DDOS防御技术.ppt

ddos防御策略,最新攻击手段 -僵尸网络,更多的木马病毒都是在你上网时不经意感染上的。 黑客从内部攻击导致信息泄漏。,2. hacked web site,1. hacker compromises legitimate web site,3. victim with vulnerable browser,4. legitimate connection to hacked web site,5. browser exploit (i.e. hidden iframe),6. victims pc compromised and owned . then part of a botnet,网络感染 - 恶意挂马,隐性侵入.,异常流量动态清洗,区域1: web,区域2: dns,区域3: e-commerce 应用,internet,legitimate traffic正常流量,攻击目标,2. 启动保护 (自动/手动),remote health injection （rhi）,3.将流量转移到guard模块,5. 将正常流量重新注入,6. 到其他区域的流量没有受到影响,o 192.168.3.0/24 110/2 via 100.0.0.3, 2d11h, gigabitethernet2 b 192.168.3.128/32 20/0 via 20.0.0.2, 00:00:01 192.168.3.128 = zone, 10.0.0.2 = guard module, 20.0.0.2 = msfc,bgp announce,内部动态策略调整 multi-verification process (mvp),active verification,statistical analysis,layer 7 analysis,rate limiting,legitimate + attack traffic to target,dynamic & static filters,启动anti-spoofing 阻挡恶意流量,动态增加访问列表阻挡攻击,启动速率限制,legitimate traffic,正常流量动态学习,防卫学习 defense learning,学习 阶段 基于cisconfp实现对网络的数据 平面,控制平面的保护.,采用ciscoguard 对数据流清洁,采用cisconetflow或 detector进行主动的 攻击检测,将出现攻击流量转移到 一个清洁中心,将清洁的流量重新注入 网络,static packet filters filter out packets according to pre-defined rules,rate-limiting of traffic towards the zone,dynamic packet filters filter out packets per flow, protocol, source ip,anti-spoofing mechanisms filter out packets from spoofed sources,statistical inspection anomaly recognition per flow compared to a baseline,流量动态层次清洗流程 multi-verification