\u8b93\u6211\u5011\u4f86\u770b\u4e00\u500b\u4f7f\u7528Python\u5be6\u73fe\u57fa\u672c\u8ffd\u8e64\u7cfb\u7d71\u7684\u5be6\u969b\u793a\u4f8b\uff1a<\/p>\n

\r\nimport numpy as np\r\nfrom scapy.all import *\r\n\r\ndef analyze_packet_patterns(pcap_file):\r\n    packets = rdpcap(pcap_file)\r\n    src_ips = {}\r\n    \r\n    for pkt in packets:\r\n        if IP in pkt:\r\n            src = pkt[IP].src\r\n            if src in src_ips:\r\n                src_ips[src] += 1\r\n            else:\r\n                src_ips[src] = 1\r\n    \r\n    # \u8b58\u5225\u6f5b\u5728\u653b\u64ca\u6e90\r\n    threshold = np.mean(list(src_ips.values())) + 2*np.std(list(src_ips.values()))\r\n    suspicious_ips = {ip: count for ip, count in src_ips.items() if count > threshold}\r\n    \r\n    return suspicious_ips\r\n<\/code><\/pre>\n
\u5be6\u65bd\u5373\u6642\u9632\u79a6\u7cfb\u7d71<\/strong><\/h2>\n
\u73fe\u4ee3\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u9700\u8981\u81ea\u52d5\u5316\u9632\u79a6\u6a5f\u5236\u3002\u8003\u616e\u9019\u500bnginx\u901f\u7387\u9650\u5236\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n
\r\nhttp {\r\n    limit_req_zone $binary_remote_addr zone=one:10m rate=30r\/s;\r\n    \r\n    server {\r\n        location \/ {\r\n            limit_req zone=one burst=10 nodelay;\r\n            proxy_pass http:\/\/backend;\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\n
\u7f8e\u570b\u4f3a\u670d\u5668\u4fdd\u8b77\u7b56\u7565<\/strong><\/h2>\n
\u5c0d\u65bc\u7f8e\u570b\u7684\u4f3a\u670d\u5668\u8a17\u7ba1\u548c\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\uff0c\u5be6\u65bd\u5f37\u5927\u7684\u4fdd\u8b77\u9700\u8981\u5168\u9762\u7684\u65b9\u6cd5\u3002\u8b93\u6211\u5011\u4f86\u770b\u4e00\u500b\u6709\u6548\u7684iptables\u57fa\u7dda\u4fdd\u8b77\u914d\u7f6e\uff1a<\/p>\n
\r\n# iptables\u901f\u7387\u9650\u5236\u914d\u7f6e\r\niptables -A INPUT -p tcp --dport 80 -m string --string \"GET \/wp-login.php\" --algo bm -m recent --name wp_login --set\r\niptables -A INPUT -p tcp --dport 80 -m string --string \"GET \/wp-login.php\" --algo bm -m recent --name wp_login --rcheck --seconds 60 --hitcount 10 -j DROP\r\n\r\n# \u9632\u8b77SYN\u6cdb\u6d2a\r\niptables -N syn_flood\r\niptables -A INPUT -p tcp --syn -j syn_flood\r\niptables -A syn_flood -m limit --limit 1\/s --limit-burst 3 -j RETURN\r\niptables -A syn_flood -j DROP\r\n<\/code><\/pre>\n
\u81ea\u52d5\u56de\u61c9\u7cfb\u7d71<\/strong><\/h2>\n
\u4ee5\u4e0b\u662f\u4e00\u500b\u6f14\u793a\u8207\u5e38\u898b\u4f3a\u670d\u5668\u79df\u7528\u63a7\u5236\u9762\u677f\u6574\u5408\u7684\u81ea\u52d5\u56de\u61c9\u7cfb\u7d71\u7684Python\u8173\u672c\uff1a<\/p>\n
\r\nfrom datetime import datetime\r\nimport subprocess\r\nimport re\r\n\r\nclass DDOSMonitor:\r\n    def __init__(self, threshold=1000):\r\n        self.threshold = threshold\r\n        self.connection_count = {}\r\n        \r\n    def check_connections(self):\r\n        netstat = subprocess.check_output(\r\n            \"netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n\",\r\n            shell=True\r\n        ).decode()\r\n        \r\n        for line in netstat.split('\\n'):\r\n            if line:\r\n                count, ip = re.match(r'\\s*(\\d+)\\s+([\\d.]