CN101465855A - Method and system for filtrating synchronous extensive aggression - Google Patents

Abstract

The present invention relates to a filtering method and system for synchronous flooding attacks. The method includes: step 1, configuring the ratio of high and low weight queues to forward data packets; step 2, receiving data packets, determining the current state, and judging whether the current state is a normal state, If yes, then the data packet enters the high-weight queue, otherwise, step 3 is performed; step 3, according to the type of the data packet, the connection state table for recording the connection and the legal address table for recording the legal IP address determine whether the data packet is Legal, if yes, then the data packet enters the high-weight queue, otherwise, the data packet enters the low-weight queue; and updates the connection state table and the legal address table; step 4, when the current state is normal, forward the data packet in the high-weight queue , when the current state is the attack state, forward the data packets in the low weight queue and the high weight queue in proportion. The invention can effectively mitigate, filter and defend large-scale synchronous flooding attacks aimed at network information systems.

Description

A filtering method and system for synchronous flooding attack

technical field

The invention relates to the field of network security monitoring, in particular to a filtering method and system for synchronous flooding attacks.

Background technique

In recent years, the frequent occurrence of DDoS (Distributed Denial of Service) attacks has seriously affected the security of important information systems and operational networks, and thus has received widespread attention from all walks of life. In DDoS attacks, Syn Flood (synchronous flooding) attack is the most common attack method. It mainly uses the design loophole of the TCP (Transmission Control Protocol) protocol stack to consume memory to save the semi-connected state to achieve the attack. Attackers often send a large number of TCP connection requests to the target to consume system memory to achieve a denial of service attack on the target system. At present, research on filtering and defense methods for Syn Flood attacks mainly includes four methods based on Syn Proxy (synchronous proxy), History-IP (historical network protocol), Hop-Count (hop count), and label.

A method based on Syn Proxy (including Syn Cookie). It mainly uses the method of performing three-way handshake of TCP connection instead of the server to filter attack packets. The disadvantage of this type of method is that the three-way handshake instead of the server needs to consume certain system resources. When the attack traffic is too large, the filtering system itself is prone to collapse.

The other is a method based on History-IP (including blacklist and whitelist). This type of method maintains a common user database or list, and when an attack occurs, the data packets whose source address is in the table are allowed to pass. The disadvantage of this type of method is that if the attack address uses a legal IP address, the filtering system will completely lose the ability to protect the target system, and if the source address of the legitimate user is not in the common user table, it will also be blocked from accessing the server, and This method takes a while to learn to build a user database or list.

Another method is based on Hop-Count. This type of method maintains a hop count database of common users. When an attack occurs, check whether the hop count of the data packet is the same as the corresponding record in the database. If they are the same, they are allowed to pass through. The disadvantage of this type of method is that when the route of the legitimate user changes, the legitimate user will also be prohibited from entering the system, and this type of method requires a period of learning to establish the hop count database.

Another label-based approach. This type of method mainly identifies the authenticity of the Syn packet by adding a label based on the source subnet number to the Syn data packet flowing out of the subnet on the border router, thereby filtering the Syn Flood attack of forging the source address. The disadvantage of this type of method is that it cannot filter the SynFlood attack of the real source address. At the same time, if the attack method of forging the source address of the subnet is adopted, this type of method will also lose its defense capability.

Contents of the invention

In order to solve the above-mentioned technical problems, a filtering method and system for syn flooding attacks are provided, which can effectively alleviate, filter and defend against large-scale Syn Flood attacks aimed at network information systems.

The invention discloses a filtering method for synchronous flood attack, including:

Step 1, configure the ratio of high and low weight queues to forward packets;

Step 2, receiving the data packet, determining the current state, and judging whether the current state is a normal state, if yes, the data packet enters the high weight queue, otherwise, execute step 3;

Step 3, according to the type of the data packet, the connection state table for recording the connection and the legal address table for recording the legal IP address, judge whether the data packet is legal, if so, then the data packet enters the High weight queue, otherwise, the data packet enters the low weight queue; and update the connection state table and the legal address table;

Step 4, when the current state is a normal state, forward the data packet in the high-weight queue, and when the current state is an attack state, forward the low-weight queue and the Packets in high weight queues.

