基于自治域边界反馈的分布式DDoS防御方法

给出一种基于自治域边界反馈的DDoS防御方法,实现在自治域边界接近攻击源端阻挡入侵流量。在攻击时,通过在被攻击端测量攻击流量并向边界路由器提供反馈,使得自治域边界处能有效地过滤恶意流量。实验表明,该方法可有效保证合法流量的存活率,保护被攻击机不被DDoS攻击干扰。     

校园网DDoS攻击防御平台建设方案研究

分布式拒绝服务攻击(DDoS)已经成为互联网最大的威胁之一。分析了校园网现状,建立了业务模型,提出了流量清洗设备的功能要求,设计了一种校园网DDoS攻击防御平台的设计方案。并分析了DDOS攻击清洗方案的流量牵引技术、触发技术、流量清洗技术与流量回注技术。     

IPv6中一种基于卷积的DDoS攻击两阶段防御机制

针对IPv6快速普及背景下分布式拒绝服务(DDoS)攻击威胁不断增长的现状, 提出一种两阶段的DDoS攻击防御机制, 包括初期实时监控DDoS攻击发生的预检测阶段, 以及告警后精准过滤DDoS攻击流量的深度检测阶段. 首先, 分析IPv6报文格式并解析PCAP流量捕获文件中的16进制头部字段作为样本元素. 其次, 在预检测阶段, 引入轻量化二值卷积神经网络(BCNN), 设计一种二维流量矩阵作为模型输入, 整体感知网络在混杂DDoS流量后出现的恶意态势作为告警DDoS发生的证据. 告警后, 深度检测阶段介入, 引入一维卷积神经网络(1DCNN)具体区分混杂的DDoS报文, 从而下发阻断策略. 在实验中, 自建IPv6-LAN拓扑并基于NAT 4to6技术重放CIC-DDoS2019公开集生成纯IPv6-DDoS流量源测试. 结果证明, 所提机制提升针对DDoS攻击的响应速度、准确度和攻击流量过滤效率, 当DDoS流量出现仅占总网络6%和10%时, BCNN就能以90.9%和96.4%的准确度感知到DDoS攻击的发生, 同时1DCNN能够以99.4%准确率区分DDoS报文并过滤.     

使用Spark Streaming的自适应实时DDoS检测和防御技术

分布式拒绝服务(distributed denial of service,DDoS)攻击是重要的安全威胁,网络速度的不断提高给传统的检测方法带来了新的挑战。以Spark等为代表的大数据处理技术,给网络安全的高速检测带来了新的契机。提出了一种基于Spark Streaming框架的自适应实时DDoS检测防御技术,通过对滑动窗口内源簇进行分组,并根据与各分组内源簇比例的偏差统计,检测出DDoS攻击流量。通过感知合法的网络流量,实现了对DDoS攻击的自适应快速检测和有效响应。实验结果表明,该技术可极大地提升检测能力,为保障网络服务性能和安全检测的可扩展性提供了一种可行的解决方案。     

基于网络流量的应用层DDoS攻击检测方法研究

根据应用层DDoS攻击和正常网络流量在特征上的不同,提出一种基于流量分析的应用层DDoS攻击检测方法,通过对源IP地址进行分析,能够有效地识别应用层DDoS攻击.同时,针对DDoS攻击流量和突发流量的相似性,在识别DDoS攻击的同时,能够正确区分突发流量,减少误报和漏报.     

浅谈运营商异常流量清洗手段的部署和运用

随着互联网的高速发展,其已经渗入到人们生活的方方面面,对经济和社会有着重大的影响。但近年来出现了大量的DDoS攻击事件,给互联网带来了很大冲击,严重影响了业务的可用性、用户的感知,以及给营运商造成了重大经济损失。在大流量的DDoS攻击面前,传统的安全防护设备显得那么无能为力,如何有效抵御DDoS攻击是每个运营商无法回避的难题。在深入分析DDoS攻击特征的前提下,探索性地将异常流量清洗设备引入到运营商的网络中,并成功防御了多次DDoS攻击事件,为解决难题指出了一条可行道路。     

