DDOS防御技术

1、 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id1 ddosddos防御策略防御策略 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id2 最新攻击手段最新攻击手段 -僵尸网络僵尸网络 更多的木马病毒都是在你上网时不经意感染上的。 黑客从内部攻击导致信息泄漏。 2. hacked web site 1. hacker compromises legitimate web site

2、3. victim with vulnerable browser 4. legitimate connection to hacked web site 5. browser exploit (i.e. hidden iframe) 6. victims pc compromised and owned . then part of a botnet 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id3 网络感染网络感染 - - 恶意挂马恶意挂马, ,隐性侵入隐性侵入. . 2006 c

3、isco systems, inc. all rights reserved.cisco confidentialpresentation_id4 异常流量动态清洗异常流量动态清洗 区域区域1: web 区域区域2: dns区域区域3: e-commerce 应应用用 internet legitimate traffic 正正常常流流量量 攻攻击击目目标标 1. 检测检测非正常流量非正常流量 2. 启启动动保保护护 (自自动动/手手动动) remote health injection （ （rhi） ） 3.将流量转移到将流量转移到guard模块模块 5. . 将正常流量重新注入将正常流量

4、重新注入 6. 到其他区域的流到其他区域的流 量没有受到影响量没有受到影响 bgp peer o 192.168.3.0/24 110/2 via 100.0.0.3, 2d11h, gigabitethernet2 b 192.168.3.128/32 20/0 via 20.0.0.2, 00:00:01 192.168.3.128 = zone, 10.0.0.2 = guard module, 20.0.0.2 = msfc bgp announce 4. 攻攻击缓击缓解解(清清洁洁) 2006 cisco systems, inc. all rights reserved.cisco

5、 confidentialpresentation_id5 内部动态策略调整内部动态策略调整 multi-verification process (mvpmulti-verification process (mvp) active verification statistical analysis layer 7 analysis rate limiting legitimate + attack traffic to target dynamic & static filters 监测恶意动作和发现攻击的流监测恶意动作和发现攻击的流 量及源量及源/目标地址目标地址 启动启动anti-sp

6、oofing 阻挡恶意流量阻挡恶意流量 动态增加访问列表阻挡攻动态增加访问列表阻挡攻 击击 启动速率限制启动速率限制 legitimate traffic 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id6 正常流量动态学习正常流量动态学习 injectdivert 防卫学习防卫学习 defense learning 攻击缓解攻击缓解 mitigate 学习学习 阶段阶段 基于基于cisconfp实现对网络的数据实现对网络的数据 平面平面,控制平面的保护控制平面的保护. 采用采用cisc

7、oguard 对数据流清洁对数据流清洁 采用采用cisconetflow或或 detector进行主动的进行主动的 攻击检测攻击检测 将出现攻击流量转移到将出现攻击流量转移到 一个清洁中心一个清洁中心 将将清洁清洁的流量重新注入的流量重新注入 网络网络 攻击检测攻击检测 detect 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id7 adding dynamic-filters static packet filters filter out packets according to

8、pre-defined rules rate-limiting of traffic towards the zone dynamic packet filters filter out packets per flow, protocol, source ip anti-spoofing mechanisms filter out packets from spoofed sources statistical inspection anomaly recognition per flow compared to a baseline rate-limiting 流量动态层次清洗流程流量动态层次清洗流程 multi-verification process (mvp)multi-verification process (mvp) 2006 cisco systems, inc. all rights reserved.cisco confidentialpresentation_id8 云监控云监控 netflow v9 实现实现noc/soc 二合一二合一 异常流