基于自适应包标记的IP源追踪方案

防御分布式拒绝服务(DDoS)攻击是当前网络攻击研究的重要课题,本文提出了一种DDoS攻击追踪方案的构想,在自适应包标记理论的基础上,提出了新的改进算法,该方案利用了TTL域和并提出了一种伸缩性的包标记策略,可以通过更少的数据包更快的定位出攻击源。同以往方法比较,该算法的灵活性好,并且误报率很低。经仿真实验证明该系统用较少的数据包即追踪IP源,最大限度的减少了攻击带来的损失。     

防御DDoS攻击的包标记联合部署方案

提出了一种新的结合确定包标记和路径标识的方案,其在源边界路由器以概率形式选择执行确定性包标记或路径标识。该方案以下游网络拥塞程度和路径追溯结果为依据,动态调整数据包标记操作,并在受害主机处根据不同的标记策略采取不同的防御措施。基于大规模权威因特网拓扑数据集的仿真实验表明,该方案防御效果较好,能有效减轻受害主机遭受DDoS攻击的影响。     

一种改进的DDoS攻击综合防御系统*

为了在IPv4网络下进一步提高防御DDoS攻击的实时性,提出DDoS防御系统的构想,将客户端防御系统与自适应包标记有效地结合起来,既可以检测防御DDoS攻击,又可以进行追踪攻击源;同时提出一个新的标记方案,该方案利用了TTL域和改进的自适应包标记的方法。与其他标记方法相比,其具有灵活性好、误报率低、计算量小的优点。经验证该系统用较少的数据包即可重构攻击路径,在最大限度上降低了攻击造成的损失。     

CoMM:基于协作标记与缓解的实时IP反向追踪模型

实时性对于在DoS或DDoS网络攻击中发送假源地址包的主机进行IP反向追踪非常重要．提出一个IP实时反向追踪的模型CoMM（Cooperative Marking and Mitigation），在受害者主动参与和自治网络协调员的帮助下推测攻击路径，局部推测的攻击路径可以帮助受害者推测的攻击路径进行验证，上游路由器采取限速方式减小攻击程度的同时保证合法用户流量的传输和受害者正常推测攻击路径的流量需要，并有效的降低路由器参加追踪的开销．     

分布式拒绝服务攻击研究综述

分布式拒绝服务攻击(distributed denial-of-service，DDoS)已经对Internet的稳定运行造成了很大的威胁．在典型的DDoS攻击中，攻击者利用大量的傀儡主机向被攻击主机发送大量的无用分组．造成被攻击主机CPU资源或者网络带宽的耗尽．最近两年来．DDoS的攻击方法和工具变得越来越复杂，越来越有效，追踪真正的攻击者也越来越困难．从攻击防范的角度来说，现有的技术仍然不足以抵御大规模的攻击．本文首先描述了不同的DDoS攻击方法，然后对现有的防范技术进行了讨论和评价．然后重点介绍了长期的解决方案-Internet防火墙策略，Internet防火墙策略可以在攻击分组到达被攻击主机之前在Internet核心网络中截取这些攻击分组。     

Distributed Denial of Service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.     

On the defense of the distributed denial of service attacks: anon-off feedback control approach

Proposes a coordinated defense scheme of distributed denial of service (DDoS) network attacks, based on the backward-propagation, on-off control strategy. When a DDoS attack is in effect, a high concentration of malicious packet streams are routed to the victim in a short time, making it a hot spot. A similar problem has been observed in multiprocessor systems, where a hot spot is formed when a large number of processors access simultaneously shared variables in the same memory module. Despite the similar terminologies used here, solutions for multiprocessor hot spot problems cannot be applied to that in the Internet, because the hot traffic in DDoS may only represent a small fraction of the Internet traffic, and the attack strategies on the Internet are far more sophisticated than that in the multiprocessor systems. The performance impact on the hot spot is related to the total hot packet rate that can be tolerated by the victim. We present a backward pressure propagation, feedback control scheme to defend DDoS attacks. We use a generic network model to analyze the dynamics of network traffic, and develop the algorithms for rate-based and queue-length-based feedback control. We show a simple design to implement our control scheme on a practical switch queue architecture     

Enhanced Internet security by a distributed traffic control service based on traffic ownership

The frequency and intensity of Internet attacks are rising at an alarming pace. Several technologies and concepts were proposed for fighting distributed denial of service (DDoS) attacks: traceback, pushback, i3, SOS and Mayday. This paper shows that in the case of DDoS reflector attacks they are either ineffective or even counterproductive. We then propose the novel concept of traffic ownership and describe a system that extends control over network traffic by network users to the Internet using adaptive traffic processing devices. We safely delegate partial network management capabilities from network operators to network users. All network packets with a source or destination address “owned” by a network user can now also be controlled within the Internet instead of only at the network user's Internet uplink. By limiting the traffic control features and by restricting the realm of control to the “owner” of the traffic, we can rule out misuse of this system. Applications of our system are manifold: prevention of source address spoofing, DDoS attack mitigation, distributed firewall-like filtering, new ways of collecting traffic statistics, service-level agreement validation, traceback, distributed network debugging, support for forensic analyses and many more. A use case illustrates how our system enables network users to prevent and react to DDoS attacks.     

