抗DDoS攻击的主动队列管理算法  

Active Queue Management Algorithm to Counter DDoS Attacks

作　　者：张长旺[1] 殷建平[1] 蔡志平[1] 刘新旺[1] 林加润[1] 朱明[1] 

机构地区：[1]国防科学技术大学计算机学院,湖南长沙410073

出　　处：《软件学报》2011年第9期2182-2192,共11页Journal of Software

基　　金：国家自然科学基金(60970034;61070198;60803002;60903040)

摘　　要：提出一种能够在DDoS(distributed denial-of-service)攻击下保证现有正常网络流量的弹性随机公平蓝色(resilient stochastic fair blue,简称RSFB)算法.RSFB算法根据数据流标记概率来识别良性数据流,并将识别出的良性数据流记录更新到一个良性数据流队列(benign flow queue,简称BFQ)中.算法再根据BFQ中的良性数据流记录来保证良性数据流数据包的顺利传输.通过开展一系列实验,评估对比了RSFB算法和几个著名主动队列管理(active queue management,简称AQM)算法的抗DDoS攻击性能.实验结果表明,RSFB算法具有如下优点:1)具有高度的健壮性;2)能够在发生DDoS攻击时有效保证现有正常TCP数据流的吞吐率;3)抗DDoS攻击性能明显优于现有的主动队列管理算法.A resilient stochastic fair blue （RSFB） algorithm is proposed to preserve the existing normal network throughput under DDoS attacks. RSFB algorithm identifies benign flows according to their marking probability, which is derived from the stochastic fair blue algorithm. All the identified benign flows are then recorded in a benign flow queue （BFQ）. Finally, the RSFB algorithm ensures the transportation of the packets from benign flows to the BFQ. A series of simulations are carried out to evaluate the anti-attack performance of RSFB and a serial of well known AQM algorithms. The results show that the RSFB algorithm i） is highly robust, ii） can well preserve the TCP throughput in the presence of DDoS attacks, iii） and obviously over performs the existing AQM algorithms when facing DDoS attacks.

关 键 词：主动队列管理 分布式拒绝服务攻击 随机公平蓝色算法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]