基于动态口令的应用层DDoS攻击防御方案  

An OTP-Based Mechanism for Defending Application Layer DDoS Attacks

作　　者：叶晰[1,2] 温武少[2] 叶依如[1] 

机构地区：[1]温州医学院信息与工程学院,温州325035 [2]中山大学软件学院,广州510275

出　　处：《电信科学》2012年第10期88-93,共6页Telecommunications Science

基　　金：广东省自然科学基金资助项目(No.10151027501000061);浙江省教育厅科技基金资助项目(No.Y201222952);温州市科技局科技基金资助项目(No.Y20100301)

摘　　要：研究和设计了使用动态口令技术来保护服务器抵御DDoS攻击的OTP-DEF方案。首先,方案可根据服务器工作负载的不同,分别处于正常、疑似受攻击或确认受攻击3种工作模式之下,而基于动态口令的认证方案只在疑似受攻击工作模式下起作用。其次,由于动态口令会自动变化,故方案可抵御复制、重放和暴力破解攻击。第三,通过记录那些不解决难题并不断发送请求的IP地址来识别客户端是否为攻击者,一旦所有攻击者被识别出来后,OTP-DEF屏蔽其IP地址并停止发布难题,以便正常用户能方便地使用服务。最后,只需在服务器端实施和部署,客户端无需做任何更改。In this paper, we present the design and implementation of OTP-DEF, a kernel extension to protect web servers against application layer DDoS attacks. First of all, according to the load of web server, an OTP-DEF web server should fall into one of three following modes： normal, suspected attack or confirmed attack mode, and the OTP-DEF authentication mechanism shall only be activated when web server is in suspected attack mode. Secondly, we use OTP as our puzzle, which can automatically change at the certain time interval. It makes our proposal can defend copy attacks, replay attacks and Brute-Force Attack. Thirdly, OTP-DEF uses an intermediate stage to identify the IP addresses that ignore the test, and persistently bombard the server with requests despite repeated failures at solving the puzzles. Once these machines are identified, OTP-DEF blocks their requests, turns the tests off, and allows access to legitimate users who are unable or unwilling to solve tests. Finally, OTP- DEF requires no modifications to client software.

关 键 词：分布式拒绝服务攻击 动态口令 难题 网页服务 应用层 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]