源端网络检测与抑制DDoS方法设计与实现

提出了一种源端网络DDoS攻击检测的方法。本方法基于BPF包过滤在源端网络的网关上监控数据包,通过计算网络报文的目的IP地址的信息熵进行可疑流量的检测,最终进一步使用连接跟踪的技术对可疑流量进行判别。本方法可以有效的鉴别出SYN Flood的流量,并在源端网络中直接拦截,节省计算资源。     

RMCARTAM For DDoS Attack Mitigation in SDN Using Machine Learning

The impact of a Distributed Denial of Service (DDoS) attack on Software Defined Networks (SDN) is briefly analyzed. Many approaches to detecting DDoS attacks exist, varying on the feature being considered and the method used. Still, the methods have a deficiency in the performance of detecting DDoS attacks and mitigating them. To improve the performance of SDN, an efficient Real-time Multi-Constrained Adaptive Replication and Traffic Approximation Model (RMCARTAM) is sketched in this article. The RMCARTAM considers different parameters or constraints in running different controllers responsible for handling incoming packets. The model is designed with multiple controllers to handle network traffic but can turn the controllers according to requirements. The multi-constraint adaptive replication model monitors different features of network traffic like rate of packet reception, class-based packet reception and target-specific reception. According to these features, the method estimates the Replication Turning Weight (RTW) based on which triggering controllers are performed. Similarly, the method applies Traffic Approximation (TA) in the detection of DDoS attacks. The detection of a DDoS attack is performed by approximating the incoming traffic to any service and using various features like hop count, payload, service frequency, and malformed frequency to compute various support measures on bandwidth access, data support, frequency support, malformed support, route support, and so on. Using all these support measures, the method computes the value of legitimate weight to conclude the behavior of any source in identifying the malicious node. Identified node details are used in the mitigation of DDoS attacks. The method stimulates the network performance by reducing the power factor by switching the controller according to different factors, which also reduces the cost. In the same way, the proposed model improves the accuracy of detecting DDoS attacks by estimating the features of incoming traffic in different corners.     

Detecting superpoints through a reversible counting Bloom filter

Internet attacks such as distributed denial-of-service (DDoS) attacks and worm attacks are increasing in severity. Identifying realtime attack detection and mitigation of Internet traffic is an important and challenging problem. For example, a compromised host doing fast scanning for worm propagation often makes an unusually high number of connections to distinct destinations within a short time. We call such a host a superpoint, which are sources that connect to a large number of distinct destinations. Detecting superpoints is very important in developing effective and efficient traffic engineering schemes. We propose two novel schemes for detecting superpoints and prove guarantees on their accuracy and memory requirements. These schemes are implemented by introducing a reversible counting Bloom filter (RCBF), a special counting Bloom filter. The RCBF consists of 4 hash functions which projectively select some consecutive bits from original strings as function values. We obtain the information of superpoints using the overlapping of hash bit strings of the RCBF. The theoretical analysis and experiment results show that our schemes can precisely and efficiently detect superpoints.     

基于自适应包标记的IP回溯

防御分布式拒绝服务攻击是当前网络安全中最难解决的问题之一。在各种解决方法中,自适应概率包标记受到了广泛的重视,因为算法中路径上的每个路由器根据一定策略自适应的概率标记过往的数据包,从而受害者可以用最短的重构时间,对攻击者进行IP回溯,找出攻击路径并发现攻击源。文中提出了一种自适应的标记策略。通过实验验证相比于常用策略,该策略重构路径所需的数据包明显减少,有效地减少了重构计算量和伪证性。     

Controlling IP Spoofing through Interdomain Packet Filters

The distributed denial-of-service (DDoS) attack is a serious threat to the legitimate use of the Internet. Prevention mechanisms are thwarted by the ability of attackers to forge or spoof the source addresses in IP packets. By employing IP spoofing, attackers can evade detection and put a substantial burden on the destination network for policing attack packets. In this paper, we propose an interdomain packet filter (IDPF) architecture that can mitigate the level of IP spoofing on the Internet. A key feature of our scheme is that it does not require global routing information. IDPFs are constructed from the information implicit in border gateway protocol (BGP) route updates and are deployed in network border routers. We establish the conditions under which the IDPF framework correctly works in that it does not discard packets with valid source addresses. Based on extensive simulation studies, we show that, even with partial deployment on the Internet, IDPFs can proactively limit the spoofing capability of attackers. In addition, they can help localize the origin of an attack packet to a small number of candidate networks.     

