脉冲式拒绝服务攻击及其防御  

Pulsing-based Denial of Service Attack and Defense

作　　者：陆伟宙[1] 余顺争[1] 

机构地区：[1]中山大学电子与通信工程系,广州510275

出　　处：《电信科学》2007年第9期67-72,共6页Telecommunications Science

基　　金：国家自然科学基金"网络与信息安全重大研究计划"资助项目(No.90304011);广东省自然科学基金资助项目(No.04009747);高等教育博士计划基金资助项目(No.20040558043)

摘　　要：脉冲式拒绝服务攻击是一类新型的拒绝服务攻击,与传统的泛洪式拒绝服务攻击相比,脉冲式拒绝服务攻击具有有效性和隐蔽性等特点。本文分析了脉冲式拒绝服务攻击的原理,介绍了目前已有的防御方法,并提出了一种基于流量摘要的检测方法,通过对总体流量进行检测发现异常后,再根据个体流的可疑程度对其进行过滤。Pulsing-based denial of service attack （PDoS attack） is a recently discovered attack that uses high narrow spikes to throttle TCP flows. Comparing with traditional flooding-based denial of service attacks, PDoS attacks are also effective but much more difficult to detect. In this paper, we analyze the frangibility of TCP congestion control mechanism and the rational of PDoS attack. We also review current detection schemes and discuss their disadvantages. Finally, we propose a new detection scheme basing on traffic digest, which can not only detect aggregative stream containing attack flow but also identify the attack flow.

关 键 词：脉冲式拒绝服务攻击 低速TCP攻击 流量摘要 异常检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]