Abstract: In recent years,the frequency and scale of DDOS attacks have increased,which has posed great challenges to network security.Among them,UDP reflection amplification attacks have become the attack method favored by hackers due to their low attack cost,huge attack traffic,and difficulty in tracing the source.Most of the current filtering and defense strategies are derived from the analysis and review after the attack,and there is a certain degree of passivity and lag in the face of the endless new UDP reflection attacks.This paper proposes a method based on traffic analysis to discover undisclosed protocols with the potential of UDP reflection amplification.Based on the two fundamental characteristics of magnification and reflectivity,this method selects traffic samples that meet the characteristics of reflective amplification from daily network traffic.Then,the replay attack is used to verify whether the samples are repeatable,and the qualified samples are recorded for research on related service protocols.Finally,a new type of undisclosed reflection amplification protocol is successfully discovered.The detection program constructed with this method has been tested for accuracy and processing rate in the experimental environment and the Internet respectively,and a variety of reflection amplification protocols are found to proactively defend against possible reflection amplification attacks.

Key words: DDOS, UDP reflection amplification attack, Cyber security, Flow detection, Active defense