IPv6中的DoS/DDoS攻击流量突发检测算法

IPv6下的安全体系结构IPSec对IPv6网络的安全起到了一定的作用,但是它对某些特殊攻击的防范,例如泛洪DoS/DDoS攻击,却无能为力。该文通过对IPv6中泛洪DoS/DDoS攻击发生时的流量特征的分析,对基于网络流量突发变化的DoS/DDoS攻击检测算法在IPv6下的应用进行研究,分别用Matlab和NS-2对算法进行有效性和可行性验证。结果表明,突发流量检测算法在IPv6环境中运行良好。     

针对IPv6的邻居发现协议的DoS攻击分析

DoS攻击一直是Internet最主要的威胁。随着Internet的发展,IPv6毫无疑问将代替Internet现在的主要协议IPv4。该论文主要关注IPv6下使用IPSec配置或不使用IPSec的情况下的针对协议的DoS攻击,主要涉及与IPv6邻居发现协议(NDP)相关的DoS攻击。     

IPv6局域网攻击安全检测研究

利用IPv6协议某些规程漏洞的攻击也越来越多。该文对IPv6局域网攻击的原理、网络检测技术的分类进行阐述,分析IPv6局域网攻击检测策略．设计了扫描攻击检测的实现方法。     

IPv6局域网攻击安全检测研究

利用IPv6协议某些规程漏洞的攻击也越来越多。该文对IPv6局域网攻击的原理、网络检测技术的分类进行阐述,分析IPv6局域网攻击检测策略,设计了扫描攻击检测的实现方法。     

基于IPv6的网络安全体系结构研究

比较了IPv4网络和IPv6网络面临的攻击,并分析了各种攻击所产生的安全威胁,详细阐述了IPv6网络在各层上为了应对安全威胁所需提供的安全服务.根据所需的安全服务,提出了基于IPv6的网络安全体系结构,并分析了其中用到的3种较新的安全技术.最后给出了安全体系结构在工程中的应用并构建了一套动态安全防护体系,同时给出了安全服务完备性的简单证明.     

IPv6的DoS／DDoS攻击及防御

IPv6无疑要比IPv4更加安全,但其本身就不是认证加密所能解决,而且就目前来看IPsec的大规模应用还有许多问题需要解决。本文详细分析了IPv6网络的DoS／DDoS攻击并针对IPV6可能面临的各种形式的拒绝服务攻击展开了讨论。     

IPv6隧道代理机制中的DDoS攻击安全性分析

DDoS攻击是当今IPv4网络上最严重的威胁之一,IPv6网络在安全性方面的设计十分优越,但由IPv4过渡到IPv6网络还需要一些转换机制,本文对转换机制中存在的安全问题进行了介绍,并着重分析了TunnelBroker(隧道代理)机制下的DDoS攻击。     

IPv6 WLAN安全网关设计

IPv6强大的寻址方案和对移动性的支持,使其在WLAN中的应用成为一种趋势。WLAN为用户提供了便捷接入的同时,也带来相较于有线网络更大的安全威胁,IPv6的邻居发现协议和自动配置功能等这些特点使得WLAN的接入安全变得更为复杂。设计一个IPv6 WLAN环境下的安全网关,能够检测到网络中潜在的漏洞和威胁,通过搭建实验环境,并对未授权接入、DAD DOS攻击和重定向攻击三种安全威胁进行了仿真,实验结果证明该安全网关的有效性。     

移动IPv6路由优化中的欺骗攻击

往返可路由过程被称为“无认证设施”的认证方法,在移动IPv6的路由优化过程中起认证协议的作用。分析路由优化过程,发现移动IPv6协议存在欺骗攻击问题。实验结果表明,欺骗攻击可能会影响到一个局域网中的所有外来移动节点,导致优化路由失败,网络性能下降,甚至会引起当前通信的暂时中断,对延迟要求较高的多媒体应用更有较大影响。     

IPv6下基于改进的SPIE源追踪方案

源追踪技术提供对真实攻击来源的有效追踪,有利于实时阻断、隔离DDoS等网络攻击。目前的源追踪方法大多是使用IPv4包头中很少使用的16位标识域保存经过的路由器信息,不适用于IPv6环境。本文提出一种IPv6下基于改进的SPIE源追踪方案。该方法利用路由器,使用Bloom filters数据结构保存转发的数据包的摘要,减少了耗费的存储空间,同时时保护了数据包的机密性;它不但适合DDoS攻击的源追踪,还能进行单个数据包的源追踪。     

12IPv6与IPv4网络攻击方式研究

通过对IPv4存在的攻击方式的研究,提出了IPv6网络可能出现的各种攻击方式并分析了其原理。     

IPv6环境下网络溯源系统

随着IPv4地址资源的逐渐告罄,而部署IPv6又需要相当长的时间,因此当前和相当长时间内我国将处于IPv4和IPv6并存的网络现状。于此同时,网络中存在多种拒绝服务式攻击。本文旨在提出一种可面向IPv6网络环境的攻击溯源系统,系统采用基于网络层数据报文分析的网络溯源技术。在处理网络层五元组数据时,采用双重型BloomFilter可以显著提升溯源的准确率,并降低时间空间消耗。     

