防御DDoS攻击的方法论

DDoS攻击对当今的互联网造成了重要威胁,反作用防御技术试图检测到这种攻击,然后扼杀掉恶意流量,但这种技术通常需要额外的设备。论文给出基于蜜网技术的DDoS防御性机制,只需较少的代价就可实现。     

一种基于资源感知的小流量DDoS攻击防御方法

分布式拒绝服务攻击（DDoS）对网络具有极大的破坏性,严重影响现网的正常运营。虽然现网已经部署针对DDoS的流量清洗系统,然而小流量的攻击较洪水型攻击更难以被感知,进而不能得到有效的清洗。本文分析了网络中小流量DDoS攻击的原理和防御现状,并提出一种基于资源感知的小流量DDoS攻击防御方法。     

DDoS攻击的技术分析与防御策略

系统地分析分析了DDoS攻击的实现原理,列举了发动DDoS攻击的常用工具,针对攻击产生的机理,提出了详细可行的DDoS攻击防御策略.最后给出市场上典型DDoS攻击检测与响应系统的主要性能和防御DDoS攻击的研究方向.     

一种新的DDoS攻击主动防御方案

介绍DDoS攻击原理和分析DDoS攻击网络的控制机制后,提出了一种新的基于蜜网(honeynet)的主动防御方案,利用网络陷阱与跟踪技术,从根源上阻止DDoS攻击远程控制网络的形成,以达到主动防御的目的。     

DDoS防御技术综述

分布式拒绝服务攻击(DDoS)是Internet面临的最严峻的威胁之一。本文介绍了DDoS攻击原理,总结了近年来防御技术的研究成果,对DDoS防御技术进行了分析,指出了防御DDoS攻击面临的挑战。     

分布式拒绝服务攻击及防御机制研究

分布式拒绝服务(DDoS)攻击是当今网络面临的最严峻的威胁之一,研究防御DDoS攻击的技术非常重要。文章分析了DDoS攻击原理,并深入介绍了当前DDoS攻击的防御技术。     

基于IXP 1200平台的DDoS攻击防御研究

分布式拒绝服务攻击（DDoS）已经成为互联网最大的威胁之一.提出了一种基于Intel IXP1200网络处理器平台的DDoS防御系统的设计方案,并实际实现了一个防御系统D-Fighter.提出了解决DDoS攻击的两个关键技术：数据包认证和细微流量控制的原理和方法,并在D-Fighter中设计实现.经过实际网络测试环境的应用测试表明,D-Fighter达到了设计目标,对DDoS攻击的防御有较好的效果.     

ISP防御DDoS攻击机制研究

通过对DDoS攻击的原理及特征进行分析,并根据ISP在网络中的地位和作用,讨论了DDoS攻击的监测和防御方法,提出了建立分布式防御系统来应对DDoS攻击的方法。     

DDoS攻击原理及其防御机制的研究

DDoS攻击是一种被黑客广泛应用的攻击方式,它以破坏计算机系统或网络的可用性为目标,危害性极大。本文首先介绍了DDoS攻击的攻击原理,接着从DDoS攻击的攻击手段和攻击方式两个方面对DoS攻击进行分类介绍,然后针对DDoS攻击的方式,提出了一种检测和防御DDoS攻击的模型,最后利用入侵检测技术和数据包过滤技术,设计了一个针对DDoS攻击的检测与防御系统,该系统具有配置简单、易于扩展、实用性较强等优点。     

DDoS攻击方式与防御措施浅议

随着Internet互联网络带宽的增加和多种DDoS黑客工具的不断发布,DDoS拒绝服务攻击的实施越来越容易,DDoS攻击事件正在成上升趋势。论文通过对常用的各种DDoS攻击方式进行分类,对攻击的原理进行了探讨,最后在此基础上有针对性地提出了一些防御DDoS攻击的方法。     