+)', line).groups()\r\n                if int(count) > self.threshold:\r\n                    self.block_ip(ip)\r\n    \r\n    def block_ip(self, ip):\r\n        subprocess.run([\r\n            'iptables',\r\n            '-A', 'INPUT',\r\n            '-s', ip,\r\n            '-j', 'DROP'\r\n        ])\r\n        self.log_attack(ip)\r\n\r\n    def log_attack(self, ip):\r\n        with open('\/var\/log\/ddos_monitor.log', 'a') as f:\r\n            f.write(f\"{datetime.now()}: \u5df2\u5c01\u9396IP {ip} \u56e0\u904e\u591a\u9023\u63a5\\n\")\r\n<\/code><\/pre>\n
\u6cd5\u5f8b\u5408\u898f\u6027\u548c\u6587\u4ef6\u8a18\u9304<\/strong><\/h2>\n
\u5728\u8ffd\u8e64\u91dd\u5c0d\u7f8e\u570b\u4f3a\u670d\u5668\u7684DDoS\u653b\u64ca\u8005\u6642\uff0c\u4fdd\u6301\u9069\u7576\u7684\u6587\u4ef6\u8a18\u9304\u5c0d\u65bc\u53ef\u80fd\u7684\u6cd5\u5f8b\u884c\u52d5\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u8a18\u9304\u4e8b\u4ef6\u7684\u7d50\u69cb\u5316\u65b9\u6cd5\uff1a<\/p>\n
\n
\u653b\u64ca\u958b\u59cb\u6642\u9593\u6233\u8a18<\/li>\n
\u7db2\u8def\u6d41\u91cf\u6355\u7372(pcap\u6a94\u6848)<\/li>\n
\u7cfb\u7d71\u8cc7\u6e90\u4f7f\u7528\u65e5\u8a8c<\/li>\n
\u5df2\u5be6\u65bd\u7684\u7de9\u89e3\u63aa\u65bd<\/li>\n
\u5f71\u97ff\u8a55\u4f30\u6587\u4ef6<\/li>\n<\/ul>\n
\u6848\u4f8b\u7814\u7a76\u5206\u6790<\/strong><\/h2>\n
\u8b93\u6211\u5011\u4f86\u5206\u6790\u4e00\u6b21\u91dd\u5c0d\u4e3b\u8981\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u7684\u6700\u8fd1DDoS\u653b\u64ca\u3002\u8a72\u653b\u64ca\u63a1\u7528\u4e86\u8907\u96dc\u7684\u591a\u5411\u91cf\u65b9\u6cd5\uff0c\u7d50\u5408\u4e86\u5bb9\u91cf\u578bUDP\u6cdb\u6d2a\u548c\u61c9\u7528\u5c64\u653b\u64ca\u3002\u4ee5\u4e0b\u662f\u653b\u64ca\u6a21\u5f0f\u7684\u5206\u6790\uff1a<\/p>\n
\r\n# \u653b\u64ca\u6a21\u5f0f\u5206\u6790\r\n\u6642\u9593: 2024-01-10 15:30 UTC\r\n\u5cf0\u503c\u6d41\u91cf: 850 Gbps\r\n\u653b\u64ca\u5411\u91cf: \r\n- UDP\u6cdb\u6d2a (\u9023\u63a5\u57e0 53)\r\n- HTTP GET\u6cdb\u6d2a\r\n- TCP SYN\u6cdb\u6d2a\r\n\r\n# \u7de9\u89e3\u56de\u61c9\r\niptables -A INPUT -p udp --dport 53 -m u32 --u32 \"0>>22&0x3C@ 12>>26&0x3C@ 0&0xFFFFFFFF=0x00000000\" -j DROP\r\n<\/code><\/pre>\n
\u6548\u80fd\u5f71\u97ff\u8a55\u4f30<\/strong><\/h2>\n
\u5728DDoS\u4e8b\u4ef6\u671f\u9593\uff0c\u76e3\u63a7\u7cfb\u7d71\u6548\u80fd\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u5373\u6642\u6548\u80fd\u8ffd\u8e64\u7684Python\u8173\u672c\uff1a<\/p>\n
\r\nimport psutil\r\nimport time\r\nfrom collections import deque\r\n\r\nclass SystemMonitor:\r\n    def __init__(self, window_size=60):\r\n        self.cpu_history = deque(maxlen=window_size)\r\n        self.network_history = deque(maxlen=window_size)\r\n        \r\n    def collect_metrics(self):\r\n        # CPU\u4f7f\u7528\u7387\r\n        cpu_percent = psutil.cpu_percent(interval=1)\r\n        \r\n        # \u7db2\u8defI\/O\r\n        net_io = psutil.net_io_counters()\r\n        bytes_sent = net_io.bytes_sent\r\n        bytes_recv = net_io.bytes_recv\r\n        \r\n        