RU2679219C1 - Method of protection of service server from ddos attack - Google Patents

Abstract

FIELD: network communication technologies.

SUBSTANCE: invention relates to the field of securing communication networks and can be used to protect service servers from DDoS attacks. Technical problem is the low security of the server services, associated with the need for considerable time to restore it and the lack of additional analysis of the “Black” list of IP addresses to ensure their relevance. Technical problem is solved due to the absence of a break in the maintenance of connections from the “White” list of IP addresses and additional analysis of the “Black” list of IP addresses.

EFFECT: increasing the security of the service server due to continuous maintenance of connections from the “White” list of IP addresses and additional analysis and correction of the “Black” list of IP addresses.

1 cl, 2 dwg

Description

The invention relates to the field of security of communication networks and can be used to protect service servers from DDoS attacks.

The “black” list of IP addresses is a user database of IP addresses from which messages will be blocked [Electronic resource. Access Mode: http://support.gfi.com/manuals/en/me2014/Content/Admini-strator/Anti-Spam/Anti-Spam_Filters/IP_Blocklist.htm].

An alternative to the "Black" list is the "White" list of IP addresses [Electronic resource. Access mode: http://dic.academic.ru/dic.nsf/ruwiki/ 701664 / Black_list].

Network traffic - the amount of information transmitted through a computer network over a certain period of time via IP packets. [BUT. Vinokurov Principles of IP traffic accounting. Electronic resource. Access mode: http://habrahabr.ru/post/136844].

A known system and method for reducing false positives when determining a network attack, (RF patent No. 2480937, H04L 29/06, G06F 15/16, G06F 21/30, published on 04/27/2013 Bull. No. 12) is that redirect traffic to the service to sensors and cleaning centers, process all service requests on the sensors with further aggregation of the received information, update the filtering rules on the collectors using the information received from the sensors, adjust the updated filtering rules using the control module based on statistics from previous networks out attacks, filter traffic at the cleaning centers using the specified filtering rules.

The closest in technical essence and functions performed analogue (prototype) to the claimed one is a method of protecting elements of virtual private communication networks from DDoS attacks (RF patent No. 2636640, G06F 21/55, G06F 21/62, H04L 12/28, G06F 11 / 30 publ. November 27, 2017 Bull. No. 33.) consisting in the fact that in the database are entered “White” and “Black” lists of IP addresses to adjust filtering rules, in which “White” and “Black” lists of IP -addresses are set based on behavioral criteria, including analysis of measured attack parameters, filtering network traffic to protect with A service from network attacks, which contains stages where redirecting traffic to the service to sensors and cleaning centers, processes all service requests on the sensors with further aggregation of the received information, updates the filtering rules on the collectors, using the information received from the sensors, and updates filtering rules taking into account the statistics of previous network attacks, they filter traffic at the cleaning centers using the specified filtering rules, while the cleaning centers are connected to the main communication channels on the channel For high-bandwidth alarms, when an attack is detected, the effect of the attack on the VPN element is predicted, the “White” lists of IP addresses are timely updated when new IP addresses appear, and statistics are collected on the functioning of the VPN.

Technical problem. Low security of the service server associated with the need for significant time to restore it and the lack of additional analysis of the "Black" list of IP addresses to comply with their relevance.

The technical problem is solved due to the absence of an interruption in servicing connections from the White List of IP addresses, additional analysis of the Black List of IP addresses.

The technical result. Increasing the security of the service server due to the continuous maintenance of connections from the White List of IP addresses and additional analysis and adjustment of the Black List of IP addresses.

The technical problem is solved in that in the method of protecting the service server from DDoS attacks, the following sequence of actions is performed, a control module is created that uses the “White” and “Black” lists of IP addresses to adjust filtering rules, while the “White” lists are IP addresses are set at the stage of formation of the control module, set the rules for filtering network traffic, monitor network traffic by processing all requests received by the server services with further aggregation of received information, last e the formation of the “Black” list of IP addresses updates the rules for filtering network traffic, after transferring the nodes of the “White” list of IP addresses to the main service server, the received packets are checked in the “White” list of IP addresses and then in the “Black” list of IP addresses upon detection of an IP address in the Black List, received traffic from this IP address is redirected to the cleaning center, according to the invention, an additional backup server, an alert server are additionally formed and connected via an independent channel to the communication network, and they also set the maximum performance the service server’s activity, then during monitoring of network traffic, data on the current connections of the service server are determined and recorded, then the current load on the service server is calculated and compared with the maximum performance, if the current load on the service server exceeds the specified maximum service server performance, then from the notification server, service commands about transferring nodes from the “White” list of IP addresses to the backup server, and record the IP addresses from which the service server was accessed an M1 memory array, after which all connections from the White List of IP addresses are reset, the service server is restored, for which they are turned on for reset and additional network traffic analysis is performed, while the IP addresses from which the connection request was received were recorded the service server in the M2 memory array, then allocate IP addresses from the M2 memory array that match the IP addresses from the M1 memory array and write them to the “Black” list of IP addresses, after updating the filtering rules taking into account the adjusted The black list of IP addresses, in the case of a continuation of the attack, the nodes of the White List of IP addresses interact with the backup server, and if the attack ends, service commands are sent to transfer the nodes of the White List of IP addresses to the main server, after which further functioning of the service server, taking into account the adjusted "Black" list of IP addresses.

