针对DDoS攻击的检测与控制系统  

Detection and Control System for DDoS Attack

作　　者：金伟[1] 崔鸿[1] 王志[1] 郭发勤 汪屹文 贺帅[1] 

机构地区：[1]中国民航大学,天津300000

出　　处：《网络空间安全》2017年第6期19-22,共4页Cyberspace Security

基　　金：大学生创新创业训练计划项目(项目编号:IECAUC2016029)

摘　　要：基于TCP协议的超时重传,实现了一个可以有效防御DDoS攻击中SYN Flood攻击的检测与控制系统。由于SYN Flood攻击无法实现超时重传机制,系统通过主动丢包的方式来验证发送方是否能够实现该机制,进而判断发送方意图,过滤攻击流量,同时采用黑名单、TCP代理服务器等机制提高系统性能。测试证明,此系统能在可以接受的延迟范围内有效降低攻击损害程度,保障Web服务正常提供。Based on the timeout retransmission mechanism of TCP protocol, a detection and control system is designed to prevent SYN Flood attack （a kind of DDoS attack）effectively. Due to the fact that the SYN Flood attack can not achieve the timeout retransmission mechanism, the system verifies the sender whether he can implement the mechanism by means of discarding the packet forwardly, and then judges the intention of the sender and filters the attack traffic. At the same time,the system also uses the blacklist, TCP proxy server and other mechanisms to improve system performance. Tests have shown that the system can effectively reduce the degree of attack damage within an acceptable connection delay range and ensure that Web services are provided normally.

关 键 词：DDOS攻击 网络安全 TCP代理 超时重传 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]