self.cpu_history.append(cpu_percent)\r\n        self.network_history.append((bytes_sent, bytes_recv))\r\n        \r\n        return {\r\n            'cpu': cpu_percent,\r\n            'network': {\r\n                'sent': bytes_sent,\r\n                'received': bytes_recv\r\n            }\r\n        }\r\n\r\n    def detect_anomaly(self):\r\n        if len(self.cpu_history) < 10:\r\n            return False\r\n            \r\n        avg_cpu = sum(self.cpu_history) \/ len(self.cpu_history)\r\n        return avg_cpu > 85.0\r\n<\/code><\/pre>\n
\u672a\u4f86\u9632\u79a6\u7b56\u7565\u7684\u898f\u5283<\/strong><\/h2>\n
\u96a8\u8457DDoS\u653b\u64ca\u6301\u7e8c\u6f14\u8b8a\uff0c\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u5fc5\u9808\u8abf\u6574\u5176\u9632\u79a6\u7b56\u7565\u3002\u4e3b\u8981\u5efa\u8b70\u5305\u62ec\uff1a<\/p>\n
\n
\u5be6\u65bd\u57fa\u65bcAI\u7684\u6d41\u91cf\u5206\u6790<\/li>\n
\u8de8\u5730\u7406\u5340\u57df\u7684\u5206\u6563\u5f0f\u76e3\u63a7\u7bc0\u9ede<\/li>\n
\u5b9a\u671f\u5b89\u5168\u7a3d\u6838\u548c\u6ef2\u900f\u6e2c\u8a66<\/li>\n
\u8207\u5168\u7403\u5a01\u8105\u60c5\u5831\u7db2\u8def\u6574\u5408<\/li>\n<\/ul>\n
\u7d50\u8ad6<\/strong><\/h2>\n
\u6709\u6548\u7684DDoS\u6aa2\u6e2c\u548c\u99ed\u5ba2\u8ffd\u8e64\u9700\u8981\u7d50\u5408\u6280\u8853\u5c08\u9577\u3001\u9069\u7576\u7684\u5de5\u5177\u548c\u7cfb\u7d71\u65b9\u6cd5\u3002\u5c0d\u65bc\u7f8e\u570b\u4f3a\u670d\u5668\u8a17\u7ba1\u548c\u4f3a\u670d\u5668\u79df\u7528\u63d0\u4f9b\u5546\u4f86\u8aaa\uff0c\u5728\u4fdd\u6301\u6cd5\u5f8b\u5408\u898f\u6027\u7684\u540c\u6642\u9818\u5148\u65bc\u65b0\u8208\u5a01\u8105\u81f3\u95dc\u91cd\u8981\u3002\u900f\u904e\u5be6\u65bd\u672c\u6307\u5357\u4e2d\u6982\u8ff0\u7684\u7b56\u7565\u548c\u5de5\u5177\uff0c\u7d44\u7e54\u53ef\u4ee5\u66f4\u597d\u5730\u4fdd\u8b77\u5176\u57fa\u790e\u8a2d\u65bd\u514d\u53d7\u8907\u96dc\u7684DDoS\u653b\u64ca\u3002<\/p>\n
\u8acb\u8a18\u4f4f\uff0cDDoS\u9632\u8b77\u662f\u4e00\u500b\u9700\u8981\u6301\u7e8c\u8b66\u60d5\u548c\u9069\u61c9\u65b0\u653b\u64ca\u5411\u91cf\u7684\u6301\u7e8c\u904e\u7a0b\u3002\u5b9a\u671f\u66f4\u65b0\u5b89\u5168\u5354\u5b9a\u548c\u6301\u7e8c\u76e3\u63a7\u7db2\u8def\u6a21\u5f0f\u5c0d\u65bc\u5728\u7576\u4eca\u7684\u5a01\u8105\u74b0\u5883\u4e2d\u7dad\u8b77\u5f37\u5927\u7684\u4f3a\u670d\u5668\u4fdd\u8b77\u4ecd\u7136\u81f3\u95dc\u91cd\u8981\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5728\u4e0d\u65b7\u767c\u5c55\u7684\u7db2\u8def\u5b89\u5168\u9818\u57df\uff0cDDoS\u653b\u64ca\u4ecd\u7136\u662f\u5c0d\u4f3a\u670d\u5668\u57fa\u790e\u8a2d\u65bd\u548c\u7db2\u8def\u7a69\u5b9a\u6027\u6700\u6301\u7e8c\u7684\u5a01\u8105\u4e4b\u4e00\u3002\u5c0d\u65bc\u7ba1\u7406\u7f8e\u570b\u4f3a\u670d\u5668\u79df […]<\/p>\n
Read More…<\/a><\/p>\n","protected":false},"author":3,"featured_media":21758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4815],"tags":[6087,6088,6089,2599,578],"class_list":["post-21761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-america-dedicated-server-tc","tag-ddos-detection-tc","tag-hacker-tracking-tc","tag-us-hosting-security-tc","tag-2599","tag-network-security-tc"],"acf":[],"yoast_head":"\n