The analysis of the prior art allowed us to establish that analogues, characterized by sets of features that are identical to all the features of the claimed method, are absent. Therefore, the claimed invention meets the condition of patentability "novelty."

The listed new set of essential features provides an extension of the capabilities of the prototype method due to the absence of an interruption in servicing connections from the “White” list of IP addresses, additional analysis of the “Black” list of IP addresses, reducing the recovery time of the service server and the use of an additional notification server.

Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the claimed invention from the prototypes showed that they do not follow explicitly from the prior art. From the prior art determined by the applicant, the influence of the provided by the essential features of the claimed invention on the achievement of the specified technical result is not known. Therefore, the claimed invention meets the condition of patentability "inventive step".

"Industrial applicability" of the method is due to the presence of the element base, on the basis of which devices can be made that implement this method with the achievement of the result specified in the invention.

The claimed method is illustrated by drawings, which show:

FIG. 1 is a generalized structural and logical sequence of a method for protecting a service server from DDoS attacks;

FIG. 2 is a diagram of a service server interaction.

, создают управляющий модуль, который использует «Белые» и «Черные» списки IP-адресов для корректировки правил фильтрации, в которой «Белые» списки задаются на начальном этапе, а «Черные» списки формируют в блоке 11. [Справка Dr. Web. Черный и «Белый» списки Электронный ресурс. Режим доступа: http://download.geo.drweb.com/pub/drweb/windows/workstation/9.0/documentation/html/ru/pc_whitelist.htm].The claimed method is illustrated by a flowchart of a method for protecting a service server from DDoS attacks (Fig. 1), where in block 1 the maximum performance of the service server is set -

, create a control module that uses the White and Black lists of IP addresses to adjust filtering rules, in which the White lists are set at the initial stage, and the Black lists are created in block 11. [Help Dr. Web Black and White Lists Electronic resource. Access Mode: http://download.geo.drweb.com/pub/drweb/windows/workstation/9.0/documentation/html/en/pc_whitelist.htm].

A backup service server and an additional notification server are formed for sending service commands to switch to the backup service server.

The notification server can be represented as a mail server, a server for sending SMS messages, etc. The mail server can be implemented using the following tools: hmailserver [https://www.hmailserver.com/], hmailserver [http://www.xmailserver.org/], mailenable [http://www.mailenable.com/standard_edition .asp].

Implementation of the SMS distribution server is possible using the following tools: fast sms [http://fastsms.pro/], Diafaan SMS Server [https://www.diafaan.com/], smsdeliverer [http://www.smsdeliverer.com /].

Connect a backup service server and an additional notification server to the communication network via an independent channel.

In block 2, rules for filtering network traffic are set

Traffic filtering rules are the result of anti-spoofing rules, the selected security mode for each network interface, the list of network filters for connections, and the operation of the attack detection system.

Traffic filtering is carried out taking into account established connections, that is, connections formed on the basis of an incoming or outgoing packet allowed by the rules. When a packet arrives, various parameters of the incoming or outgoing packet allowed by the filters are fixed. Based on this data, a temporary connection rule is created for further packets passing forward and backward. Such a rule exists as long as there is traffic corresponding to this connection. [The basic principles of filtration. Electronic resource. Access Mode: http://mybiblioteka.su/10-39332.html].

In block 3 monitor network traffic

Network monitoring is understood to mean the process of collecting and analyzing network traffic, the results of which make it possible to judge the qualitative and quantitative characteristics of the network or its individual components. Network monitoring programs allow you to capture packets and reassemble them for further analysis. [Network monitoring. Sniffer Wireshark. Electronic resource. Access Mode: http://www.4stud.info/networking/work2.html]

They process the received data on all requests to the service server with further aggregation of the received information [Monitoring network traffic using Netflow. Translation: Mikhail Sgibnev Electronic resource. Access Mode: http://www.opennet.ru/base/cisco/monitor_netflow.txt.html. I. Chubin NetFlow Electronic Resource. Access mode: http://www.opennet.ru/docs/RUS/netflow_bsd/].