IPv6安全脆弱性研究

IPv6作为可控、可信、可扩展的下一代网络核心协议已经从试验阶段走向实际应用。普遍认为IPv6因有IPSec而比IPv4更安全,但IPv6网络在实际部署中往往没有实施IPSec。IPv6协议在没有IPSec时的安全性,特别是过渡时期和IPv6协议自身的安全性问题值得深入研究。主要研究了IPv6在没有IPSec时的安全性。首先对IPv6网络中的攻击和安全问题进行了分类和概述,然后分两部分重点讨论了过渡时期的安全性和IPv6特有的安全性,并给出了一些攻击和漏洞的防护建议。     

Detecting stealth DHCP starvation attack using machine learning approach

Dynamic Host Configuration Protocol (DHCP) is used to automatically configure clients with IP address and other network configuration parameters. Due to absence of any in-built authentication, the protocol is vulnerable to a class of Denial-of-Service (DoS) attacks, popularly known as DHCP starvation attacks. However, known DHCP starvation attacks are either ineffective in wireless networks or not stealthy in some of the network topologies. In this paper, we first propose a stealth DHCP starvation attack which is effective in both wired and wireless networks and can not be detected by known detection mechanisms. We test the effectiveness of proposed attack in both IPv4 and IPv6 networks and show that it can successfully prevent other clients from obtaining IP address, thereby, causing DoS scenario. In order to detect the proposed attack, we also propose a Machine Learning (ML) based anomaly detection framework. In particular, we use some popular one-class classifiers for the detection purpose. We capture IPv4 and IPv6 traffic from a real network with thousands of devices and evaluate the detection capability of different machine learning algorithms. Our experiments show that the machine learning algorithms can detect the attack with high accuracy in both IPv4 and IPv6 networks.     

IPv6欺骗攻击的防范

IPv6在性能和安全机制方面有了显著提高,但同时也带来新的问题和挑战.通过对欺骗攻击技术研究,分析在IPv6下可能出现的各种欺骗攻击形式,提出了相应的防范措施.     

IPv6 Implementation Decisions for an Organization

ABSTRACT

This paper discusses the decision-making process for rolling out IPv6 in an organization today. The author walks the reader through a pragmatic operational approach to implementing IPv6 and securing it against common attacks. There is a brief technical overview explaining the various IPv6 mechanisms, but the overall intent is to highlight the various key decision points architects will face while implementing IPv6. The intent is not to take the reader down into the technical bowels of any given process, but rather to shine a light on the many topics of concern that management must consider when deploying IPv6.     

A novel approach for securing IPv6 link local communication

ABSTRACT

Link local communication is one of the predominant components and intrinsic features of Internet Protocol Version 6 (IPv6) networks. IPv6 nodes utilize link local communication for ascertaining the presence of other nodes on the link, for resolving their link local addresses, and for determining the reachability information of the other nodes. To achieve link local communication, IPv6 nodes employ the services of Neighbor Discovery Protocol (NDP). The protocol also suffices and forms the fundamental core in IPv6 mobile communication, enabling multihop communication. The NDP presumes that the network consists of trusted nodes; however, with the genesis of public unsecured wireless networks, any random node with minimum authentication can affix itself to the link and launch various attacks. As in the case of NDP Stateless Address Auto Configuration (SLAAC), there is no inclusion of central address configuration servers, thereby making the process vulnerable to denial-of-service (DoS) attacks on duplicate address detection (DAD). Also, in the case of the NDP address resolution process, man-in-the-middle attacks (MITM) can be launched, whereby the attackers impersonate the legitimate nodes address. Thus access to the link can be obstructed and network traffic can be redirected without the knowledge of users. To vanquish these problems, the Internet Engineering Task Force (IETF) proposed the use of cryptographically generated addresses (CGAs), which are an intrinsic element of the Secure Neighbor Discovery (SEND) protocol. The use of CGAs ensures message integrity, authentication, and address impersonation mitigation, but at the cost of higher computation and resource utilization. This article proposes some novel approaches for securing IPv6 link layer communication operations. These techniques are implemented programmatically for securing DoS on IPv6 DAD and MITM attacks and used as an alternate approach for CGAs and the SEND protocol.     

移动IPv6网络中的DoS攻击

介绍了移动IPv6协议的工作原理,分析总结了移动IPv6网络中三种主要的DoS攻击。针对NS-2环境提出了一套模拟移动IPv6中DoS攻击的具体实现方案。经过对仿真实验结果分析表明,DoS攻击对移动IPv6网络性能造成很大的影响。     

一个扩展的CAM协议

随着IPv6技术的稳步发展以及移动IPv4面临移动性、安全性差等越来越多的问题,移动IPv6由于取优良的性能而日益引起人们的关注。如何防止绑定更新消息遭受攻击是移动IPv6在开放式环境中面临的难题。本文针对CAM协议的不足提出了一个扩展的CAM协议。该协议实现了协议双方的相互认证并能抗DOS攻击。最后对该协议的安全性和功能进行了分析与论证。