ALPi: A DDoS Defense System for High-Speed Networks

Distributed denial-of-service (DDoS) attacks pose a significant threat to the Internet. Most solutions proposed to-date face scalability problems as the size and speed of the network increase, with no widespread DDoS solution deployed in the industry. PacketScore has been proposed as a proactive DDoS defense scheme, which detects DDoS attacks, differentiates attack packets from legitimate ones with the use of packet scoring (where the score of a packet is calculated based on attribute values it possesses), and discards packets whose scores are lower than a dynamic threshold. In this paper, we propose ALPi, a new scheme which extends the packet scoring concept with reduced implementation complexity and enhanced performance. More specifically, a leaky-bucket overflow control scheme simplifies the score computation, and facilitates high-speed implementation. An attribute-value-variation scoring scheme analyzes the deviations of the current traffic attribute values, and increases the accuracy of detecting and differentiating attacks. An enhanced control-theoretic packet discarding method allows both schemes to be more adaptive to challenging attacks such as those with ever-changing signatures and intensities. When combined together, the proposed extensions not only greatly reduce the memory requirement and implementation complexity but also substantially improve the accuracies in attack detection and packet differentiation. This makes ALPi an attractive DDoS defense system amenable for high-speed hardware implementation.     

Intrusion Detection Routers: Design, Implementation and Evaluation Using an Experimental Testbed

In this paper, we present the design, the implementation details, and the evaluation results of an intrusion detection and defense system for distributed denial-of-service (DDoS) attack. The evaluation is conducted using an experimental testbed. The system, known as intrusion detection router (IDR), is deployed on network routers to perform online detection on any DDoS attack event, and then react with defense mechanisms to mitigate the attack. The testbed is built up by a cluster of sufficient number of Linux machines to mimic a portion of the Internet. Using the testbed, we conduct real experiments to evaluate the IDR system and demonstrate that IDR is effective in protecting the network from various DDoS attacks.     

基于DPDK的DDoS攻击防御技术分析与实现

针对当前规模日益增大的分布式拒绝服务攻击(DDoS),提出一种基于Intel DPDK的DDoS攻击防御技术,对比分析其相对于传统DDoS防御技术的优缺点。在此基础上使用网络测试仪进行仿真测试,结果表明DPDK对于提升整体DDoS防御性能效果显著。     

Defending Wireless Infrastructure Against the Challenge of DDoS Attacks

This paper addresses possible Distributed Denial-of-Service (DDoS) attacks toward the wireless Internet including the Wireless Extended Internet, the Wireless Portal Network, and the Wireless Ad Hoc network. We propose a conceptual model for defending against DDoS attacks on the wireless Internet, which incorporates both cooperative technological solutions and economic incentive mechanisms built on usage-based fees. Cost-effectiveness is also addressed through an illustrative implementation scheme using Policy Based Networking (PBN). By investigating both technological and economic difficulties in defense of DDoS attacks which have plagued the wired Internet, our aim here is to foster further development of wireless Internet infrastructure as a more secure and efficient platform for mobile commerce.     

新网络环境下应用层DDoS攻击的剖析与防御

针对新网络环境下近两年新出现的应用层分布式拒绝服务攻击,本文将详细剖析其原理与特点,并分析现有检测机制在处理这种攻击上的不足.最后,本文提出一种基于用户行为的检测机制,它利用Web挖掘的方法通过Web访问行为与正常用户浏览行为的偏离程度检测与过滤恶意的攻击请求,并通过应用层与传输层的协作实现对攻击源的隔离.     

Differentiating Malicious DDoS Attack Traffic from Normal TCP Flows by Proactive Tests

To defend against distributed denial of service (DDoS) attacks, one critical issue is to effectively isolate the attack traffic from the normal ones. A novel DDoS defense scheme based on TCP is hereby contrived because TCP is the dominant traffic for both the normal and lethal flows in the Internet. Unlike most of the previous DDoS defense schemes that are passive in nature, the proposal uses proactive tests to identify and isolate the malicious traffic. Simulation results validate the effectiveness of our proposed scheme