The step 1 also includes configuring the detection time slot, initializing the timer to 0, and initializing the current state variable for recording the current state as normal;

Determining the current state in the step 2 is further as follows:

Step 21, after receiving the data packet, judge whether the value of the timer is less than the detection time slot, if yes, then determine that the current state is the state recorded in the current state variable, otherwise, set the timer to 0, go to step 22;

The step 22 is to determine whether an attack occurs, and if so, update the current state variable to be an attack state, and determine that the current state is an attack state, otherwise, update the current state variable to be a normal state, and determine the current state to normal state.

The step 2 further includes, after step 22 is executed and it is determined that the current state is a normal state, clearing the connection state table and the legal address table.

Said step 1 also includes configuring a synchronization packet threshold;

In the step 22, judging whether an attack occurs is further

Step 41, judging whether the number of synchronization packets counted within the time counted by the timer divided by the value of the timer is greater than or equal to the synchronization data packet threshold, if yes, then determine that an attack occurs, and determine as normal.

The step 3 is further as follows,

Step 51, when the data packet is a synchronization packet, determine that the data packet is illegal, enter the low weight queue, and update the connection state table;

Step 52, when the data packet is a synchronization/acknowledgment packet, if the data packet has a corresponding record in the connection state table, the data packet is legal, the data packet enters the high weight queue, and the Connect the state table and the legal address table, otherwise, the data packet is illegal, and the data packet enters a low-weight queue;

Step 53, when the data packet is of other types, if the data packet has a corresponding record in the legal address table, it is determined that the data packet is legal, and the data packet enters a high-weight queue, otherwise, the The data packet is invalid, and the data packet enters the low-weight queue.

Updating the connection state table in the step 51 is further as follows:

Step 61: Search the connection status table for the identifier of the connection corresponding to the data packet, if not found, add the identifier of the connection corresponding to the data packet to the connection status table.

The step 52 is further as follows,

Step 71, when the data packet is a synchronization/acknowledgment packet, search the connection status table for the identification of the connection corresponding to the data packet, if not found, then the data packet enters the low weight queue, if found , then execute step 72;

The step 72 is to delete the identification of the connection corresponding to the data packet from the connection state table, add the source IP address of the data packet to the legal address table, and determine that the data packet is legal, The data packet enters the high weight queue.

The step 53 is further to search the source IP address of the data packet in the legal address table when the data packet is of other types, if found, then determine that the data packet is legal, and the data packet enters high weight queue, otherwise, the data packet enters the low weight queue.

The identification is a five-source group of the synchronous data packet of the connection, and the five-source group is composed of source IP address, source port number, destination IP address, destination port number and sequence number.

The step 2 and the step 3 in which the data packet enters the high-weight queue are further as follows:

Judging whether the high-weight queue is full, if so, discarding the data packet, otherwise adding the data packet to the high-weight queue;

The data packet in the step 3 entering the low weight queue is further as follows:

Judging whether the low-weight queue is full, if so, discarding the data packet, otherwise adding the data packet to the low-weight queue.

The invention also discloses a filter system for synchronous flood attack, including: a detection module, a filter module, a buffer module and a forwarding module,

The buffer module includes a low-weight queue and a high-weight queue;

The initialization module is used to configure the ratio of high and low weight queues to forward data packets;

The detection module is used to receive data packets, determine the current state, and judge whether the current state is a normal state, if so, add the data packets to the high-weight queue, otherwise, transmit the data packets to to the filter module;

The filter module is used to judge whether the data packet is legal according to the type of the data packet, the connection state table used to record the connection and the legal address table used to record the legal IP address, and if so, the The data packet is added to the high weight queue, otherwise, the data packet is added to the low weight queue; and the connection state table and the legal address table are updated;

The forwarding module is configured to forward the data packets in the high-weight queue when the current state is a normal state, and forward the low-weight queue according to the ratio of forwarding data packets in the high-weight queue when the current state is an attack state queues and packets in the high weight queues.

