amount of attack messages even removed being connected between web server and the some agencies, equally can consume the web server resource.Therefore, in a preferred embodiment, can adopt the method for limiting access simultaneously, promptly the http linking number that same source IP is initiated is added up, if within a certain period of time, the web server then adds blacklist with this IP to the number of times of the user's return error sign indicating number value greater than a certain appointment, limits the visit to the web server that this source IP initiates.

Above be connected to example, embodiment of the present invention are specified with http.It may be noted that to the invention is not restricted to this, also can be applicable to connect such as other tcp of ftp.

Obviously, the present invention described here can have many variations, and this variation can not be thought and departs from the spirit and scope of the present invention.Therefore, the change that all it will be apparent to those skilled in the art all is included within the covering scope of these claims.

Claims

1. a kind of firewall defense is aimed at the method for web server DDOS attack, and described firewall is arranged before web server, and described method comprises steps: receive the tcp connection request that user initiates to web server; Described request is forwarded to web server; Receive And check the response message of the web server; when the response message includes an error code, disconnect the tcp connection corresponding to the tcp connection request.

2. The method according to claim 1, characterized in that the tcp connection request initiated by the user is sent to the firewall through a proxy server.

3. The method according to claim 1, wherein the step of disconnecting the tcp connection comprises that the firewall sends a reset or terminate message to the web server in the name of the user.

4. The method according to claim 1, characterized in that comprising: when a user initiates a tcp connection to a web server, the firewall establishes a session table for the tcp connection, and the session table includes source IP address, source port, protocol Type, destination IP address and destination port.

5. The method of claim 1, wherein the tcp connection is an http connection.

6. The method according to claim 1, comprising counting the number of times that the web server returns an error code to a source IP address within a certain period of time, if the number of times is greater than a certain threshold, then limiting the number of times that the source IP address initiates Access to the web server.

7. a kind of firewall that is arranged before web server, is used for defense against the DDOS attack of described web server, and described firewall comprises the device that receives the tcp connection request that user initiates to web server; Described request is forwarded to web server The device; the device for receiving and checking the response message of the web server; when the error code is included in the response message, the device for disconnecting the tcp connection.

8. Firewall as claimed in claim 7, it is characterized in that comprising the device that counts the number of times that web server returns error code to a source IP address within a certain period of time, and if the number of times is greater than a certain threshold, then limit the source IP The address originates the means of access to the web server.