一种部署于源-目的端供应商的包标记方案研究

提出了一个新的包标记方案,分别部署于源端和目的端供应商,主要用来描绘DDoS攻击流特征。这些特征对于受害者过滤攻击非常有效。在过滤方面,提出了一个比率控制方案,通过限制攻击流并保持合法数据流不受影响来有效保护受害者。在经济方面,提供更好的安全措施可以作为ISP对客户的增值服务,因此也就更有积极性来部署。     

基于源-目的端ISP包标记方案研究

提出了一个基于源-目的端ISP包标记方案.此方案不再用来重构攻击路径,而主要用于刻画DDoS攻击流特征.这些特征对于受害者过滤攻击非常有效.在过滤方面,提出了一个比率控制方案,通过限制攻击流并保持合法数据流不受影响来有效保护受害者.在经济方面ISP能提供更好的安全措施作为对客户的增值服务,因此也就更有积极性来部署.     

一种IPv6环境下实时DDoS防御方法

现有的DDoS防御方法大多是针对传统IPv4网络提出的,而且它们的防御实时性还有待进一步提高。针对这种情况,提出了一种IPv6环境下实时防御DDoS的新方法,其核心思想是首先在受害者自治系统内建立决策判据树,然后依据决策判据1和2对该树进行实时监控,如果发现攻击,就发送过滤消息通知有关实体在受害端和源端一起对攻击包进行过滤,从而保护受害者。实验证明,该方法能够在秒钟数量级检测到攻击并且对攻击包进行过滤,能有效地防范多个DDoS攻击源。另外,该方法还能准确地区分攻击流和高业务流,可以在不恢复攻击路径的情况下直接追踪到攻击源所在的自治系统（甚至是子网）。     

DDoS下的TCP洪流攻击及对策

分布式拒绝服务攻击(DDoS)是近年来出现的一种极具攻击力的Internet攻击手段,而TCP洪流攻击是其最主要的攻击方式之一。本文提出了一种针对TCP洪流攻击的本地攻击检测-过滤LADF机制,其部署于受害者及其上游ISP网络。该机制综合使用了一种基于信息熵的异常检测技术、SYN-cookie技术和“红名单”技术来检测攻击报文,最终结合新型防火墙技术,构建起一个完善的本地DDoS防御系统。     

基于盔甲的DoS防御方案

本文提出了一种基于盔甲的保护服务器不受DoS攻击的方案。该方案允许使用廉价的、高效的且容易使用的包过滤机制来过滤DoS流,不需要对消息进行加密处理,允许使用有效的路由以避免覆盖。     

基于合作过滤机制的ICMP回溯DDoS攻击源方法

提出一种改进的ICMP回溯方法。此方法是基于合作过滤机制的,采用合作过滤机制能够使产生的ICMP回溯包更有效并在尽可能靠近DDoS攻击源的地方过滤攻击包和保护合法包,改进后的ICMP方法对引发ITrace包的IP包从靠近攻击源的地方同步跟踪到受害者,提高了重构攻击路径的速度和准确性。     

一种改进的路由包标记追踪方案

提出了一种基于中国余数定理的包标记方案,对分布式拒绝服务攻击的来源进行追踪。该方案使用中国余数的唯一性来标记IP分块的特征,相对其他包标记算法运算简单,并且有效避免了Hash碰撞的发生,可以在不用假设受害者拥有网络拓扑信息的基础上,只需要较少的标记数据包在较短的时间内重构出攻击路径。该包标记方案在相对量较大的攻击中,能够有效减少重构路径的误报,且计算速度也较其他的包标记方案更快。仿真结果验证了该方案在路由追踪中的正确性和有效性。     

基于合作过滤机制的ICMP回溯DDoS攻击源方法

提出一种改进的ICMP回溯方法。此方法是基于合作过滤机制的，采用合作过滤机制能够使产生的ICMP回溯包更有效并在尽可能靠近DDoS攻击源的地方过滤攻击包和保护合法包，改进后的ICMP方法对引发ITrace包的IP包从靠近攻击源的地方同步跟踪到受害者，提高了重构攻击路径的速度和准确性。     

基于速率限制的源端网络DDoS防御

分布式拒绝服务攻击(DDoS)给Internet网络带来了巨大的威胁,目前已提出的各种防御机制都无法有效解决DDoS攻击报文特征随机变化的问题,本文提出一个从源端网络检测和防御制方法阻止DDoS攻击。仿真测试表明,该方法的防御效果显著优于被攻击端防御方法,减少DDoS攻击对于正常网络流的影响。     

