共查询到20条相似文献,搜索用时 15 毫秒
1.
SYN Flooding攻击问题的分析 总被引:5,自引:3,他引:2
网络给全世界的人们带来了无限的生机的同时也带来了很多的困扰。由于多年来网络系统累积下了无数的漏洞,我们将面临的威胁与日剧增。DoS攻击是网络上最不安定的因素之一。SYN flooding攻击是DoS攻击的一种重要形式,SYN flooding是利用TCP协议3次握手时的漏洞对服务进行攻击。以SYN flooding攻击的实现为线索,对SYN flooding攻击的原理进行了深入剖析,提出了一个综合的、“内外兼休”的防御办法。 相似文献
2.
Haidar Safa Mohamad Chouman Hassan Artail Marcel Karam 《Journal of Network and Computer Applications》2008,31(4):509-534
SYN flooding exploits the Transmission Control Protocol (TCP) three-way handshake process by sending many connection requests using spoofed source IP addresses to a victim's host. This keeps that host from handling legitimate requests, causing it to populate its backlog queue with forged TCP connections. In this article, we propose a novel defense mechanism that makes use of the edge routers that are associated with the spoofed IP addresses’ networks to determine whether the incoming SYN–ACK segment is valid. This is accomplished by maintaining a matching table of the outgoing SYNs and incoming SYN–ACKs and also by using the ARP protocol. If an incoming SYN–ACK segment is not valid, the edge router resets the connection at the victim's host, freeing up an entry in the victim's backlog queue, and enabling it to accept other legitimate incoming connection requests. We also present a communication protocol to encourage collaboration between various networks to protect each other. We evaluated the performance of our proposed approach and studied its impact on the network. Our experimental and simulation results showed the efficiency of our proposed collaborative defense mechanism. 相似文献
3.
Distributed denial of service (DDoS) attacks seriously threaten Internet services yet there is currently no defence against such attacks that provides both early detection, allowing time for counteraction, and an accurate response. Traditional detection methods rely on passively sniffing an attacking signature and are inaccurate in the early stages of an attack. Current counteractions such as traffic filter or rate-limit methods do not accurately distinguish between legitimate and illegitimate traffic and are difficult to deploy. This work seeks to provide a method that detects SYN flooding attacks in a timely fashion and that responds accurately and independently on the victim side. We use the knowledge of network traffic delay distribution and apply an active probing technique (DARB) to identify half-open connections that, suspiciously, may not arise from normal network congestion. This method is suitable for large network areas and is capable of handling bursts of traffic flowing into a victim server. Accurate filtering is ensured by a counteraction method using IP address and time-to-live(TTL) fields. Simulation results show that our active detection method can detect SYN flooding attacks accurately and promptly and that the proposed rate-limit counteraction scheme can efficiently minimize the damage caused by DDoS attacks and guarantee constant services to legitimate users. 相似文献
4.
SYN Flood攻击的原理、实现与防范 总被引:8,自引:0,他引:8
SYN Flood攻击是拒绝服务攻击中的一种典型攻击手段。在分析攻击原理的基础上,介绍了该攻击在Limux平台上的实现方法及目前防范该攻击的主要技术。 相似文献
5.
6.
浅议TCP SYN Flooding攻击 总被引:2,自引:0,他引:2
介绍了TCP协议建立连接的过程及存在的安全问题,以及由此而引起的TCP SYN Flooding(TCP SYN洪流)拒绝服务攻击,并介绍了几种简便有效的防范措施。 相似文献
7.
8.
9.
SYN flooding attack is a threat that has been designed based on vulnerabilities of the connection establishment phase of the TCP protocol. In this attack some sources send a large number of TCP SYN segments, without completing the third handshake step to quickly exhaust connection resources of the victim server. Hence, a main part of the server’s buffer space is allocated to the attack half open connections and incoming new connection requests will be blocked. This paper proposes a novel framework, in which, the defense issue is formulated as an optimization problem. Then it employs the particle swarm optimization (PSO) algorithm to solve this optimization problem. Our theoretical analysis and packet-level simulations in ns-2 environment show that the proposed defense strategy called PSO_SYN decreases the number of blocked TCP connection requests and cuts down share of attack connections from the buffer space. 相似文献
10.
陈勇 《数字社区&智能家居》2011,(18)
SYN FLOOD攻击是目前比较常见的攻击方式之一。该文介绍了SYN FLOOD攻击的基本原理,通过对Windows Server2003操作系统系统注册表修改策略提高TCP\IP通信安全来有效防止来自网络内外部SYN FLOOD攻击。 相似文献
11.
