基于聚集流量分类的流量型DoS攻击防御方法  

A Novel Method of Defending Flooding DoS Attack Based on Aggregate Traffic Classification

作　　者：黄鑫[1] 尹宝林[1] 

机构地区：[1]北京航空航天大学计算机学院,北京100083

出　　处：《计算机工程》2005年第18期132-134,196,共4页Computer Engineering

基　　金：武器装备预研基金资助项目

摘　　要：提出一种基于主机服务状态检测和关键流量识别的聚集流量细粒度分类、识别及控制方法,并在可控网络上实现基于此聚集流量分类的流量型DoS攻击分布式检测和防御。该方法利用攻击检测感知器和控制路由器间的安全通讯协作,通过调整控制路由器集上的聚集流量分类策略和Rampart控制机制对一般聚集流量的控制力度,使得被保护主机及其网络在受到流量型DoS攻击的情况下,其负载和拥塞程度仍可以稳定在一个正常的范围内,从而有效地保证关键聚集流量服务请求的QoS需求。Based on the status of the protected host and the identification of the key aggregate traffic, a new method is put forward to classify the aggregate traffic in a fine-granularity. A new mechanism of defending against the flooding DoS attack based on aggregate traffic control in the controllable network is also described, which cooperates between the monitor sensors and the controllable routers in security. Through constantly adjusting the classify policies of aggregate traffic and the parameters of rampart control mechanism in the controllable route, it can effectively control the malicious aggregate traffic, and thus make the load of protected host and network keep a normal level under the situation of flooding DoS attack and satisfy the QoS of key aggregate traffic.

关 键 词：拒绝服务 聚集流量 服务质量 追踪 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]