The initialization module is also used to configure the detection time slot, the initialization timer is 0, and the initialization of the current state variable used to record the current state is normal;

The detection module is further used to determine whether the value of the timer is less than the detection time slot after receiving the data packet when determining the current state, and if so, determine that the current state is the state recorded in the current state variable ; Otherwise, the timer is set to 0, and it is judged whether an attack occurs, and if so, the current state variable is updated to be an attack state, and the current state is determined to be an attack state, otherwise, the current state variable is updated to be normal state, determining that the current state is a normal state.

The detection module is further configured to clear the connection state table and the legal address table after determining that the current state is a normal state by judging that no attack has occurred.

The initialization module is also used to configure the synchronization data packet threshold;

When determining whether an attack occurs, the detection module is further used to determine whether the value obtained by dividing the number of synchronization packets counted within the timing time of the timer by the value of the timer is greater than or equal to the synchronization data packet threshold, if yes , it is determined that an attack has occurred, and the above is determined to be normal.

The filtering module is further used for determining that the data packet is illegal when the data packet is a synchronous packet, adding the data packet to the low-weight queue, and updating the connection state table; When it is a synchronization/acknowledgment packet, if the data packet has a corresponding record in the connection state table, the data packet is legal, the data packet is added to the high weight queue, and the connection state table and the connection state table are updated. Otherwise, the data packet is illegal, and the data packet is added to the low-weight queue; when the data packet is of other types, if the data packet has a corresponding record, it is determined that the data packet is legal, and the data packet is added to the high-weight queue; otherwise, the data packet is illegal, and the data packet is added to the low-weight queue.

When the filtering module updates the connection state table in the case that the data packet is a synchronous packet, it is further used to search the connection state table for the identification of the connection corresponding to the data packet, if not found, the The identifier of the connection corresponding to the data packet is added to the connection state table.

When the data packet is a synchronization/acknowledgment packet, the filter module is further used to search the connection state table for the identification of the connection corresponding to the data packet, and if not found, add the data packet to the The low-weight queue, if found, deletes the connection identifier corresponding to the data packet from the connection state table, adds the source IP address of the data packet to the legal address table, and determines the If the data packet is legal, add the data packet to the high-weight queue.

The filter module is further used to search the source IP address of the data packet in the legal address table when the data packet is of other types, if found, then determine that the data packet is legal, and the The data packet is added to the high-weight queue, otherwise, the data packet is added to the low-weight queue.

The identification is a five-source group of the synchronous data packet of the connection, and the five-source group is composed of source IP address, source port number, destination IP address, destination port number and sequence number.

The detection module is further used to judge whether the high-weight queue is full when adding the data packet to the high-weight queue, and if so, discard the data packet; otherwise, add the data packet to the high-weight queue. weight queue;

The filtering module is further used to judge whether the high-weight queue is full when adding the data packet to the high-weight queue, and if so, discard the data packet; otherwise, add the data packet to the high-weight queue. weight queue;

The filtering module is further used to judge whether the low-weight queue is full when adding the data packet to the low-weight queue, and if so, discard the data packet; otherwise, add the data packet to the low-weight queue. weight queue.

The beneficial effect of the present invention is that it can effectively mitigate, filter and defend against large-scale Syn Flood attacks on network information systems; it does not need to learn traffic characteristics or user behavior in advance, plug and play; it does not require any modification to existing equipment , no need to add other additional equipment; no need to replace the server for TCP three-way handshake, no need to send verification packets, which improves the processing efficiency of the filtering system, reduces the consumption of filtering system and network resources, and effectively solves the problem of filtering under large traffic attacks The problem of the system's own collapse; it has effective defense capabilities against Syn Flood attacks of fake source IP and real source IP.

