基于流量行为的DDoS检测系统

针对传统攻击检测算法不能实时识别攻击源和受害者的问题,基于对单用户流量行为的分析,设计实现一种实时的DDoS洪流攻击检测和防御系统。通过周期性地检测每个用户发送和接收的流量,判断其是否满足TCP和UDP协议行为的时间同步性,从而有效识别攻击者、受害者和正常用户,并且实时过滤攻击流量和转发正常流量。测试结果表明,该系统能够在攻击早期实时地检测出攻击者并过滤其流量,防御效果明显。     

一种IPv6环境下实时DDoS防御方法

现有的DDoS防御方法大多是针对传统IPv4网络提出的,而且它们的防御实时性还有待进一步提高。针对这种情况,提出了一种IPv6环境下实时防御DDoS的新方法,其核心思想是首先在受害者自治系统内建立决策判据树,然后依据决策判据1和2对该树进行实时监控,如果发现攻击,就发送过滤消息通知有关实体在受害端和源端一起对攻击包进行过滤,从而保护受害者。实验证明,该方法能够在秒钟数量级检测到攻击并且对攻击包进行过滤,能有效地防范多个DDoS攻击源。另外,该方法还能准确地区分攻击流和高业务流,可以在不恢复攻击路径的情况下直接追踪到攻击源所在的自治系统（甚至是子网）。     

基于网络拒绝服务攻击的技术分析与安全策略

拒绝服务攻击是目前一种常见而有效的网络攻击手段，它通过利用协议或系统中的缺陷或漏洞，采取欺骗或伪装的策略来进行攻击，使受害者因资源耗尽或系统瘫痪而无法向合法用户提供服务。介绍了拒绝服务攻击实施的原理，所利用的相关协议的漏洞，常见的拒绝服务攻击程序，以及拒绝服务攻击的最新进展，并说明了如何结合防火墙和入侵检测系统等手段来制定相应的安全策略以防范其攻击。     

一种强健的入侵检测系统方案的研究与设计

目前，关于入侵检测的研究大部分都集中于研究检测方法，追求检测效率的提高和对新型攻击的自动检测，而入侵检测系统本身的安全却未能受到足够重视，往往使得入侵检测系统在入侵者面前暴露无疑。而现在的攻击者在攻击网络上的关键服务时，如果发现此服务有入侵检测保护，往往首先攻击入侵检测系统，使之停止其保护作用，再攻击被入侵检测系统保护的对象。     

开放式系统的攻击取证和系统恢复机制Eudemon的设计及实现

该文提出了一种开放式系统的攻击取证和系统恢复机制Eudemon。Eudemon综合了攻击检测、文件保护和系统恢复等安全技术,采取分布式结构,通过一台远程记录服务器保护多个主机系统。该保护机制能够检测、记录恶意的攻击行为,对攻击行为进行分析取证;在系统遭遇到攻击时,利用保存的系统信息和应用数据,能及时恢复系统和重要数据。该文描述了Eudemon机制的结构设计、实现技术以及系统安全措施。     

基于源-目的端ISP包标记方案研究

提出了一个基于源-目的端ISP包标记方案.此方案不再用来重构攻击路径,而主要用于刻画DDoS攻击流特征.这些特征对于受害者过滤攻击非常有效.在过滤方面,提出了一个比率控制方案,通过限制攻击流并保持合法数据流不受影响来有效保护受害者.在经济方面ISP能提供更好的安全措施作为对客户的增值服务,因此也就更有积极性来部署.     

一种基于源的DDoS攻击防御系统的设计

当前拒绝服务攻击工具随处可得,且易操作,使得分布式拒绝服务攻击发生的频率越来越高,此类攻击已被公认为互联网上最难解决的问题之一.本文主要基于R.Mahajan等提出的防范模型,将随机边标记和过滤机制相结合,设计了基于随机边标记的DDoS攻击防范系统.此系统可以充分利用IP回溯和过滤机制的优点,并相互弥补其不足.相对R.Mahajan等的方法来说,能更好地保护合法用户的请求及攻击源与受害者之间的网络带宽资源.     

