基于流媒体服务DDoS攻击防范研究

分布式拒绝服务（Distributed Deny of Service,DDoS）攻击是目前最难解决的网络安全问题之一。在研究RTSP（Real-Time Streaming Protocol）协议漏洞基础上,提出一种有效防御流媒体服务DDoS攻击防御方案。该方案基于时间方差图法（Variance-TimePlots,VTP）,计算自相似参数Hurst值,利用正常网络流量符合自相似模型的特性来进行DDoS攻击检测,并综合采用黑白名单技术对流量进行处理。最后通过MATLAB仿真工具进行了模拟实验,并对结果进行了分析,在协议分析基础上能合理控制流量,使得DDoS攻击检测准确率、实时性高,目标流媒体服务器带宽和资源得到了有效保护。     

基于模型研判的TLS恶意流量检测

为了解决加密流量中隐藏的网络安全攻击行为，提出了基于模型研判的安全传输层协议（Transport Layer Security,TLS）恶意流量检测技术。在网关设备对加密流量不进行解密的情况下，提取流量中的密钥协商和身份认证等明文信息，并结合网络安全专家经验和机器学习算法知识，通过数据处理、特征编码等技术手段，在不消耗大量资源的前提下，准确检测出加密流量中的恶意攻击事件，实现了对加密流量的智能化检测，可帮助企业保障通信安全。     

一种基于资源感知的小流量DDoS攻击防御方法

分布式拒绝服务攻击（DDoS）对网络具有极大的破坏性,严重影响现网的正常运营。虽然现网已经部署针对DDoS的流量清洗系统,然而小流量的攻击较洪水型攻击更难以被感知,进而不能得到有效的清洗。本文分析了网络中小流量DDoS攻击的原理和防御现状,并提出一种基于资源感知的小流量DDoS攻击防御方法。     

基于流量强度的DDoS攻击源追踪快速算法

DDoS攻击以其破坏力大、易实施、难检测、难追踪等特点,而成为网络攻击中难处理的问题之一。攻击源追踪技术是阻断攻击源、追踪相关责任、提供法律证据的必要手段。基于网络拓扑理论和路由器流量特性原理以及可编程式路由器的体系结构,提出了一种追踪DDoS攻击源的分布式快速算法,该算法可以准确、协调、高效地判断路由器的数据流量值,受害者可以根据流量强度推断出恶意攻击数据流的来源,从而快速追溯和定位DDoS攻击源。     

基于用户信誉值防御DDoS攻击的协同模型

提出了一种基于用户信誉值防御DDoS攻击协同(CDDACR,cooperation defense DDoS attack based on client reputation)模型来检测和防御DDoS攻击.该模型在逻辑上由2个检测代理构成:路由器端的RDA(router detection agent)和服务器端的SDA(server detection agent).RDA对用户数据流进行粗粒度检测,旨在过滤具有明显DDoS攻击特征的恶意数据流;SDA对用户数据流进行细粒度检测,检测并过滤恶意的狡猾攻击和低流量攻击,RDA和SDA协同工作来实时监测网络状况.实验结果表明,CDDACR模型能实时地识别和防御DDoS攻击,并且在异常发生时有效地阻止服务器被攻击的可能性.     

基于小波分析的网络低速率DDoS攻击检测方法

为减少网络DDoS（分布式拒绝服务）攻击检测误报率,实现对网络DDoS攻击的精准检测,有针对性地调节网络的运行速率,文章设计一种基于小波分析的网络低速率DDoS攻击检测方法。提取DDoS攻击特征,布设异常攻击定位节点,识别异常波段进行同步处理,构建小波分析DDoS攻击检测模型。最终的测试结果表明,对比于传统攻击检测小组,文章设计的小波分析DDoS攻击检测小组误差较小,检测效率较高,具有一定的应用价值。     

一种基于流量检测的校园网洪攻击防御方法研究

针对数字化校园运行的实际情况分析,分布式拒绝服务攻击成为校园网络安全的大敌,结合其攻击原理与相应的校园网络传输与解析协议,从数据中心服务器运行与维护出发,提出了一种基于流量监测的校园网数据中心服务器应对DDoS的方法,在不额外增加硬件运行成本的前提下,实现了一种直接面向流量进行分布式拒绝服务攻击的检测和防范.该方法在网络维护及实践应用中起到了保护服务器网络安全的作用.     

