DDoS攻击的源追踪与源端快速检测方法研究

II
硕士学位论文
Keywords: DDoS; IP Traceback; Attack Detection; CUSUM
IIIDDoS 攻击的来自追踪与源端快速检测方法研究插图索引
图 2.1 图 2.2 图 2.3 图 2.4 图 2.5 图 3.1 图 3.2 图 3.3 图 3.4 图 3.5 图 3.6 图 3.7 图 3.8 图 3.9 图 4.1 图 4.2 图 4.3 图 4.4 图 4.5 图 4.6 DDoS 攻击图 ...................................................................................... 7 SYN flooding 攻击原理图 ................................................................... 8 IPv4 头部格式 ................................................................................... 13 SPIE 体系结构图 .............................................................................. 14 D-WARD 系统模型 ........................................................................... 14 IPv6 头部格式 ................................................................................... 17 Bloom filters 摘要记录图 .................................................................. 20 转换查找表 ....................................................................................... 21 追踪流程图 ....................................................................................... 22 攻击路径重构图 ............................................................................... 23 隧道方式连接图 ............................................................................... 25 IPv4 → IPv6 转换表 ........................................................................... 26 误报率与哈希函数个数关系图 ......................................................... 27 存储效率与误报率关系图 ................................................................ 28 累加和算法效果图 ............................................................................ 32 TCP 连接建立与终止图 .................................................................... 33 不同阈值下的误警率和漏报率 ......................................................... 36 实验网络图 ....................................................................................... 38 攻击速率为 100SYNs/s 时 y [ n ] 变化图 ............................................. 39 攻击速率为 60SYNs/s 时 y [ n ] 变化图 ............................................... 39
I
DDoS 攻击的源追踪与源端快速检测方法研究
Abstract
Due to the deficiency of network protocol, there are a lot of attacks in network, among which DDoS attack has become one of the most common network attack technology because of its simplicity, strong concealment, and powerful destruction. DDoS attackers launched attacks from several sources that had already been penetrated. The attack streams exhausted the resource of the victim and rendered it unavailable to legitimate clients. This kind of attack has badly affected the effective service of network and host system. They threated the security of network and the usability of information very much. Directing at this attack, the existed countermeasure strategies have proposed solutions from the angles of IP Traceback and defense against DDoS attacks. IP Traceback technologies can effectively trace the locations of the real attack source, and then they can interdict on-going attacks and insulate DDoS attacks in networks. This paper presents an IP Traceback scheme based on improved SPIE in IPv6. The method sets the invariant field of IPv6 packets as the input of hash function and uses Bloom filters data structure upon routers to save digests of forwarded data packets. So, in addition to reduce the storage requirement, it can preserve traffic confidentiality. On the basis of IP Traceback scheme in IPv6 and by combining the IP Traceback scheme in IPv4, a new IP Traceback scheme for transition of IPv4/IPv6 is proposed. The method is fit for IP Traceback in DDoS, as well as tracing a single packet. Defense system against DDoS attacks is always deployed at victim, but legitimate traffic would be affected when filtering attack streams after detecting the attack. It’s easier to filter attack packets at source network, but the small amount of attack stream brings difficulty to attack detection. This paper presents a rapid source-end detection mechanism against DDoS attacks, which considers the amount difference between SYN packets in TCP and the corresponding SYN/ACK packets as detection factor. In order to abbreviate the delay of detection, an improved CUSUM method is proposed by taking the number of attackers into account. The improved CUSUM method reduces false positive by accumulating the continuous attacks. The experimental results show our scheme generates lower false positive and the delay of detection is shorter than the existed source-end detection method.