一种基于数据包综合信任度的防火墙包过滤模型  

A model of firewall packet filtering based on the integrated reputation

作　　者：李胜利[1] 何丽莉[1] 韩宗芬[1] 孙建华[1] 

机构地区：[1]华中科技大学计算机科学与技术学院,湖北武汉430074

出　　处：《华中科技大学学报（自然科学版）》2005年第2期89-91,共3页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：湖北省自然科学重点基金资助项目(2001ABA001);武汉市科技攻关计划基金资助项目(20031003027).

摘　　要：针对分布式拒绝服务攻击的特点和目前防火墙采用的包过滤技术在攻击响应时的不足,提出了一种基于数据包综合信任度的防火墙包过滤模型.该模型中,对发往受保护主机的TCP和UDP数据包进行过滤时,不仅要考虑该数据包的特性以及记录的状态,还要考虑计算的综合信任度和由此得到的信任级别,从而通过为不同级别的数据包提供不同的服务质量来减轻拒绝服务攻击.By analyzing features of DDoS attack and disadvantages of traditional firewall packet filtering schemes in attack response, this paper presented a model of firewall packet filtering based on the integrated reputation. In this model, the filtering of a TCP or UDP packet to protect hosts involved the packet′s features and state, and its integrated reputation and reputation level. Denial of service attacks through differential quality of services provided to packets of differential reputation levels was mitigated.

关 键 词：分布式拒绝服务攻击 防火墙 包过滤 信任度 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]