一种部署于源-目的端供应商的包标记方案研究

提出了一个新的包标记方案,分别部署于源端和目的端供应商,主要用来描绘DDoS攻击流特征。这些特征对于受害者过滤攻击非常有效。在过滤方面,提出了一个比率控制方案,通过限制攻击流并保持合法数据流不受影响来有效保护受害者。在经济方面,提供更好的安全措施可以作为ISP对客户的增值服务,因此也就更有积极性来部署。     

基于流量行为的DDoS检测系统

针对传统攻击检测算法不能实时识别攻击源和受害者的问题,基于对单用户流量行为的分析,设计实现一种实时的DDoS洪流攻击检测和防御系统。通过周期性地检测每个用户发送和接收的流量,判断其是否满足TCP和UDP协议行为的时间同步性,从而有效识别攻击者、受害者和正常用户,并且实时过滤攻击流量和转发正常流量。测试结果表明,该系统能够在攻击早期实时地检测出攻击者并过滤其流量,防御效果明显。     

一种IPv6环境下实时DDoS防御方法

现有的DDoS防御方法大多是针对传统IPv4网络提出的,而且它们的防御实时性还有待进一步提高。针对这种情况,提出了一种IPv6环境下实时防御DDoS的新方法,其核心思想是首先在受害者自治系统内建立决策判据树,然后依据决策判据1和2对该树进行实时监控,如果发现攻击,就发送过滤消息通知有关实体在受害端和源端一起对攻击包进行过滤,从而保护受害者。实验证明,该方法能够在秒钟数量级检测到攻击并且对攻击包进行过滤,能有效地防范多个DDoS攻击源。另外,该方法还能准确地区分攻击流和高业务流,可以在不恢复攻击路径的情况下直接追踪到攻击源所在的自治系统（甚至是子网）。     

Enforcing a Source-end Cooperative Multilevel Defense Mechanism to Counter Flooding Attack

The exponential advancement in telecommunication embeds the Internet in every aspect of communication. Interconnections of networks all over the world impose monumental risks on the Internet. A Flooding Attack (FA) is one of the major intimidating risks on the Internet where legitimate users are prevented from accessing network services. Irrespective of the protective measures incorporated in the communication infrastructure, FA still persists due to the lack of global cooperation. Most of the existing mitigation is set up either at the traffic starting point or at the traffic ending point. Providing mitigation at one or the other end may not be a complete solution. To insist on better protection against flooding attacks, this work proposes a cooperative multilevel defense mechanism. The proposed cooperative multilevel defense mechanism consists of two-level of mitigation. In the first level, it is proposed to design a Threshold-based rate-limiting with a Spoofing Resistant Tag (TSRT), as a source end countermeasure for High-Rate Flooding Attacks (HRFA) and spoofing attacks. In the second level, the accent is to discriminate normal traffic after Distributed Denial of Service (DDoS) traffic and drop the DDoS traffic at the destination end. Flow Congruence-based Selective Pushback (FCSP), as a destination-initiated countermeasure for the Low Rate Flooding Attack (LRFA). The source and the destination cooperate to identify and block the attack. A key advantage of this cooperative mechanism is that it can distinguish and channel down the attack traffic nearer to the starting point of the attack. The presentation of the agreeable cooperative multilevel safeguard mechanism is approved through broad recreation in NS-2. The investigation and the exploratory outcomes show that the proposed plan can effectively identify and shield from the attack.     

基于数据包标记的伪造IP DDoS攻击防御

提出一种基于数据包标记的伪造IP DDoS攻击防御方案,该方案在IP数据包中嵌入一个路径相关的16位标识,通过检测标识计数器临界值判断是否发生了DDoS攻击,对伪造地址的IP数据包进行过滤,达到对DDoS攻击进行有效防御的目的。仿真实验表明,该方案对于伪造的IP数据包具有较高的识别率。     

基于流量优化的包标记IP追踪策略研究

传统的攻击源追踪方案在面对大规模DDoS攻击时,重构路径的收敛速度往往过慢.文中提出一种根据DDoS流量分布优化的随机包标记策略OMS(Optimized Marking Scheme),该策略通过在IP报头中插入控制信息,使标记包采样概率在攻击路径上随终点的距离递增,从而更远处的标记包能够以更高的概率到达终点.仿真试验的结果表明,OMS收敛速度较以往的方案有了明显的提高.     

基于合作过滤机制的ICMP回溯DDoS攻击源方法

提出一种改进的ICMP回溯方法。此方法是基于合作过滤机制的,采用合作过滤机制能够使产生的ICMP回溯包更有效并在尽可能靠近DDoS攻击源的地方过滤攻击包和保护合法包,改进后的ICMP方法对引发ITrace包的IP包从靠近攻击源的地方同步跟踪到受害者,提高了重构攻击路径的速度和准确性。