SDN场景中基于双向流量特征的DDoS攻击检测方法

传统网络资源的分布式特性使得管理员较难实现网络的集中管控,在分布式拒绝服务攻击发生时难以快速准确地检出攻击并溯源。针对这一问题,结合软件定义网络集中管控、动态管理的优势和分布式拒绝服务攻击特点,本文首先引入双向流量概念,提出了攻击检测四元组特征,并利用增长型分层自组织映射算法对网络流中提取的四元组特征向量快速准确地分析并分类,同时提出了一种通过自适应改变监控流表粒度以定位潜在受害者的检测方法。仿真实验结果表明,本文提出的四元组特征及下发适量监控流表项的检测算法能以近似96%的准确率检出攻击并定位受害者,且对控制器造成的计算开销较小。     

Provider-based deterministic packet marking against distributed DoS attacks

One of the most serious security threats on the Internet are Distributed Denial of Service (DDoS) attacks, due to the significant service disruption they can create and the difficulty in preventing them. In this paper, we propose new deterministic packet marking models in order to characterize DDoS attack streams. Such a common characterization can be used to make filtering near the victim more effective. In this direction we propose a rate control scheme that protects destination domains by limiting the amount of traffic during an attack, while leaving a large percentage of legitimate traffic unaffected. The above features enable providers to offer enhanced security protection against such attacks as a value-added service to their customers, and hence offer positive incentives for them to deploy the proposed models. We evaluate the proposed marking models using a snapshot of the actual Internet topology, in terms of how well they differentiate attack traffic from legitimate traffic in cases of full and partial deployment.     

A router-based technique to mitigate reduction of quality (RoQ) attacks

We propose a router-based technique to mitigate the stealthy reduction of quality (RoQ) attacks at the routers in the Internet. The RoQ attacks have been shown to impair the QoS sensitive VoIP and the TCP traffic in the Internet. It is difficult to detect these attacks because of their low average rates. We also show that our generalized approach can detect these attacks even if they employ the source IP address spoofing, the destination IP address spoofing, and undefined periodicity to evade several router-based detection systems. The detection system operates in two phases: in phase 1, the presence of the RoQ attack is detected from the readily available per flow information at the routers, and in phase 2, the attack filtering algorithm drops the RoQ attack packets. Assuming that the attacker uses the source IP address and the destination IP address spoofing, we propose to detect the sudden increase in the traffic load of all the expired flows within a short period. In a network without RoQ attacks, we show that the traffic load of all the expired flows is less than certain thresholds, which are derived from real Internet traffic analysis. We further propose a simple filtering solution to drop the attack packets. The filtering scheme treats the long-lived flows in the Internet preferentially, and drops the attack traffic by monitoring the queue length if the queue length exceeds a threshold percent of the queue limit. Our results show that we can successfully detect and mitigate RoQ attacks even with the source and destination IP addresses spoofed. The detection system is implemented in the ns2 simulator. In the simulations, we use the flowid field available in ns2 to implement per-flow logic, which is a combination of the source IP address, the destination IP address, the source port, and the destination port. We also discuss the real implementation of the proposed detection system.     

Detection and defense of application-layer DDoS attacks in backbone web traffic

Web servers are usually located in a well-organized data center where these servers connect with the outside Internet directly through backbones. Meanwhile, the application-layer distributed denials of service (AL-DDoS) attacks are critical threats to the Internet, particularly to those business web servers. Currently, there are some methods designed to handle the AL-DDoS attacks, but most of them cannot be used in heavy backbones. In this paper, we propose a new method to detect AL-DDoS attacks. Our work distinguishes itself from previous methods by considering AL-DDoS attack detection in heavy backbone traffic. Besides, the detection of AL-DDoS attacks is easily misled by flash crowd traffic. In order to overcome this problem, our proposed method constructs a Real-time Frequency Vector (RFV) and real-timely characterizes the traffic as a set of models. By examining the entropy of AL-DDoS attacks and flash crowds, these models can be used to recognize the real AL-DDoS attacks. We integrate the above detection principles into a modularized defense architecture, which consists of a head-end sensor, a detection module and a traffic filter. With a swift AL-DDoS detection speed, the filter is capable of letting the legitimate requests through but the attack traffic is stopped. In the experiment, we adopt certain episodes of real traffic from Sina and Taobao to evaluate our AL-DDoS detection method and architecture. Compared with previous methods, the results show that our approach is very effective in defending AL-DDoS attacks at backbones.     