Description of drawings

Fig. 1 is the flowchart of the filtering method of synchronous flooding attack of the present invention;

Figure 2 is the organization chart of Bloom Filter;

Fig. 3 is the deployment connection diagram of the filtering system of synchronous flooding attack of the present invention;

FIG. 4 is a structural diagram of a filtering system for synchronous flooding attacks in the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings.

The flow process of filtering method is as shown in Figure 1, and the specific implementation steps of filtering method are as follows:

Step S101, initialize parameters.

Configure the ratio of high and low weight queue forwarding packets as r; configure the detection time slot as s, and the unit is second; configure the threshold of the number of Syn packets (synchronous packets) as n, and the unit is the number of packets per second; initialize the current state variable as normal state, The current state variables include attack state and normal state; the initialization timer is 0.

The length of the high-weight queue and the length of the low-weight queue in the system represent the cache space of the low-weight queue and the high-weight queue respectively, and are determined by the processing capacity of the filtering system. In a specific embodiment, the length of the high-weight queue is greater than that of the low-weight queue length; the total forwarding rate is v, the unit is the number of packets per second, which is determined by the processing capability of the protected network information system.

Step S102, receiving a data packet.

Step S103, judging whether the timer is less than s, if yes, execute step S108; otherwise, execute step S104.

Step S104, set the timer to 0, judge whether an attack occurs in the current state, if so, execute step S107, otherwise, execute step S105.

The number of Syn packets counted by the timer from 0 to the current time is N, and the current timer time is t. If N/t is greater than or equal to the threshold n, it is determined that an attack has occurred, otherwise N/t is less than n, it is determined that no attack has occurred.

Step S105, clear the connection status table for recording connections and the legal address table for recording legal IP addresses, determine that the current status is a normal status, and update the current status variable to be a normal status.

Step S106, judging whether the high-weight queue in the buffer is full, discarding the data packet if it is full, otherwise adding the data packet to the high-weight queue.

Among them, the high-weight queue adopts the first-in-first-out method (FIFO method).

Step S107, determine that the current state is the attack state, update the current state variable to be the attack state, and execute step S109.

Step S108, determine the current state of the current state variable record, if the current state is normal, execute step S106, otherwise, execute step S109.

Step S109, determine the type of packet, if the packet is a Syn packet, then execute step S110, if the packet is a Syn/Ack packet (synchronization/confirmation packet), then execute step S111, if the packet is other types, then execute Step S112.

Step S110, look up the quintuple of the data packet in the connection state table, if not found, add the quintuple into the connection state table; execute step S113.

The quintuple of the data packet is composed of source IP, source port, destination IP, destination port, and serial number. The quintuple of the connected Syn packet is the identification of the connection and is recorded in the connection status table.

Step S111, look up the identifier of the connection corresponding to the data packet in the connection state table, if not found, execute step S113, otherwise, execute step S114.

The identification of the connection corresponding to the Syn/Ack packet is the quintuple of the Syn data of the connection, which is equal to the source IP, source port, destination IP, destination port, and sequence number of the Syn/Ack packet minus 1 value.

Step S112, look up the source IP of the data packet in the valid address table, if found, execute step S106, otherwise, execute step S113.

Step S113, judging whether the low-weight queue in the buffer is full, discarding the data packet if it is full, otherwise adding the data packet to the low-weight queue.

Among them, the low-weight queue adopts the first-in-first-out method (FIFO method).

Step S114, delete the connection identifier and quintuple from the connection state table, and add the source IP into the legal address table, and then execute step S106.

Step S115, while performing the above steps, forwarding the data packet.

