基于SYN Cache/Cookie的防DoS攻击的改进方案  

An Improved Scheme Defending Against Denial of Service Based on SYN Cache/Cookie

作　　者：陈刚[1] 杨波[1] 

机构地区：[1]西安电子科技大学计算机网络与信息安全教育部重点实验室,西安710071

出　　处：《计算机工程》2005年第21期140-142,共3页Computer Engineering

基　　金：国家自然科学基金资助项目(60372046);现代通信国家重点实验室基金资助项目(5143604020DZ0102)

摘　　要：提出了对现有SYNCache/Cookie的改进方法,针对Cache的哈希表的弱安全性引入了变换矩阵TM,使得攻击者预选的套接字对不会产生哈希冲突。针对Cookie携带的选项信息少、算法复杂效率低,引入了简洁有效的TM和S盒代换,以生成可以验证携带较多选项信息的ISNs。最后,依据攻击状态的不同,整合了SYNCache/Cookie,以便更好地抵御SYNFlood拒绝服务攻击。This paper presents an improved scheme on SYN cache/cookie available. For the weak security of hash table, it introduces the transform matrix（TM） to make these sockets attacker pre-selecting can＇t produce hash collisions. For the less option messages cookie taking, and complicate algorithm, low in efficiency, it provides a TM and s-box substitution approach which is concise and efficient to generate the ISNs taking more messages that can be verified. In the end, it integrates SYN cache and SYN cookie in terms of different attack cases to defend against SYN flood DoS effectively.

关 键 词：SYN CACHE SYN COOKIE 哈希算法 变换矩阵 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]