Monitoring the macroscopic effect of DDoS flooding attacks

Creating defenses against flooding-based, distributed denial-of-service (DDoS) attacks requires real-time monitoring of network-wide traffic to obtain timely and significant information. Unfortunately, continuously monitoring network-wide traffic for suspicious activities presents difficult challenges because attacks may arise anywhere at any time and because attackers constantly modify attack dynamics to evade detection. In this paper, we propose a method for early attack detection. Using only a few observation points, our proposed method can monitor the macroscopic effect of DDoS flooding attacks. We show that such macroscopic-level monitoring might be used to capture shifts in spatial-temporal traffic patterns caused by various DDoS attacks and then to inform more detailed detection systems about where and when a DDoS attack possibly arises in transit or source networks. We also show that such monitoring enables DDoS attack detection without any traffic observation in the victim network.     

Language models for detection of unknown attacks in network traffic

In this paper, we propose a method for network intrusion detection based on language models. Our method proceeds by extracting language features such as n-grams and words from connection payloads and applying unsupervised anomaly detection—without prior learning phase or presence of labeled data. The essential part of this procedure is linear-time computation of similarity measures between language models of connection payloads. Particular patterns in these models decisive for differentiation of attacks and normal data can be traced back to attack semantics and utilized for automatic generation of attack signatures. Results of experiments conducted on two datasets of network traffic demonstrate the importance of high-order n-grams and variable-length language models for detection of unknown network attacks. An implementation of our system achieved detection accuracy of over 80% with no false positives on instances of recent remote-to-local attacks in HTTP, FTP and SMTP traffic.     

Mathematical Model for Low-Rate DoS Attacks Against Application Servers

In recent years, variants of denial of service (DoS) attacks that use low-rate traffic have been proposed, including the Shrew attack, reduction of quality attacks, and low-rate DoS attacks against application servers (LoRDAS). All of these are flooding attacks that take advantage of vulnerability in the victims for reducing the rate of the traffic. Although their implications and impact have been comprehensively studied, mainly by means of simulation, there is a need for mathematical models by which the behaviour of these sometimes complex processes can be described. In this paper, we propose a mathematical model for the LoRDAS attack. This model allows us to evaluate its performance by relating it to the configuration parameters of the attack and the dynamics of network and victim. The model is validated by comparing the performance values given against those obtained from a simulated environment. In addition, some applicability issues for the model are contributed, together with interpretation guidelines to the model's behaviour. Finally, experience of the model enables us to make some recommendations for the challenging task of building defense techniques against this attack.      

基于随机森林算法的无线传感网络攻击流量阻断模型构建

针对无线传感网络攻击流量阻断存在攻击流量检测准确率较低、阻断效果较差的问题,构建了一种基于随机森林算法的无线传感网络攻击流量阻断模型。基于字符（单词）的词频矩阵,利用TF-IDF算法将有效载荷的特征自动提取出来;根据特征结果使用随机森林算法通过词频矩阵对网络流量实行分类,基于分类结果对网络中的流量攻击实现溯源,完成异常无线传感网络检测;利用流表的报文过滤实现无线传感攻击流量的阻断。实验结果表明,该模型在检测攻击流量时,准确率最高可达100%,调和平均数最高为99.18%,错误率最高仅为7.3%,假阳性率最高仅为5.5%,同时能够有效阻断网络攻击流量,在较短时间内将网络恢复至正常,具有良好的攻击流量检测效果和攻击流量阻断效果。     

基于用户人口统计与专家信任的协同过滤算法

推荐系统是学术研究的热门课题,在工业界应用也越来越广泛,推荐系统旨在为用户推荐相关的感兴趣的物品。协同过滤算法被用来比较用户及物品的相似度,向用户推荐与其最近邻用户的偏好。为了提高协同过滤算法预测的准确率,提出基于用户人口统计与专家信任的协同过滤算法,先比较用户人口统计属性,然后进一步比较用户与专家的人口统计属性来得到用户与专家的相似度,从而提高预测的准确性。实验验证表明,提出的算法能够有效提高协同过滤算法预测的准确率。     

A generic solution for unwanted traffic control through trust management

The Internet has dramatically changed our daily life. But it is also bogged down by unwanted traffic, which is malicious, harmful or unexpected for its receivers. In order to control the unwanted traffic over the Internet, especially the mobile Internet, in this paper, we propose a generic unwanted traffic control (UTC) solution through trust management. It can control unwanted traffic from its source to destinations in a personalized manner according to trust evaluation at a Global Trust Operator, traffic and behavior analysis at hosts and traffic observation in the Internet. Thus, it can conduct UTC by integrating distributed and centralized functions and supporting both defensive and offensive approaches. Simulation based evaluation shows that the solution is effective with regard to accuracy and efficiency for botnet intrusion and DDoS intrusion via reflectors. It is also robust against a number of malicious system attacks, such as hide evidence attack, bad mouthing attack, on-off attack, malicious attack by an Internet Service Provider and combinations of the above, playing in conjunction with traffic intrusions. Meanwhile, the solution can provide a personalized UTC based on unwanted traffic detection behaviors.