Judging the current state, if it is an attack state and there are data packets in the buffer, then the data packets in the high-weight queue and low-weight queue will be sent at the rate of r*v/(r+1) and v/(r+1) respectively. Keep forwarding; if it is not in the attack state, then if there are data packets in the high-weight queue, these data packets will be forwarded continuously at the v rate.

The connection state table and the legal address table are both implemented using a publicly available Bloom Filter technology. The organizational structure of Bloom Filter is shown in Figure 2, which consists of k mutually independent hash functions and a hash table with a length of m. Composed of, where k and m are determined by the configuration, the basic process of its main operation is as follows:

Search operation: use each hash function to hash the input data items separately to generate a set of hash values, and check whether the values of a set of buckets corresponding to the set of hash values in the hash table are all 1, if so , it will return the search success, otherwise, it will return the search failure;

Join operation: Use each hash function to hash the input data items to generate a set of hash values, set the value of a set of buckets corresponding to the set of hash values in the hash table to 1, and return.

Delete operation: use each hash function to hash the input data items separately to generate a set of hash values, check whether the values of a group of buckets corresponding to the set of hash values in the hash table are all 1, if so , then set all to 0 and return, otherwise return.

The filtering system disclosed in the present invention has the ability to filter and defend against Syn Flood attacks of the network information system, and is mainly deployed between the access router and the protected network information system. The specific deployment and connection methods can be referred to in FIG. 3 . The filtering system can be connected between the access router and the switch, between the access router and the egress router, or between the access router and the protected server.

Filtering System Structure and Processing Flow As shown in FIG. 4 , the filtering system 400 includes an initialization module 401 , a detection module 402 , a filtering module 403 , a buffer module 404 and a forwarding module 405 .

The specific implementation steps are as follows:

The buffer module 404 includes a low weight queue 441 and a high weight queue 442 .

Wherein, the low-weight queue 441 adopts a first-in-first-out mode (FIFO mode).

Wherein, the high-weight queue 442 adopts a first-in-first-out mode (FIFO mode).

The length of the high-weight queue 442 and the low-weight queue 441 are determined by the processing capability of the filtering system.

The initialization module 401 is used to configure the detection time slot as s; configure the Syn packet number threshold as n; configure the ratio of high and low weight queue forwarding packets as r; initialize the current state variable as a normal state; initialize the timer as 0.

The detection module 402 is used to obtain a data packet from the system entrance, and judges whether the timer is less than s, if less than s, if the current state is a normal state, then judge whether the high weight queue 442 in the buffer module 404 is full, if If the packet is full, the packet is discarded, otherwise the packet is added to the high weight queue 442; if the current state is an attack state, the packet is passed to the filtering module 403; if the timer is greater than or equal to s, then the timer is set to 0 , to determine whether an attack has occurred, if an attack occurs, the current state is modified to the attack state, and the data packet is passed to the filter module 403; if no attack occurs, the connection state table and the legal address table are cleared, and the current state Update to a normal state, judge whether the high-weight queue 442 in the buffer module 404 is full, if full, discard the data packet, otherwise add the data packet to the high-weight queue 442.

The specific method for judging whether an attack has occurred is as follows:

The number of Syn packets counted by the timer from 0 to the current time is N, and the current timer time is t. If N/t is greater than or equal to the threshold n, it is determined that an attack has occurred, otherwise N/t is less than n, it is determined that no attack has occurred.