DDoS下的TCP洪流攻击及对策

分布式拒绝服务攻击(DDoS)是近年来出现的一种极具攻击力的Internet攻击手段,而TCP洪流攻击是其最主要的攻击方式之一。本文提出了一种针对TCP洪流攻击的本地攻击检测-过滤LADF机制,其部署于受害者及其上游ISP网络。该机制综合使用了一种基于信息熵的异常检测技术、SYN-cookie技术和“红名单”技术来检测攻击报文,最终结合新型防火墙技术,构建起一个完善的本地DDoS防御系统。     

基于自适应包标记的DDoS攻击源的定位研究

防御分布式拒绝服务攻击是当前网络安全中最难解决的问题之一.在自适应包标记的基础上,提出了有效计算攻击图各个路由器的本地发包率的方法,进一步提出了受害者重构攻击路径和定位攻击源的方法.受害者只要利用收集到的数据包就能更快更准的定位攻击源.     

SDN场景中基于双向流量特征的DDoS攻击检测方法

传统网络资源的分布式特性使得管理员较难实现网络的集中管控,在分布式拒绝服务攻击发生时难以快速准确地检出攻击并溯源。针对这一问题,结合软件定义网络集中管控、动态管理的优势和分布式拒绝服务攻击特点,本文首先引入双向流量概念,提出了攻击检测四元组特征,并利用增长型分层自组织映射算法对网络流中提取的四元组特征向量快速准确地分析并分类,同时提出了一种通过自适应改变监控流表粒度以定位潜在受害者的检测方法。仿真实验结果表明,本文提出的四元组特征及下发适量监控流表项的检测算法能以近似96%的准确率检出攻击并定位受害者,且对控制器造成的计算开销较小。     

无线接入点的安全性检测算法研究

无线钓鱼接入点通过设置与真实接入点完全相同的名称诱骗受害者接入伪装的无线接入点,进而可以窃取隐私信息。本文针对无线钓鱼接入点的网络安全问题,在分析无线钓鱼接入点的特征后,根据正常接人点与钓鱼接人点网络链路和MAC地址的区别,提出无线接入点的安全性检测算法,从而保证无线网络用户的信息安全。实验结果证明本文提出的算法准确、有效。     

A Building Information Model enabled Multiple Traveling Salesman Problem for building interior patrols

During building emergencies, an effective and visible primary search plan enhances situation awareness and enables a more efficient rescue mission. The aim of the primary search during an emergency is the rapid screening of every space in the building to identify locations of victims and their conditions. Afterwards, first responders can plan for the rescue of those victims. To provide a timely draw up of interior patrol routes and assign rescue teams to conduct the primary search, this study formulates the problem as a multiple traveling salesman problem (M-TSP) where the comprehensive building interior network is given by the building information models (BIMs), while the total traveling costs (lengths) of every rescue team is minimized. To meet the requirement of real-time patrol routes optimization, we employed the branch-and-price algorithm for the enhancement of computation efficiency. In addition, a heuristic method was introduced to provide timely solutions for large-scale networks. A case study is conducted for a single-floor convention center. We utilized BIM to construct a network of nodes and arcs where the decision model requires as input, and the branch-and-price algorithm finds the optimal patrol. The resulting patrol routes can be visualized and serve as guide for rescue teams to conduct the primary search. The integrated approach proposed in this study is practical and can expedite search and rescue missions.     

一种基于动态蜜罐和实时仿真的蜜网设计

本文提出一种新的、基于动态蜜罐和实时仿真入侵目标的蜜网设计方案,并对方案的安全性进行了分析。采用该蜜网设计方案,能更加有效地部署和维护蜜网系统,从而增强了整个网络系统以及蜜网系统自身的安全性。     

关于针对DDoS中Flood攻击的防御系统的研究

本文主要针对DDoS中的Flood攻击的攻击特点,提出一种防御系统的结构,能够满足对不同Flood攻击检测的简易性、有效性的要求,并且与网络的地理位置、拓扑结构规模无关。该系统主要划分为检测攻击和确定攻击目标两个阶段。检测攻击阶段根据时攻击特征有较好描述性的源地址、目标地址、TCP报文的标志以及ICMP报文的类型,检测攻击是否发生。当检测出攻击发生,启动确定攻击目标阶段,找山攻击目标的具体IP地址。最后综合这两阶段的结果,提取攻击特征,将满足这些特征的数据包过滤掉,达到防御的效果。     