Block 4 collects information about current server connections

A collection (inventory) of server connections is in progress. [Reports of sets of system data collection elements. Electronic resource. Access mode: https://msdn.microsoft.com/en-us/library/cc280385(v=sql.110).aspx] In this case, data is recorded about the IP address of the sender and the IP address of the recipient, as well as the number of IP packets transferred between these pairs.

In block 5, the current server load is calculated

In the general case, the load on the service server can be represented as the product of the number of subscribers connected to the service server and the amount of information transmitted by subscribers:

,

,

– общая нагрузка на сервер услуг; Where:

- total load on the service server;

– количество абонентов;

- number of subscribers;

– объем передаваемой абонентами информации.

- the amount of information transmitted by subscribers.

Under the conditions of network attacks, the total load on the service server will be formed as the sum of the load of the DDoS attack and the information load from the communication nodes:

,

,

– общая нагрузка на сервер услуг; Where:

- total load on the service server;

– нагрузка от узлов связи, подключенных к серверу услуг;

- load from communication nodes connected to the service server;

– нагрузка на сервер производимая DDoS атакой.

- server load produced by DDoS attack.

. Если условие выполняется, то переходят к блоку 7 и передают команды о переводе узлов связи из «Белого» списка IP-адресов на резервный сервер услуг, в противном случае переходят к блоку 3 и продолжают мониторинг сетевого трафика. In block 6, verify the condition

. If the condition is met, then go to block 7 and send commands about the transfer of communication nodes from the "White" list of IP addresses to the backup service server, otherwise go to block 3 and continue monitoring network traffic.

In block 8, all IP addresses from which the main service server is accessed (except for the IP addresses of the White List) are recorded. From the received data about all requests to the service server, IP addresses (with the exception of IP addresses from the White List) are allocated from which the server was accessed and written to the M1 memory array.

In block 9, all connections from the "White" list of IP addresses are reset.

All connections from the White List of IP addresses established with the service server are reset, after which the service server is rebooted.

In block 10, the network traffic of the main service server is monitored.

Denial of service (DDoS) attacks affect the availability of information resources. A denial of service attack is considered successful if it results in the unavailability of an information resource. In this case, we are talking about a large number of malicious requests arriving at the server from many different places. Typically, such attacks are organized through botnets. The botnet generates a large number of requests to the server, which leads to exceeding the allowable load on the server and, therefore, denial of service to legitimate users [DDoS attacks: attack types and levels of the OSI model. Electronic resource. Access Mode: https://firstvds.ru/technology/types-of-ddos].

This block processes the received data on all requests to the service server with further aggregation of the received information [Monitoring network traffic using Netflow. Translation: Mikhail Sgibnev Electronic resource. Access Mode: http://www.opennet.ru/base/cisco/monitor_netflow.txt.html. I. Chubin NetFlow Electronic Resource. Access mode: http://www.opennet.ru/docs/RUS/netflow_bsd/]. When processing data about requests to the service server, all IP addresses from which a connection request is received are allocated, but the connection is not established. Formal signs by which you can determine a DDoS attack are presented in [Defining DoS / DDoS attacks on a server. Electronic resource. Access Mode: https://www.stableit.ru/2010/01/dosddos.html].

In block 11, IP addresses are analyzed and an additional “Black” list of IP addresses is formed.

From the received data on all requests to the service server, the IP addresses from which the server was accessed are allocated and written to the M2 memory array. Then compare the arrays M1 and M2. Coinciding IP addresses in the arrays M1 and M2 are recorded in the memory array M. The resulting array of memory M is an additional "Black" list of IP addresses. [Help Dr. Web "Black" and "White" lists. Electronic resource. Access Mode: http://download.geo.drweb.com/pub/drweb/windows/workstation/9.0/documentation/html/en/pc_whitelist.htm]. IP addresses that were present only in one of the arrays are considered non-threatening and are not entered into the Black List of IP addresses.

There are static and dynamic blacklists. A dynamic blacklist is a network service provided by a blacklist provider. These providers track IP addresses (sometimes domain names) compromised by spammers. Some blacklist providers, along with spammer lists, monitor the addresses from which viruses, Trojans, network worms, unauthorized remote control programs and other malicious content are sent [Dynamic Blacklists. Electronic resource. Access mode: https://www.osp.ru/winitpro/2005/04/177681]. The main disadvantage of static Blacklists is that, to access the selected blacklist service, the mail filtering program generates a special DNS query, which is transmitted to the DNS server of the blacklist provider. Typically, such requests are issued as a PTR record requesting a type A record. When a positive result is received from the provider asking if the address is a known source of spam, the mail filter may decide to block the reception of mail from this source, and delete messages received from this address, or about placing letters from this source in the queue for further consideration.

In the proposed method, the "Black" list of IP addresses is formed directly during the attack and allows you to generate relevant IP-addresses for a specific attack. Moreover, this list is updated in real time and there is no need to contact the blacklist provider.