The filtering module 403 receives a data packet that the detection module 402 transfers to, investigates the type of the data packet, if it is a Syn packet, then searches for the identification of the corresponding connection of the data packet in the connection state table, and this identification is the quintuple of the Syn packet Group <source IP, source port, purpose IP, purpose port, sequence number>, if not found, then this five-tuple is added in the connection state table, judges whether the low weight queue 441 in the buffer module 404 is full, If full then discard this packet, otherwise this packet is added to the low weight queue 441; If it is a Syn/Ack packet, then search the identifier of the connection corresponding to this packet in the connection state table, this identifier is equal to this Syn/Ack The source IP of the Ack packet, the source port, the destination IP, the destination port, the value of the sequence number minus 1, if not found, then judge whether the low weight queue 441 in the buffer module 404 is full, if it is full, then discard the packet , otherwise the packet is added to the low weight queue 441; if found, the five-tuple is deleted in the connection state table, and the source IP is added to the legal address table to determine the high weight in the buffer module 404 Whether queue 442 is full, if full then discard this packet, otherwise this packet is added to high weight queue 442; If not above-mentioned two kinds of packets, then search the source IP of this packet in legal address table, if Found, then judge whether the high-weight queue 442 in the buffer module 404 is full, if full then discard this packet, otherwise this packet is added to the high-weight queue 442, if not found, then judge the buffer module 404 Whether the low-weight queue 441 in is full, if it is full, then discard the packet, otherwise the packet is added to the low-weight queue 441.

The connection state table and the legal address table are both implemented using a publicly available Bloom Filter technology. The organizational structure of Bloom Filter is shown in Figure 2, which consists of k mutually independent hash functions and a hash table with a length of m. Composition, (where k and m are determined by the user), the basic process of its main operation is as follows:

Search operation: use each hash function to hash the input data items separately to generate a set of hash values, and check whether the values of a set of buckets corresponding to the set of hash values in the hash table are all 1, if so , it will return the search success, otherwise, it will return the search failure;

Join operation: Use each hash function to hash the input data items to generate a set of hash values, set the value of a set of buckets corresponding to the set of hash values in the hash table to 1, and return.

Delete operation: use each hash function to hash the input data items separately to generate a set of hash values, check whether the values of a group of buckets corresponding to the set of hash values in the hash table are all 1, if so , then set all to 0 and return, otherwise return.

Forwarding module 405, is used for carrying out simultaneously with above-mentioned process, judges current state, if attack state, if there is data packet in the buffer zone, then press r*v/(r+1) and v/(r+1 respectively ) the data packets in the high-weight queue 442 and the low-weight queue 441 are continuously forwarded from the system exit; Keep forwarding from the system exit.

The total forwarding rate is v, the unit is the number of packets per second, which is determined by the processing capability of the protected network information system.

Various modifications can be made to the above contents by those skilled in the art without departing from the spirit and scope of the present invention defined by the claims. Therefore, the scope of the present invention is not limited to the above description, but is determined by the scope of the claims.

Claims (20)

