2016 DDoS 威胁报告 m o c . 5 DD oS THREAT REPOR T h t i g b u © 2017 中国电信云堤 & 绿盟科技 关于中国电信云堤 2008 年以来，中国电信开始着力于网络 DDoS 攻击防 护能力建设，已形成了覆盖国内 31 省和亚太、欧洲、北美 等主要 POP 点的一体化攻击防御能力。2014 年，中国电信 首次在业界系统性提出电信级网络集约化安全能力开放平台 m o 框架，并将“云堤”作为对外服务的统一品牌。 几年来，中国电信云堤一方面致力于高效、可靠、精确、 可开放的 DDoS 攻击防护能力建设，同时，面向政企客户提 c . 5 供运营商级 DDoS 攻击防护服务。目前已涵盖互联网、金融、 能源制造、政府机构等各个行业。 关于绿盟科技 h t i g b u 北京神州绿盟信息安全科技股份有限公司（简称绿盟科 技）成立于 2000 年 4 月，总部位于北京。在国内外设有 30 多个分支机构，为政府、运营商、金融、能源、互联网以及教育、 医疗等行业用户，提供具有核心竞争力的安全产品及解决方 案，帮助客户实现业务的安全顺畅运行。 基于多年的安全攻防研究，绿盟科技在网络及终端安全、 互联网基础安全、合规及安全管理等领域，为客户提供入侵 检测 / 防护、抗拒绝服务攻击、远程安全评估以及 Web 安全 防护等产品以及专业安全服务。 北京神州绿盟信息安全科技股份有限公司于 2014 年 1 月 29 日起在深圳证券交易所创业板上市交易。 股票简称：绿盟科技　股票代码：300369 目录 1. 2016 DDoS 态势概览 ············································································1 2016 DDoS 攻击者画像 ········································································ 3 2. 2016 DDoS 攻击趋势 ············································································5 2.1 DDoS 攻击次数和流量峰值············································································6 2.1.1 DDoS 攻击次数和攻击流量································································································ 6 2.1.2 攻击峰值各区间分布··········································································································· 7 2.1.3 大流量攻击事件频发··········································································································· 7 2.2 DDoS 攻击发生和持续时间············································································9 2.2.1 DDoS 攻击发生时间 ············································································································ 9 2.2.2 DDoS 攻击持续时间 ·········································································································· 11 m o 2.2.3 DDoS 攻击峰值 vs. 攻击持续时长 ·················································································· 12 2.3 DDoS 攻击类型分析 ······················································································12 2.3.1 各攻击类型次数和流量占比 ···························································································· 12 c . 5 2.3.2 攻击类型各流量区间分布 ································································································ 13 2.3.3 混合攻击分析 ····················································································································· 14 2.3.4 反射攻击类型分析 ············································································································· 15 2.4 DDoS 攻击分布情况 ······················································································18 b u 2.4.1 DDoS 攻击受控攻击源国家······························································································ 18 2.4.2 DDoS 攻击来源发起网络·································································································· 18 2.4.3 中国各省份受控攻击源分析 ···························································································· 19 h t i g 2.4.4 全球 DDoS 攻击目标国家占比 ························································································ 20 2.4.5 中国 DDoS 攻击目标各省份占比 ···················································································· 21 3. 2016 僵尸网络发展情况 ·····································································23 3.1 BotMaster 全球分布 ·····················································································24 3.2 Bot 端国内分布 ······························································································25 3.3 物联网僵尸网络的扩张·················································································26 3.3.1 Mirai 物联网僵尸网络 ······································································································· 26 3.3.2 台风 DDoS 物联网僵尸网络····························································································· 29 3.3.3 物联网僵尸网络资源的争夺 ···························································································· 30 3.4 物联网的治理 ·································································································32 4. DDoS 热点攻击事件 ············································································35 4.1 万物互联时代，物联网成僵尸网络新宠 ····················································36 4.2 勒索软件整合 DDoS 攻击能力，进一步挖掘黑产利益 ···························39 4.3 攻击者使用 DDoS 攻击作为其他犯罪活动的烟雾弹 ································39 4.4 政府、金融、游戏行业依然是 DDoS 攻击重灾区 ····································40 5. DDoS 防护趋势··