*8(9)0+=POILK.?/:;“;DeleteReturnshiftoption防御DDoS攻击态势报告DDoS Attack Landscape2019UDP FloodICMP FloodACK FloodSYN Flood关于中国电信云堤2008年以来，中国电信开始着力于网络DDoS攻击防护能力建设，已形成了覆盖国内31省和亚太、欧洲、北美等主要POP点一体化攻击防御能力。2014年，中国电信首次在业界系统性提出电信级网络集约化安全能力开放平台框架，并将“云堤”作为对外服务的统一品牌。“保障网络安全、提供一流服务”，中国电信除了持续加强高效、可靠、精确、可开放的DDoS攻击防护能力建设外，继续加大网络资源和能力的开放力度，陆续推出网站安全、域名安全、反欺诈和APP合法合规等产品。目前已为政务、金融、教育、医疗、互联网、能源制造等数千家行业客户提供运营商级网络安全服务。关于绿盟科技北京神州绿盟信息安全科技股份有限公司（以下简称绿盟科技公司），成立于2000年4月，总部位于北京。公司于2014年1月29日在深圳证券交易所创业板上市，证券代码：300369。绿盟科技在国内设有40多个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗等行业用户，提供全线网络安全产品、全方位安全解决方案和体系化安全运营服务。公司在美国硅谷、日本东京、英国伦敦、新加坡设立海外子公司，深入开展全球业务，打造全球网络安全行业的中国品牌。版权声明本文中出现的任何文字叙述、文档格式、插图、照片、方法、过程等内容，除另有特别注明，版权均属绿盟科技所有，受到有关产权及版权法保护。任何个人、机构未经绿盟科技的书面授权许可，不得以任何方式复制或引用本文的任何片断。A目录1. 执行摘要 ·······························································································································································22. 2019 年 DDoS 攻击态势概览 ·······························································································································42.1 2019 vs 2018 ··············································································································································································· 52.2 重要观点 ······················································································································································································· 53. 2019 年 DDoS 攻击分析 ······································································································································63.1 DDoS 攻击次数和流量峰值情况 ··············································································································································· 73.1.1 攻击峰值分布 ······························································································································································································73.1.2 DDoS 攻击次数和攻击流量 ······································································································································································· 93.1.3 单次攻击最高和平均峰值 ·······································································································································································113.2 DDoS 攻击类型分析 ·································································································································································123.2.1 攻击类型占比 ····························································································································································································123.2.2 攻击类型各流量区间分布 ·······································································································································································163.2.3 反射攻击 ····································································································································································································173.3 DDoS 攻击时间刻画 ·································································································································································183.3.1 DDoS 攻击持续时间占比 ·········································································································································································183.3.2 一天中 DDoS 攻击活动分布 ····································································································································································183.3.3 一周中 DDoS 攻击活动分布 ···································································································································································193.4 DDoS 攻击地域分布 ·································································································································································203.4.1 DDoS 受控攻击源地域分布 ·····································································································································································203.4.2 DDoS 攻击目标地域分布 ·········································································································································································213.4.3 DDoS 控制端地域分布 ·············································································································································································223.5 攻击资源行为分析 ····································································································································································233.5.1 攻击资源活跃度分析 ················································································································································································233.5.2 