在介绍SYN Flood攻击原理的基础上,分析了已有防御方法的不足,据此提出了一种同源SYN报文两次接收法.该方法对SYN请求报文在合理的时间段内进行两次接收,然后转入三次握手机制.该方法可以有效的对TCP连接请求进行筛选,让正常的连接请求进入三次握手流程,从而有效地避免了半连接队列溢出引起的DoS攻击.分析表明,同源SYN报文两次接收法不需外部工具支持,在TCP/IP协议的不变性、防火墙穿透能力和节省系统资源消耗等方面具有一定的优势,且该方法对阻止DDoS攻击同样有效. 相似文献
12.
SYN Flood是一种典型的拒绝服务攻击技术,它利用TCP协议的安全漏洞危害网络,目前还没有很好的办法彻底解决SYN Flood攻击问题。分析了3种现有的SYN Flood防御模型:SYN Cookie、SYN Gateway和SYN Proxy,提出了增强的SYN Proxy防御模型,研究了其相关的防御算法,并基于Linux平台进行了实现,最后对防御模型进行了测试。测试结果表明,增强的SYN Proxy模型能抵御高强度的SYN Flood攻击,较之现有的模型有更好的优越性。 相似文献
13.
随着对移动Agent技术的研究和应用不断深入,移动Agent系统的安全问题越来越受到关注.在诸多类型的安全问题中,DoS攻击作为一种常见的攻击手段,其危害性尤为突出.本文介绍了移动Agent系统中两种基本的Dos攻击的形式,通过分析它们各自的机理,分别提出防御策略,最后介绍了南京大学计算机软件新技术国家重点实验室自行研制的Mogent系统中对此策略的实现。 相似文献
14.
15.
SYN Flood攻击源代码分析 总被引:2,自引:0,他引:2
陈波 《计算机工程与应用》2003,39(7):36-39
文章从程序设计的角度介绍了SYNFlood攻击的原理,并分析了攻击源代码,对涉及的Linux网络编程知识进行了研究。 相似文献
16.
“内容中心网络”(Content Centric Networking,CCN)是未来互联网架构体系群中极具前景的架构之一。尽管CCN网络的全新设计使其能够抵御目前网络存在的大多数形式DoS攻击,但仍引发了新型的DoS攻击,其中危害较大的两类攻击是兴趣包泛洪攻击和缓存污染攻击。这两类DoS攻击利用了CCN网络自身转发机制的安全逻辑漏洞,通过泛洪大量的恶意攻击包,耗尽网络资源,并导致网络瘫痪。与传统IP网络中DoS攻击相比,CCN网络中的内容路由、内嵌缓存和接收者驱动传输等新特征,对其DoS攻击的检测和防御方法都提出了新的挑战。本文首先介绍CCN网络的安全设计和如何对抗已有的DoS攻击,然后从多角度描述、比较CCN中新型DoS攻击的特点,重点阐述了兴趣包泛洪攻击和缓存污染攻击的分类、检测和防御方法,以及它们所面临的问题挑战,最后对全文进行总结。 相似文献
17.
18.
抵御SIP分布式洪泛攻击的入侵防御系统 总被引:1,自引:0,他引:1
针对SIP分布式洪泛攻击检测与防御的研究现状,结合基于IP的分布式洪泛攻击和SIP消息的特点,提出了一种面向SIP分布式洪泛攻击的两级防御分布式拒绝服务(DDoS)攻击体系结构(TDASDFA):一级防御子系统(FDS)和二级防御子系统(SDS)。FDS对SIP的信令流进行粗粒度检测与防御,旨在过滤非VoIP消息和丢弃超出指定速率的IP地址的SIP信令,保证服务的可用性;SDS利用一种基于安全级别设定的攻击减弱方法对SIP信令流进行细粒度检测,并过滤具有明显DoS攻击特征的恶意攻击和低流量攻击。FDS和SDS协同工作来实时检测网络状况,减弱SIP分布式洪泛攻击。实验结果表明,TDASDFA能实时地识别和防御SIP分布式洪泛攻击,并且在异常发生时有效地减弱SIP代理服务器/IMS服务器被攻击的可能性。 相似文献
19.
近年来,Docker 技术因其部署灵活、可扩展性强,获得了大规模应用。Docker 采用模块化设计,在降低开发和维护的复杂性的同时引入了针对组件间通信的拒绝服务(DoS)攻击。在Docker容器内频繁进行stdout输出会引起Docker组件消耗大量CPU,造成DoS攻击。经过分析,可发现容器实例中的stdout输出会触发Docker各个组件的goroutine,进行频繁输出复制。为系统化地找出可被DoS攻击的goroutine创建的路径,提出使用静态分析的方法来分析Docker各组件,设计并实现了Docker组件静态分析框架,最后在Docker上进行了测试,成功分析得到了34条此类路径,其中22条路径经验证,可成功被动态触发。 相似文献