1. A method for filtering synchronous flooding attacks, comprising: Step 1, configure the ratio of high and low weight queues to forward packets; Step 2, receiving the data packet, determining the current state, and judging whether the current state is a normal state, if yes, the data packet enters the high weight queue, otherwise, execute step 3; Step 3, according to the type of the data packet, the connection state table for recording the connection and the legal address table for recording the legal IP address, judge whether the data packet is legal, if so, then the data packet enters the High weight queue, otherwise, the data packet enters the low weight queue; and update the connection state table and the legal address table; Step 4, when the current state is a normal state, forward the data packet in the high-weight queue, and when the current state is an attack state, forward the low-weight queue and the Packets in high weight queues. 2. the filtering method of synchronous flood attack as claimed in claim 1, is characterized in that, The step 1 also includes configuring the detection time slot, initializing the timer to 0, and initializing the current state variable for recording the current state as normal; Determining the current state in the step 2 is further as follows: Step 21, after receiving the data packet, judge whether the value of the timer is less than the detection time slot, if yes, then determine that the current state is the state recorded in the current state variable, otherwise, set the timer to 0, go to step 22; The step 22 is to determine whether an attack occurs, and if so, update the current state variable to be an attack state, and determine that the current state is an attack state, otherwise, update the current state variable to be a normal state, and determine the current state to normal state. 3. the filtering method of synchronous flood attack as claimed in claim 2, is characterized in that, The step 2 further includes, after step 22 is executed and it is determined that the current state is a normal state, clearing the connection state table and the legal address table. 4. the filtering method of synchronous flood attack as claimed in claim 2 is characterized in that, Said step 1 also includes configuring a synchronization packet threshold; In the step 22, judging whether an attack occurs is further Step 41, judging whether the number of synchronization packets counted within the time counted by the timer divided by the value of the timer is greater than or equal to the synchronization data packet threshold, if yes, then determine that an attack occurs, and determine as normal. 5. the filtering method of synchronous flood attack as claimed in claim 1, is characterized in that, The step 3 is further as follows, Step 51, when the data packet is a synchronization packet, determine that the data packet is illegal, enter the low weight queue, and update the connection state table; Step 52, when the data packet is a synchronization/acknowledgment packet, if the data packet has a corresponding record in the connection state table, the data packet is legal, the data packet enters the high weight queue, and the Connect the state table and the legal address table, otherwise, the data packet is illegal, and the data packet enters a low-weight queue; Step 53, when the data packet is of other types, if the data packet has a corresponding record in the legal address table, it is determined that the data packet is legal, and the data packet enters a high-weight queue, otherwise, the The data packet is invalid, and the data packet enters the low-weight queue. 6. the filtering method of synchronous flood attack as claimed in claim 5 is characterized in that, Updating the connection state table in the step 51 is further as follows: Step 61: Search the connection status table for the identifier of the connection corresponding to the data packet, if not found, add the identifier of the connection corresponding to the data packet to the connection status table. 7. the filtering method of synchronous flood attack as claimed in claim 6 is characterized in that, The step 52 is further as follows, Step 71, when the data packet is a synchronization/acknowledgment packet, search the connection status table for the identification of the connection corresponding to the data packet, if not found, then the data packet enters the low weight queue, if found , then execute step 72; The step 72 is to delete the identification of the connection corresponding to the data packet from the connection state table, add the source IP address of the data packet to the legal address table, and determine that the data packet is legal, The data packet enters the high weight queue. 8. the filtering method of synchronous flood attack as claimed in claim 7 is characterized in that, The step 53 is further to search the source IP address of the data packet in the legal address table when the data packet is of other types, if found, then determine that the data packet is legal, and the data packet enters high weight queue, otherwise, the data packet enters the low weight queue. 9. The filtering method of synchronous flood attack as claimed in claim 6, 7 or 8, is characterized in that, The identification is a five-source group of the synchronous data packet of the connection, and the five-source group is composed of source IP address, source port number, destination IP address, destination port number and sequence number. 10. the filtering method of synchronous flood attack as claimed in claim 1, is characterized in that, The step 2 and the step 3 in which the data packet enters the high-weight queue are further as follows: Judging whether the high-weight queue is full, if so, discarding the data packet, otherwise adding the data packet to the high-weight queue; The data packet in the step 3 entering the low weight queue is further as follows: Judging whether the low-weight queue is full, if so, discarding the data packet, otherwise adding the data packet to the low-weight queue. 