活跃攻击资源地域分布 ············································································································································································243.5.3 攻击资源惯犯分析 ····················································································································································································253.5.4 攻击资源异常行为类型分析 ···································································································································································253.5.5 攻击资源团伙行为分析 ············································································································································································263.6 物联网攻击资源分析 ································································································································································343.6.1 异常物联网设备的 DDoS 参与度分析 ···················································································································································343.6.2 参与 DDoS 攻击的物联网设备的地域分布 ···········································································································································353.6.3 参与 DDoS 攻击的物联网设备类型分布 ···············································································································································363.7 DDoS 僵尸网络 ··········································································································································································373.7.1 僵尸网络概览 ····························································································································································································373.7.2 热点家族 ····································································································································································································404. 总结 ·····································································································································································432019 DDoS攻击态势报告2执行摘要1. 执行摘要1执行摘要2019 DDoS攻击态势报告3执行摘要2019 年，我们发现 DDoS 攻击的平均峰值与 2018 年相比稳中有升，达 42.9Gbps，体现中大规模攻击的技术成熟度在逐年提升。超大型 DDoS 攻击事件在 2018 年急剧增长后逐年稳步增长， 2019 年300Gbps 以上的超大规模攻击与 2018 年相比，增长了 200 余次。从攻击总流量来看， 2019 年攻击总流量相比于 2018 年却下降了 26.4%，体现出整体攻击者的攻击意愿并没有随着技术成熟度同步上升。比特币市场的走强和僵尸网络的功能迁移可能是主要的原因。僵尸网络不再局限于单一的 DDoS 或者远控功能，或选择与勒索软件，挖矿木马合作进行攻击，或转向分布式爆破攻击。功能的丰富和切换的灵活性使得黑灰产攻击者能够紧密跟随市场趋势，最大化自身获利。另一方面，物联网设备的 DDoS 攻击参与度在逐年提升，全年参与 DDoS 攻击的物联网攻击资源近17 万，在我们发现的 DDoS 团伙中单一团伙最高包含 2.8 万物联网攻击资源，占比高达 31%。物联网设备数量众多，在线时间长，漏洞更新周期长，成为攻击者漏洞利用的温床，需要我们进一步加强感知、预防和治理。本报告的第二章的是 2019 年的 DDoS 攻击态势概览。在第三章，本文从攻击次数、流量、攻击类型、时间、地域等多个维度，以及从攻击资源、团伙性行为、物联网和僵尸网络四个视角，力求全面剖析 2019 年的 DDoS 的变化和演进，以便抛砖引玉，帮助各组织 / 机构持续改善自身网络安全防御体系及技术。1执行摘要2019 DDoS攻击态势报告42019 年 DDoS 攻击态势概览2. 2019 年 DDoS 攻击态势概览22019年DDoS攻击态势概览2019 DDoS攻击态势报告52019 年 DDoS 攻击态势概览2.1 2019 vs 20181. 攻击次数增加了 30.2%，攻击总流量下降了 26.4%2. 1-5Gbps 小规模攻击显著增加，300Gbps 以上的大规模攻击小幅增加3. 平均峰值小幅增长，达 42.9Gbps，中大规模攻击的技术成熟度在逐年提高4. UDP Flood、SYN Flood 和 ACK Flood 依然是 DDoS 的主要攻击手法，混合攻击在超大规模攻击中发挥重要作用5. 物联网设备的 DDoS 攻击参与度逐年提升6. IoT 家族的漏洞利用载荷组成与 2018 年类似，主要攻击物联网智能设备，同时攻击手段增多，在攻击链上的角色出现了分工态势2.2 重要观点1. 成熟：攻击者的技术成熟度在稳步提升，攻击者在 DDoS 外存在更多获利选择。2. 混合：12.5% 的 DDoS 攻击事件使用了多种攻击手法，在 300Gbps 以上的超大规模攻击中逾 3成攻击都采用了混合攻击模式，对清洗设备性能和清洗线路的稳定，以及防护运营提出了更大的挑战。3. 惯犯：2019 年全年 DDoS 惯犯（攻击次数大于 20 次）达 130 万，其中 7% 的惯犯承担了 78%的攻击事件，惯犯行为值得持续关注。 4. 团伙： 全年发现 DDoS团伙 60个，攻击资源数量大于 1000的团伙达 15个，最大攻击团伙包含 8.8万攻击源，月均活跃 3.5 万攻击源，团伙行为和攻击团伙的治理值得持续关注。5. 物联网：物联网设备参与 DDoS 攻击的情况值得持续关注，参与 DDoS 攻击的物联网设备逐年增加，DDoS 团伙中单一团伙最高物联网设备占比达 31%。6. 恶意家族： IoT 平台家族攻击占比进一步扩大， Gafgyt 和 Mirai 贡献了大部分攻击行为，但整体上，在 DDoS 特征、攻击目标和 C&C 分布等方面没有明显变化。7. 地域：国内，香港取代浙江成为受 DDoS 攻击最多的省份，其它依次是浙江、广东、北京、江苏。2019 DDoS攻击态势报告62019 年 DDoS 攻击分析3. 2019 年 DDoS 攻击分析32019年DDoS攻击分析2019 DDoS攻击态势报告72019 年 DDoS 攻击分析3.1 DDoS攻击次数和流量峰值情况3.1.1 攻击峰值分布从最近三年各月数据来看，攻击峰值在 100Gbps 以上的大型攻击的次数在 2018 年大幅攀升后，连续两年在高位波动。 2017 年全年 100Gbps 以上的大型攻击为 1.18 万次，仅为 2018 年的 48%（全年2.45 万次）。2019 年，100Gbps 以上的大型攻击发生了 2.14 万次（截止至 2019 年 11 月），与 2018年同期的 2.2 万次基本持平。与此同时， 300Gbps 以上的超大规模攻击在逐年递增，从 2017 平均每月30 次增长到 2018 年平均每月 247 次后，在 2019 年小幅增长到平均每月 262 次，超大规模攻击次数持续增长已经成为常态。2017年 Apr Jul Oct 2018年 Apr Jul Oct 2019年 Apr Jul Oct100Gbps以上攻击次数300Gbps以上攻击次数图 3.1 大流量攻击的次数变化数据来源：中国电信云堤2019 DDoS攻击态势报告82019 年 DDoS 攻击分析在全部 DDoS 攻击中， 22.2% 的攻击峰值在 1-5Gbps 之间，在所有区间中占比最高。与 2018 年相比，攻击峰值分布向单侧分化，攻击峰值 10Gbps 以下的小规模 DDoS 攻击有所增加，占全部攻击的49.9%，1-5Gbps 的小规模攻击比例成倍增加。15.6%22.2%12.1%12.5%16.0%9.5%7.4%3.3%1.6%2018年 2019年大于300G200-300G100-200G50-100G20-50G10-20G5-10G1-5G小于1G图 3.2 攻击峰值分布数据来源：中国电信云堤从各季度来看， DDoS 攻击峰值在 20Gbps 以下的小型攻击持续增加，在进入 Q4 后，小型攻击在全部攻击中占比 66%，特别是在 Q2，5Gbps 以下的小规模攻击占了全部攻击的 41.5%。300Gbps 以上的超大规模攻击整体占比减少但绝对数量小幅增长，截止 2019 年 11 月全年共发生了 2884 次，同比2018 年的 2673 次小幅增加。对比 2017 年全年 300Gbps 以上的超大规模攻击只有 350 次，近两年的超大规模攻击均增长 6 倍以上。