DDOS攻击检测和防御模型

提出了基于聚集和协议分析防御分布式拒绝服务攻击(aggregate-based protocol analysis anti-DDoS,简称APA-ANTI-DdoS)模型来检测和防御DDoS攻击.APA-ANTI-DDoS模型包括异常流量聚集、协议分析和流量处理.异常流量聚积把网络流量分为正常流量和异常流量;协议分析寻找异常流量中DDoS攻击流量的特征;流量处理则根据当前的DDoS攻击流量特征,过滤异常流量并测试当前聚积流量的拥塞控制特性,恢复被误判的流量.随后实现了APA-ANTI-DDoS系统.实验结果表明,APA-ANTI-DDoS模型能很好地识别和防御DDoS攻击,能在误判时恢复非攻击流量,保证合法的正常网络通信.     

网络设备参与的DDoS防御系统的构建与仿真

分布式拒绝服务(DDoS)攻击严重威胁网络安全,现有DDoS防御方法存在被攻击时防御能力不足,无攻击时能力浪费问题。通过在发生DDoS攻击时,通知互联网服务提供商(ISP)将已发现的攻击元组流量在网络中短暂丢弃的方式,可以在保证DDoS防御的前提下,显著减少防御能力部署。仿真实验表明,对已知的攻击元组流量丢弃合理的时长,即可在仅检测0. 55%攻击流量的前提下,阻止99. 9%的攻击流量。同时,合法流量只有2%因误判被阻塞,防护对象的负载相对正常情况下仅上升1. 77%。     

服务器漫游防御DDoS攻击研究

分布式拒绝服务（DDoS）攻击已经成为目前整个互联网安全的严重威胁。提出了防御DDoS攻击的两道防线：（1）由ISP（Internet服务提供商）提供的主动缓解技术,ISP收集的曾参与攻击的网络实体组成的黑名单使客户可以共享。针对每个客户生成的信任列表和黑名单,结合用户自己制定的策略生成特定用户的缓解策略;（2）采用服务器漫游技术缓解DDoS攻击,服务器集合中的几个是活跃的并提供服务,其余用作蜜罐,只有合法客户才能跟踪漫游的服务器。实验证明,配置蜜罐后能有效地过滤掉攻击流量,使服务器能继续为合法客户提供服务。     

基于流特征相对熵的DDOS攻击检测方法的研究

分布式拒绝服务(DistributedDenialofService,简称DDoS)攻击是互联网的重要威胁之一。笔者通过分析DDoS攻击的原理及其攻击特征,从延长检测响应时间和减少计算复杂度的角度提出了一种DDoS攻击的检测方法。该方法基于DDoS攻击的流量特征,提取有效的流量特征参数,并根据参数变化及时、准确地判断DDoS攻击的发生时间。实验结果证明,该方法能迅速有效地检测到DDoS攻击,并对其他网络安全异常检测具有指导作用。     

云环境下一种基于信任的加密流量DDoS发现方法

针对云环境下分布式拒绝服务(distributed denial-of-service,DDoS)攻击加密攻击流量隐蔽性更强、更容易发起、规模更大的问题,提出了一种云环境下基于信任的加密流量DDoS发现方法TruCTCloud.该方法在现有基于机器学习的DDoS攻击检测中引入信任的思想,结合云服务自身的安全认证,融入基...     

Characterizing DDoS attacks and flash events: Review,research gaps and future directions

A Distributed Denial of Service (DDoS) attack is an austere menace to network security. Nowadays in a technological era, DDoS attacks pose a severe threat to widely used Internet-based services and applications. Disruption of these services even for a fraction of time lead to huge financial losses. A Flash event (FE) is similar to a DDoS attack wherein a large number of legitimate users starts accessing a particular service concurrently leading to the denial of service. Both of these events cause overloading of network resources such as bandwidth, CPU, Memory to legitimate users and result in limited accessibility. Nowadays most of the DDoS attacks use the logical semantics of HTTP protocol to launch a similar kind of attack traffic as that of legitimate traffic which makes the distinction between the two very challenging. Many researchers have tried to discriminate these two types of traffic, but none of them has been able to provide any effective solution yet. This paper systematically reviews 40 such prominent research papers from 2002 to till date for providing insight into the problem of discriminating DDoS and FEs. This article dowries and deliberates the list of traffic feature rationales and detection metrics used by the fellow researchers at both macro and micro level. Such a pragmatic list of rationales would surely be helpful to provide more robust and efficient solutions. The paper also highlights open issues, research challenges and future directions in this area.     

