一种基于源的DDoS攻击防御系统的设计  

A Design for Source-based DDoS Defense System

作　　者：刘利[1] 苏德富[2] 郑华[3] 

机构地区：[1]广东省惠州学院计算机科学系,惠州516001 [2]广西大学计算机与电子信息学院,南宁530004 [3]广西财经学院计算机与信息管理系,南宁530003

出　　处：《现代计算机》2006年第5期31-34,共4页Modern Computer

摘　　要：当前拒绝服务攻击工具随处可得,且易操作,使得分布式拒绝服务攻击发生的频率越来越高,此类攻击已被公认为互联网上最难解决的问题之一。本文主要基于R.Mahajan等提出的防范模型,将随机边标记和过滤机制相结合,设计了基于随机边标记的DDoS攻击防范系统。此系统可以充分利用IP回溯和过滤机制的优点,并相互弥补其不足。相对R.Mahajan等的方法来说,能更好地保护合法用户的请求及攻击源与受害者之间的网络带宽资源。Presently, tools for denial of service are available everywhere, and can be operated easily, making distributed denial of serviee increased in frequency. This kind of attack have been considered as one of most difficult security problems. This paper, based on the model of R. Mahajan etc and combining IP traeebaek with filter mechanism, designs a system for defending DDoS attacks. The system can make full use of the advantage of IP traceback and filter mechanism, and make up each other＇s shortage. So it not only can protect victim, but also can control attacking packets in advance and protect network bandwidth sequentially.

关 键 词：IP回溯 分布式拒绝服务攻击 随机边标记 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] U674.703.5[自动化与计算机技术—计算机科学与技术]