Detecting attacks on networks

As Internet based and intranet based network systems have evolved, they have become invaluable tools that businesses can use to share information and conduct business with online partners. However, hackers have also learned to use these systems to access private networks and their resources. Studies have shown that many organizations have suffered external and internal network intrusions. Internet systems are subject to various types of attacks. Traditional network security products, such as firewalls, can be penetrated from outside and can also leave organizations vulnerable to internal attacks. Generally, victims do not find out that their networks have been attacked until they examine system logs the next day, after the damage has been done. Network intrusion detection systems solve this problem by detecting external and internal security breaches as they happen and immediately notifying security personnel and network administrators by e mail or pager. Intrusion detection systems use several types of algorithms to detect possible security breaches, including algorithms for statistical anomaly detection, rule based anomaly detection, and a hybrid of the two     

A joint network for disaster recovery and search and rescue operations

Disasters are exceptional events that are either man made, such as terrorist attacks, or natural, such as earthquakes, wildfires and floods. Disasters create emergency situations and cause physical and social disorder. In these emergency situations, food, water, shelter, protection and medical help are needed, and the effort needed to provide these basic services to the victims must be coordinated quickly via a reliable communication network. A disaster recovery network is used to provide emergency support to both the disaster victims and the crewmembers that are helping the victims, and to provide a communication infrastructure in the disaster affected area. The disaster relief operation also involves searching for and locating the survivors, and then rescuing them. Currently this process involves manual search in the disaster area, which is also time consuming. A novel network architecture called the Portable Disaster Recovery Network is presented in this paper that enables survivors in a disaster area or a non-disaster related search-and-rescue situation to report their locations to a Command Center. This enables first responders to quickly rescue the survivors from these areas. This paper analyzes the performance of random walk models of the movement of survivors in the Portable Disaster Recovery Network.     

基于多智能体强化学习的无人机群室内辅助救援

本文主要研究了在室内场景中使用多台无人机设备对受害者进行合作搜索的问题.在室内场景中,依赖全球定位系统获取受害者位置信息可能是不可靠的.为此,本文提出一种基于多智能体强化学习(MARL)方案,该方案着重对无人机团队辅助救援时的路径规划问题进行研究.相比于传统方案,所提方案在大型室内救援场景中更具优势,例如部署多台救援无人机、救援多位受害者.本方案也考虑了无人机的充电问题,保证无人机的电量始终充足.具体地,鉴于模型中的救援场景深度参数不断变化,所提方案将搜索路径规划问题模拟为部分可观的马尔可夫决策过程(Dec-POMDP),为使得对无人机控制策略最优,本文又训练了一个双深度的Q网络架构(Double DQN).最后使用蒙特卡罗方法验证了本方案在大型室内环境中能够使多台无人机有效合作,且能最大化搜集受害者所用手机内部所存储的位置信息.     

The <Emphasis Type="Italic">k</Emphasis>-anonymity and <Emphasis Type="Italic">l</Emphasis>-diversity approaches for privacy preservation in social networks against neighborhood attacks

Recently, more and more social network data have been published in one way or another. Preserving privacy in publishing social network data becomes an important concern. With some local knowledge about individuals in a social network, an adversary may attack the privacy of some victims easily. Unfortunately, most of the previous studies on privacy preservation data publishing can deal with relational data only, and cannot be applied to social network data. In this paper, we take an initiative toward preserving privacy in social network data. Specifically, we identify an essential type of privacy attacks: neighborhood attacks. If an adversary has some knowledge about the neighbors of a target victim and the relationship among the neighbors, the victim may be re-identified from a social network even if the victim’s identity is preserved using the conventional anonymization techniques. To protect privacy against neighborhood attacks, we extend the conventional k-anonymity and l-diversity models from relational data to social network data. We show that the problems of computing optimal k-anonymous and l-diverse social networks are NP-hard. We develop practical solutions to the problems. The empirical study indicates that the anonymized social network data by our methods can still be used to answer aggregate network queries with high accuracy.     

低速率拒绝服务攻击研究综述

低速率拒绝服务攻击是近年来提出的一类新型攻击,其不同于传统洪泛式DoS攻击,主要是利用端系统或网络中常见的自适应机制所存在的安全漏洞,通过低速率周期性攻击流,以更高的攻击效率对受害者进行破坏且不易被发现。LDoS攻击自提出以来便得到了研究者们的充分重视,其攻击特征分析与检测防范方法逐渐成为网络安全领域的一个重要研究课题。首先对目前已提出的各种LDoS攻击方式进行了分类描述和建模,并在NS2平台上进行了实验验证,接着对LDoS攻击的检测防范难点进行了讨论并对已有的各种检测防范方案进行了小结,最后指出了有待进一步研究的几个问题,以期为今后此类攻击检测防范研究工作提供参考。