DDoS攻击从检测到流量识别总体防御方案研究

分布式拒绝服务（DDoS）攻击是互联网安全的严重威胁,攻击发生时会有大规模流量淹没目标网络和主机。能够准确快速地检测到攻击,区分合法拥塞流量和攻击流量,对攻击流量加以清洗,对于DDoS攻击的防御来说十分重要。采用信息熵对流量参数进行实时统计来检测攻击,用累积和（CUSUM）算法控制熵值连续变化情况。检测到攻击后,依据目的IP数量前后增长情况找出受害者,对流向受害者处的流量进行重点观察。由于大规模的攻击流量与合法的拥塞流量非常相似,难以识别,在此对流本身的相似性进行考察,使用流相关系数算法辨别攻击流量和合法拥塞流量,为流量清洗工作提供依据。     

SDN环境下基于LightGBM的DDoS流量分类

软件定义网络(SDN)以其高度的网络可编程性和灵活性,通过将控制平面与数据平面解耦,克服了传统网络中存在的问题,近年来成为一种新的网络结构。但由于控制器是SDN的核心部分,因此更容易发生攻击,尤其是分布式拒绝服务攻击(DDoS),已经成为SDN环境的最大安全威胁。分布式拒绝服务(DDoS)攻击会使SDN控制器和交换机流表过载,导致网络性能下降,甚至瘫痪整个网络。检测攻击速度快、精度高,误报率低是解决DDoS攻击的关键。为此,我们通过公开的入侵检测数据集IDS2018,使用LightGBM算法训练DDoS分类模型,实现对正常流量和DDoS攻击流量的分类。对比XGBoost算法,改进后的LightGBM算法分类效果更好。使用虚拟环境Mininet构建SDN拓扑,使用Ryu作为SDN控制器。模拟DDoS攻击并通过sFlow RT收集攻击流量,利用训练好的DDoS流量分类模型进行检测,模型五折交叉验证AUC达到0.81。     

基于IXP 1200平台的DDoS攻击防御研究

分布式拒绝服务攻击（DDoS）已经成为互联网最大的威胁之一.提出了一种基于Intel IXP1200网络处理器平台的DDoS防御系统的设计方案,并实际实现了一个防御系统D-Fighter.提出了解决DDoS攻击的两个关键技术：数据包认证和细微流量控制的原理和方法,并在D-Fighter中设计实现.经过实际网络测试环境的应用测试表明,D-Fighter达到了设计目标,对DDoS攻击的防御有较好的效果.     

Research on DDoS detection in multi-tenant cloud based on entropy change

An attacker compromised a number of VMs in the cloud to form his own network to launch a powerful distrib-uted denial of service (DDoS) attack.DDoS attack is a serious threat to multi-tenant cloud.It is difficult to detect which VM in the cloud are compromised and what is the attack target,especially when the VM in the cloud is the victim.A DDoS detection method was presented suitable for multi-tenant cloud environment by identifying the malicious VM at-tack sources first and then the victims.A distributed detection framework was proposed.The distributed agent detects the suspicious VM which generate the potential DDoS attack traffic flows on the source side.A central server confirms the real attack flows.The feasibility and effectiveness of the proposed detection method are verified by experiments in the multi-tenant cloud environment.     

Adaptive Defense Against Various Network Attacks

In defending against various network attacks, such as distributed denial-of-service (DDoS) attacks or worm attacks, a defense system needs to deal with various network conditions and dynamically changing attacks. Therefore, a good defense system needs to have a built-in “adaptive defense” functionality based on cost minimization—adaptively adjusting its configurations according to the network condition and attack severity in order to minimize the combined cost introduced by false positives (misidentify normal traffic as attack) and false negatives (misidentify attack traffic as normal) at any time. In this way, the adaptive defense system can generate fewer false alarms in normal situations or under light attacks with relaxed defense configurations, while protecting a network or a server more vigorously under severe attacks. In this paper, we present concrete adaptive defense system designs for defending against two major network attacks: SYN flood DDoS attack and Internet worm infection. The adaptive defense is a high-level system design that can be built on various underlying nonadaptive detection and filtering algorithms, which makes it applicable for a wide range of security defenses.     

DDoS attack detection in IEEE 802.16 based networks

Achieving high data rate transmission, WiMAX has acquired noticeable attention by communication industry. One of the vulnerabilities of the WiMAX network which leads to DDoS attack is sending a high volume of ranging request messages to base station (BS) in the initial network entry process. In the initial network entry process, BS and subscriber station (SS) exchange management messages. Since some of these messages are not authenticated, malicious SSs can attack the network by exploiting this vulnerability which may increase the traffic load of the BS and prevent it from serving the SSs. So, detecting such attacks is one of the most important issues in such networks. In this research, an artificial neural network (ANN) based approach is proposed in order to detect DDoS attacks in IEEE 802.16 networks. Although lots of studies have been devoted to the detection of DDoS attack, some of them focus just on some statistical features of the traffic and some other focus on packets’ headers. The proposed approach exploits both qualitative and quantitative methods. It detects the attack by feeding some features of the network traffic under attack to an appropriate ANN structure. To evaluate the method, first a typical attacked network is implemented in OPNet simulator, and then by using the proposed system, the efficiency of the method is evaluated. The results show that by choosing suitable time series we can classify 93 % of normal traffic and 91 % of attack traffic.     

