一种同步洪流攻击的监测模型

本文提出了一种新型的针对同步洪流攻击的监测模型．文中首先介绍了同步洪流攻击的原理和几种典型的防范这种攻击的对策，接着详述了监测模型的原理并论述了实现监测模型核心部分的方法．这种监测模型主要监测网络中是否发生同步洪流攻击，并及时采取措施恢复正常的网络运行．监测模型引入NDIS协议驱动程序，网络监听及多线程等技术，主要采用跟踪发起TCP连接请求的可疑IP地址的方法进行监测，采用释放被攻击主机上被占用的系统资源的措施使其恢复正常．

A monitor model against SYN flood attacks

This paper presents a monitor model for SYN flood attacks.At first,the paper introduces the principle of SYN flood attacks and several characteristic countermeasures against the attacks,then expounds the principle of the monitor model and explains the methods used to implement the kernel part of the model.The model is designed to monitor SYN flood attacks in the networks,and to make the networks resume by taking actions immediately.The model mainly uses several technologies including NDIS protocol driver,network monitoring, multithreading to trace spoofed IP addresses which request TCP connections with other hosts and to release the resource consumed by the attacked hosts.