2016年DDoS威胁报告

DDoS2016威胁报告DDoS THREAT REPORT © 2017中国电信云堤&绿盟科技 关于绿盟科技北京神州绿盟信息安全科技股份有限公司（简称绿盟科技）成立于2000年4月，总部位于北京。在国内外设有30多个分支机构，为政府、运营商、金融、能源、互联网以及教育、医疗等行业用户，提供具有核心竞争力的安全产品及解决方案，帮助客户实现业务的安全顺畅运行。基于多年的安全攻防研究，绿盟科技在网络及终端安全、互联网基础安全、合规及安全管理等领域，为客户提供入侵检测/防护、抗拒绝服务攻击、远程安全评估以及Web安全防护等产品以及专业安全服务。北京神州绿盟信息安全科技股份有限公司于2014年1月29日起在深圳证券交易所创业板上市交易。股票简称：绿盟科技 股票代码：300369关于中国电信云堤2008年以来，中国电信开始着力于网络DDoS攻击防护能力建设，已形成了覆盖国内31省和亚太、欧洲、北美等主要POP点的一体化攻击防御能力。2014年，中国电信首次在业界系统性提出电信级网络集约化安全能力开放平台框架，并将“云堤”作为对外服务的统一品牌。几年来，中国电信云堤一方面致力于高效、可靠、精确、可开放的DDoS攻击防护能力建设，同时，面向政企客户提供运营商级DDoS攻击防护服务。目前已涵盖互联网、金融、能源制造、政府机构等各个行业。 1. 2016 DDoS态势概览 ············································································1 2016 DDoS攻击者画像 ········································································32. 2016 DDoS攻击趋势 ············································································52.1 DDoS攻击次数和流量峰值 ············································································62.1.1 DDoS攻击次数和攻击流量 ································································································62.1.2 攻击峰值各区间分布 ···········································································································72.1.3 大流量攻击事件频发 ···········································································································72.2 DDoS攻击发生和持续时间 ············································································92.2.1 DDoS攻击发生时间 ············································································································92.2.2 DDoS攻击持续时间 ··········································································································112.2.3 DDoS攻击峰值vs.攻击持续时长 ··················································································122.3 DDoS攻击类型分析 ······················································································122.3.1 各攻击类型次数和流量占比 ····························································································122.3.2 攻击类型各流量区间分布 ································································································132.3.3 混合攻击分析 ·····················································································································142.3.4 反射攻击类型分析 ·············································································································152.4 DDoS攻击分布情况 ······················································································182.4.1 DDoS攻击受控攻击源国家 ······························································································182.4.2 DDoS攻击来源发起网络 ··································································································182.4.3 中国各省份受控攻击源分析 ····························································································192.4.4 全球DDoS攻击目标国家占比 ························································································202.4.5 中国DDoS攻击目标各省份占比 ····················································································213. 2016僵尸网络发展情况 ·····································································233.1 BotMaster全球分布 ·····················································································243.2 Bot端国内分布 ······························································································253.3 物联网僵尸网络的扩张 ·················································································263.3.1 Mirai物联网僵尸网络 ·······································································································263.3.2 台风DDoS物联网僵尸网络 ·····························································································293.3.3 物联网僵尸网络资源的争夺 ····························································································303.4 物联网的治理 ·································································································324. DDoS热点攻击事件 ············································································354.1 万物互联时代，物联网成僵尸网络新宠 ····················································364.2 勒索软件整合DDoS攻击能力，进一步挖掘黑产利益 ···························394.3 攻击者使用DDoS攻击作为其他犯罪活动的烟雾弹 ································394.4 政府、金融、游戏行业依然是DDoS攻击重灾区 ····································405. DDoS防护趋势 ····················································································435.1 智能、敏捷、可运营 ·····················································································445.2 基于威胁情报的DDoS防护 ·········································································455.3 本地+云端的混合清洗方案 ········································································46结束语 ······································································································49作者 ························································································································49DDoS威胁报告 ····································································································49目录 如果您需要了解更多信息，请手机扫码关注：中国电信云堤官微绿盟科