11. A filtering system for synchronous flooding attack, comprising: a detection module, a filtering module, a buffer module and a forwarding module, The buffer module includes a low-weight queue and a high-weight queue; The initialization module is used to configure the ratio of high and low weight queues to forward data packets; The detection module is used to receive data packets, determine the current state, and judge whether the current state is a normal state, if so, add the data packets to the high-weight queue, otherwise, transmit the data packets to to the filter module; The filter module is used to judge whether the data packet is legal according to the type of the data packet, the connection state table used to record the connection and the legal address table used to record the legal IP address, and if so, the The data packet is added to the high weight queue, otherwise, the data packet is added to the low weight queue; and the connection state table and the legal address table are updated; The forwarding module is configured to forward the data packets in the high-weight queue when the current state is a normal state, and forward the low-weight queue according to the ratio of forwarding data packets in the high-weight queue when the current state is an attack state queue and the packets in the high weight queue. 12. The filtering system of synchronous flood attack as claimed in claim 11, is characterized in that, The initialization module is also used to configure the detection time slot, the initialization timer is 0, and the initialization of the current state variable used to record the current state is normal; The detection module is further used to determine whether the value of the timer is less than the detection time slot after receiving the data packet when determining the current state, and if so, determine that the current state is the state recorded in the current state variable ; Otherwise, the timer is set to 0, and it is judged whether an attack occurs, and if so, the current state variable is updated to be an attack state, and the current state is determined to be an attack state, otherwise, the current state variable is updated to be normal state, determining that the current state is a normal state. 13. The filtering system of synchronous flood attack as claimed in claim 12, is characterized in that, The detection module is further configured to clear the connection state table and the legal address table after determining that the current state is a normal state by judging that no attack has occurred. 14. The filtering system of synchronous flood attack as claimed in claim 12, is characterized in that, The initialization module is also used to configure the synchronization data packet threshold; When determining whether an attack occurs, the detection module is further used to determine whether the value obtained by dividing the number of synchronization packets counted within the timing time of the timer by the value of the timer is greater than or equal to the synchronization data packet threshold, if yes , it is determined that an attack has occurred, and the above is determined to be normal. 15. The filtering system of synchronous flood attack as claimed in claim 11, is characterized in that, The filtering module is further used for determining that the data packet is illegal when the data packet is a synchronous packet, adding the data packet to the low-weight queue, and updating the connection state table; When it is a synchronization/acknowledgment packet, if the data packet has a corresponding record in the connection state table, the data packet is legal, the data packet is added to the high weight queue, and the connection state table and the connection state table are updated. Otherwise, the data packet is illegal, and the data packet is added to the low-weight queue; when the data packet is of other types, if the data packet has a corresponding record, it is determined that the data packet is legal, and the data packet is added to the high-weight queue; otherwise, the data packet is illegal, and the data packet is added to the low-weight queue. 16. The filtering system of synchronous flood attack as claimed in claim 15, is characterized in that, When the filtering module updates the connection state table in the case that the data packet is a synchronous packet, it is further used to search the connection state table for the identification of the connection corresponding to the data packet, if not found, the The identifier of the connection corresponding to the data packet is added to the connection state table. 17. The filtering system of synchronous flood attack as claimed in claim 16, is characterized in that, When the data packet is a synchronization/acknowledgment packet, the filter module is further used to search the connection state table for the identification of the connection corresponding to the data packet, and if not found, add the data packet to the The low-weight queue, if found, deletes the connection identifier corresponding to the data packet from the connection state table, adds the source IP address of the data packet to the legal address table, and determines the If the data packet is legal, add the data packet to the high-weight queue. 18. The filtering system of synchronous flood attack as claimed in claim 17, is characterized in that, The filter module is further used to search the source IP address of the data packet in the legal address table when the data packet is of other types, if found, then determine that the data packet is legal, and the The data packet is added to the high-weight queue, otherwise, the data packet is added to the low-weight queue. 19. The filtering system of synchronous flood attack as claimed in claim 16, 17 or 18, is characterized in that, The identification is a five-source group of the synchronous data packet of the connection, and the five-source group is composed of source IP address, source port number, destination IP address, destination port number and sequence number. 20. The filtering system of synchronous flood attack as claimed in claim 11, is characterized in that, The detection module is further used to judge whether the high-weight queue is full when adding the data packet to the high-weight queue, and if so, discard the data packet; otherwise, add the data packet to the high-weight queue. weight queue; The filtering module is further used to judge whether the high-weight queue is full when adding the data packet to the high-weight queue, and if so, discard the data packet; otherwise, add the data packet to the high-weight queue. weight queue; The filtering module is further used to judge whether the low-weight queue is full when adding the data packet to the low-weight queue, and if so, discard the data packet; otherwise, add the data packet to the low-weight queue. weight queue.

Images