Distributed Denial of Service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.     

一种IPv6环境下实时DDoS防御方法

现有的DDoS防御方法大多是针对传统IPv4网络提出的,而且它们的防御实时性还有待进一步提高。针对这种情况,提出了一种IPv6环境下实时防御DDoS的新方法,其核心思想是首先在受害者自治系统内建立决策判据树,然后依据决策判据1和2对该树进行实时监控,如果发现攻击,就发送过滤消息通知有关实体在受害端和源端一起对攻击包进行过滤,从而保护受害者。实验证明,该方法能够在秒钟数量级检测到攻击并且对攻击包进行过滤,能有效地防范多个DDoS攻击源。另外,该方法还能准确地区分攻击流和高业务流,可以在不恢复攻击路径的情况下直接追踪到攻击源所在的自治系统（甚至是子网）。     

D-WARD: a source-end defense against flooding denial-of-service attacks

Defenses against flooding distributed denial-of-service (DDoS) commonly respond to the attack by dropping the excess traffic, thus reducing the overload at the victim. The major challenge is the differentiation of the legitimate from the attack traffic, so that the dropping policies can be selectively applied. We propose D-WARD, a source-end DDoS defense system that achieves autonomous attack detection and surgically accurate response, thanks to its novel traffic profiling techniques, the adaptive response and the source-end deployment. Moderate traffic volumes seen near the sources, even during the attacks, enable extensive statistics gathering and profiling, facilitating high response selectiveness. D-WARD inflicts an extremely low collateral damage to the legitimate traffic, while quickly detecting and severely rate-limiting outgoing attacks. D-WARD has been extensively evaluated in a controlled testbed environment and in real network operation. Results of selected tests are presented in the paper.     

神经网络和IP标记在DDoS攻击防御中的应用

DDoS(Distributed Denial of Service)攻击是在传统的DoS攻击上产生的新的网络攻击方式,是Internet面临的最严峻威胁之一,这种攻击带来巨大的网络资源消耗,影响正常的网络访问.DDoS具有分布式特征,攻击源隐蔽,而且该类攻击采用IP伪造技术,不易追踪和辨别.任何网络攻击都会产生异常流量,DDoS也不例外,分布式攻击导致这种现象更加明显.主要研究利用神经网络技术并借助IP标记辅助来甄别异常流量中的网络数据包,方法是:基于DDoS攻击总是通过多源头发起对单一目标攻击的特点,通过IP标记技术对路由器上网路包进行标记,获得反映网络流量的标记参数,作为神经网络的输入参数相量;再对BP神经网络进行训练,使其能识别DDoS攻击引起的异常流量;最后,训练成熟的神经网络即可在运行时有效地甄别并防御DDoS攻击,提高网络资源的使用效率.通过实验证明了神经网络技术防御DDoS攻击是可行和高效的.     

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.     

A fast self-similarity matrix-based method for shrew DDoS attack detection

ABSTRACT

Shrew DDoS attack mainly targets the TCP’s retransmission timeout (RTO) mechanism that handles severe cases of congestion and packet losses. This attack is very hard to detect due to its stealthy nature and low-rate in volume which if remained undetected can affect the legitimate TCP flows. In this paper, we propose a fast shrew DDoS attack detection method based on self-similarity matrix (SSM) that measures the self-similarity of network traffic across multiple time scales over a subset of relevant features. The method can detect any presence of shrew attack in-line with the incoming traffic samples and thus identify the attack flows. We experimented our method over real-life low-rate datasets for multiple scenarios and the results demonstrate its efficiency both in terms of detection accuracy and speed.     

防御DDoS攻击的智能过滤模型

拒绝服务攻击(DoS)和分布式拒绝服务攻击(DDoS)已经成为网络最大的安全威胁之一,如何防御DDoS攻击已经引起了人们的广泛关注,然而关于在DDoS攻击发生时减轻攻击危害的这方面工作却很少。阐述了一种基于IP返回追踪的数据包智能过滤模型,能够在DDoS攻击正在发生时尽可能响应合法用户的请求,提高合法通信的吞吐量。