基于日志监视主动防御HTTP泛洪攻击  

Proactive Defense Against HTTP Flood Attacks Based on Watching Web Log

作　　者：袁志[1] 

机构地区：[1]广州大学华软软件学院,广州510990

出　　处：《计算机系统应用》2012年第5期189-191,共3页Computer Systems & Applications

摘　　要：模仿正常访问行为的HTTP泛洪攻击较为隐蔽,在消耗网站服务器资源的同时还带来信息安全隐患,提出了一种主动防御方法。用URL重写的方法使Web日志记录HTTP请求的CookieId和SessionId;定时分析Web日志,利用CookieId和SessionID识别用户,根据请求时间特征来识别傀儡主机;对HTTP请求进行预处理,拦截傀儡主机的请求。该方法成本低、便于实施,实践证明了其有效性。HTTP flood attacks mimicking normal access behavior are difficult to discovered,it consumes web server＇s resources and brings hidden danger on information security,a method of proactive defense against HTTP floods is provided.Rewrite URL to record CookieId and SessionId of HTTP requests into Web log;analysis Web log at regular time,identify user according CookieId and SessionId,indentify puppet computers using request time characteristic;process HTTP requests in advance to keep out the requests from the puppet computers.This method is low cost and easy to implement,practice proved its validity.

关 键 词：分布式拒绝服务攻击 HTTP泛洪 网站安全 WEB日志分析 主动防御 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]