基于拥塞控制的DDoS防御机制的研究  

A study on the prevention mechanism of DDoS based on congestion control

作　　者：忽海娜[1] 万鸿运[1] 程明[2] 

机构地区：[1]许昌学院教育技术与信息部,461000 [2]天津理工大学信息技术研究所,300191

出　　处：《微计算机信息》2006年第06X期91-93,共3页Control & Automation

基　　金：教育部科学技术重点基金资助项目(03010)

摘　　要：DDoS攻击数据流在发生网络拥塞的情况下并不降低他们的发送速率,充满了路由器的缓冲区,剥夺其他正常数据流的带宽。基于这一网络行为,从拥塞控制的角度来研究DDoS攻击目标端的防御机制。通过仿真实验,对传统的队列管理策略和基于聚类的拥塞控制机制ACC进行了比较,进一步验证了ACC算法在控制恶意数据流的有效性。DDoS flows that do not cut down their sending rates after their packets are dropped will hog the buffer space at routers and deprive all other flows of their fair share of bandwidth. Based on the characteristic, We study the prevention mechanism of DDoS from the aspect of congestion control. We compare the traditional queuing management with Aggregate-based congestion control through the simulation, and prove the efficiency of ACC that control the malicious flows.

关 键 词：分布式拒绝服务 拥塞控制 聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]