In block 12, the rules for filtering network traffic are updated taking into account the adjusted Black List of IP addresses.

In block 13, the end of the attack on the main service server is checked. If the attack continues, then go to block 14 and continue the interaction of the nodes of the "White" list of IP addresses with the backup service server, otherwise go to block 15 and send service commands to transfer the nodes of the "White" list of IP addresses to the main service server .

In block 16, the service server is operated taking into account the adjusted Black List of IP addresses.

After the nodes of the “White” list of IP addresses are transferred to the main service server, the received packets are checked in the “White” list of IP addresses. If the received packets are received from the list of “White” IP addresses, then the packet is processed. If the packet was received from an IP address that is not from the White List, the IP address is compared with the Black List of IP addresses. If the received packet is obtained from the Black IP list, the packet is redirected to the cleaning center and destroyed [Network protection based on Cisco System technologies. Practical course. Ural Federal University named after the first President of Russia B.N. Yeltsin. Yekaterinburg, p. 180. 2014].

The average DDoS attack lasts about 5 hours on average [The main types of DDoS attacks and how these attacks work. Electronic resource. Access mode: https://data247.ru/2014/10/20/osnovnye-vidy-ddos-atak-i-princip-dejstviya-takix-atak/], while during the attack the load on the service server will exceed the allowable load and, therefore, will lead to a denial of service for legitimate users, in addition, additional time will be spent on restoring the server. Thus, all the time of the DDoS attack and the time required to restore working capacity - the service server will not be able to provide services to users.

,

,

– среднее время отказа в обслуживании; Where

- average denial of service time;

– среднее время восстановления.

- average recovery time.

все соединения, установленные с сервером услуг будут переведены на резервный сервер услуг, после чего за время

осуществляют обработку сетевого трафика и формирование скорректированного «Черного» списка IP-адресов, время

будет затрачено не перезагрузку сервера, а время

на восстановление работоспособности сервера услуг (с учетом «Черного» списка IP-адресов).The achievement of the technical result is illustrated as follows. In the proposed method, when starting a DDoS attack in time

all connections established with the service server will be transferred to the backup service server, after which time

they process network traffic and generate the adjusted "Black" list of IP addresses, time

it will not be spent rebooting the server, but time

to restore the service server (taking into account the "Black" list of IP addresses).

,

,

On average, it may take up to 10 minutes to transfer all connections from the main service server to the backup server (taking into account the transfer of commands to transfer communication nodes from the White List of IP addresses to the backup service server), it may take up to 20 minutes to process network traffic , to restart the service server for up to 15 minutes and about 40 minutes to restore functionality. Thus, after 1 hour 25 minutes, the service server will be able to provide services to users. Compared with the prototype method, the efficiency is about 3.3 times.

Based on this, it follows that the claimed method of protecting the service server from DDoS attacks allows to increase the security of the service server due to the continuous maintenance of connections from the White List of IP addresses and additional analysis of the Black List of IP addresses.

Claims (1)

A way to protect the service server from DDoS attacks, which is to create a control module that uses White and Black lists of IP addresses to adjust filtering rules, while White lists of IP addresses are set at the stage of formation of the control module , set the rules for filtering network traffic, monitor network traffic by processing all requests received by the server services with further aggregation of the received information, after the formation of the "Black" list of IP addresses, filtering rules are updated and network traffic, after the nodes of the White List of IP addresses are transferred to the main service server, the received packets are checked in the White List of IP addresses, then in the Black List of IP addresses, if an IP address is found in the Black List, the received traffic from this IP address is redirected to the cleaning center, characterized in that they additionally form a backup server, an alert server and connect them via an independent channel to the communication network, as well as set the maximum performance of the service server, then during monitoring of network traffic they limit and record data on the current connections of the service server, after which they calculate the current load on the service server and compare it with the maximum performance, if the current load on the service server exceeds the specified maximum performance of the service server, then service commands are sent from the notification server about the transfer of nodes from " Of the White list of IP addresses to the backup server, and record the IP addresses from which the service server was accessed in the M1 memory array, and then reset all connections from the White IP addresses, restore the functioning of the service server, for which they enable it for reset and perform additional analysis of network traffic, while recording the IP addresses from which the request to connect to the service server was received in the M2 memory array, then allocate IP addresses from the M2 memory array, which coincided with the IP addresses from the M1 memory array, and write their “Black” list of IP addresses, after updating the filtering rules taking into account the adjusted “Black” list of IP addresses, in case of continued attack, carry out the interaction of the nodes of the "White" list of IP addresses with the backup server, and in case of an attack, service commands are sent to transfer the nodes of the "White" list of IP addresses to the main server, after which the service server will continue to operate taking into account the adjusted IP Black List -addresses.

Images