基于NTP反射放大攻击的DDoS追踪研究

提出了一种利用NTP反射型放大攻击的特点，通过对中国大陆开放公共NTP服务的主机定期发起主动探测（执行monlist指令），利用返回信息对全球范围NTP反射类DRDoS攻击事件进行长期追踪观察和统计分析。追踪从2014年2月开始，初始探测范围为大陆近1.4万台NTP服务主机，每隔2 h一个周期持续进行了164天，观测到了针对数十万个IP地址的疑似DDoS攻击行为。

Research on tracking DDoS based on NTP reflection amplification attack

Based on characteristics of NTP reflection amplification attack, proposes a method of regularly launching active detection to hosts of public NTP services in Chinese mainland (execution of monlist instruction) and doing a long-term follow-up observation and statistical analysis of global NTP reflection DRDoS attacks based on the return information. The track began in February 2014, the initial detection range covered 14 000 NTP servers in China mainland, and detection period is 164 days with two hours for each cycle, observed suspected DDOS attacks against hundreds of thousands of IP addresses.