基于HMM的分布式拒绝服务攻击检测方法

文章根据分布式拒绝服务攻击（DDoS）的本质特点，提出了一种基于隐马尔可夫模型（HMM）的DDoS攻击检测方法。该方法通过IP地址信息库．保存当前常用服务的源IP地址，然后对新到数据包的IP地址用HMM建模。通过离线训练，更新IP地址信息库，优化HMM参数。在线检测时，IP地址信息库在线学习更新，HMM实时检测．并根据检测结果通过边界路由器进行积极响应。实验结果显示，该方法具有很好的检测效果，并能及时响应，保持常用服务的延续性。     

Differentiating Malicious DDoS Attack Traffic from Normal TCP Flows by Proactive Tests

To defend against distributed denial of service (DDoS) attacks, one critical issue is to effectively isolate the attack traffic from the normal ones. A novel DDoS defense scheme based on TCP is hereby contrived because TCP is the dominant traffic for both the normal and lethal flows in the Internet. Unlike most of the previous DDoS defense schemes that are passive in nature, the proposal uses proactive tests to identify and isolate the malicious traffic. Simulation results validate the effectiveness of our proposed scheme     

分布式DNS反射DDoS攻击检测及控制技术

分布式DNS反射DDoS攻击已经成为拒绝服务攻击的主要形式之一,传统的基于网络流量统计分析和网络流量控制技术已经不能满足防护需求。提出了基于生存时间值（TTL）智能研判的DNS反射攻击检测技术,能够准确发现伪造源IP地址分组;基于多系统融合的伪造源地址溯源阻断技术,从源头上阻断攻击流量流入网络。     

Detection of Low-Rate Cloud DDoS Attacks in Frequency Domain Using Fast Hartley Transform

Distributed Denial-of-Service (DDoS) attack has been a serious threat to the availability feature of cloud computing. As traditional DDoS attacks are implemented using a huge volume of malicious traffic, the detection of such attacks becomes a naive task. To evade this detection, attackers are moving towards the Low-Rate DDoS (LRDDoS) attacks. The stealthy behavior of LRDDoS attack makes it difficult to get detected due to its low volume traffic. The existing frequency-domain approaches for LRDDoS detection are not feasible in terms of computational and storage requirements. This paper aims to propose a lightweight, accurate, and adaptive approach for the detection of LRDDoS attacks in frequency-domain. In this paper, the LRDDoS attack is detected by analyzing the power spectral distribution. The novelty of the proposed approach is to calculate the power spectral density using Fast Hartley Transform (FHT). The FHT processes real-valued input data, and has low computational and storage complexities. The approach is implemented on OpenStack cloud platform, and the aggregate network traffic (external and internal) is captured and analyzed. Experimental results show that the computational and storage complexities involved in FHT are lower than other transformation algorithms’ complexities. Thus, the approach provides faster response with an average detection time of 60.16 s. The average true negative and true positive rates obtained by the proposed approach are 99.83% and 99.46% respectively, which are competitive.

     

DDoS attack detection and defense based on hybrid deep learning model in SDN

Software defined network (SDN) is a new kind of network technology,and the security problems are the hot topics in SDN field,such as SDN control channel security,forged service deployment and external distributed denial of service (DDoS) attacks.Aiming at DDoS attack problem of security in SDN,a DDoS attack detection method called DCNN-DSAE based on deep learning hybrid model in SDN was proposed.In this method,when a deep learning model was constructed,the input feature included 21 different types of fields extracted from the data plane and 5 extra self-designed features of distinguishing flow types.The experimental results show that the method has high accuracy,it’s better than the traditional support vector machine (SVM) and deep neural network (DNN) and other machine learning methods.At the same time,the proposed method can also shorten the processing time of classification detection.The detection model is deployed in SDN controller,and the new security policy is sent to the OpenFlow switch to achieve the defense against specific DDoS attack.     

UDM:NFV-based prevention mechanism against DDoS attack on SDN controller

DDoS attack extensively existed have been mortal threats for the software-defined networking (SDN) controllers and there is no any security mechanism which can prevent them yet.Combining SDN and network function virtualization (NFV),a novel preventing mechanism against DDoS attacks on SDN controller called upfront detection middlebox (UDM) was proposed.The upfront detection middlebox was deployed between SDN switch interfaces and user hosts distributed,and DDoS attack packets were detected and denied.An NFV-based method of implementing the upfront middlebox was put forward,which made the UDM mechanism be economical and effective.A prototype system based on this mechanism was implemented and lots experiments were tested.The experimental results show that the UDM mechanism based on NFV can real-time and effectively detect and prevent against DDoS attacks on SDN controllers.     

新网络环境下应用层DDoS攻击的剖析与防御

针对新网络环境下近两年新出现的应用层分布式拒绝服务攻击,本文将详细剖析其原理与特点,并分析现有检测机制在处理这种攻击上的不足.最后,本文提出一种基于用户行为的检测机制,它利用Web挖掘的方法通过Web访问行为与正常用户浏览行为的偏离程度检测与过滤恶意的攻击请求,并通过应用层与传输层的协作实现对攻击源的隔离.