域间路由系统的级联失效攻击及检测研究  

Research on cascading failure attack and detection of inner-domain routing system

作　　者：邱菡[1,2] 李玉峰 兰巨龙[1,3] 王清贤[1,2] 郭毅[1,2] 

机构地区：[1]解放军信息工程大学,郑州450002 [2]数字工程与先进计算国家重点实验室,郑州450002 [3]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《中国科学：信息科学》2017年第12期1715-1729,共15页Scientia Sinica(Informationis)

基　　金：国家自然科学基金(批准号:61502528;61402525;61402526)资助项目

摘　　要：针对BGP协议自适应机制缺陷,精心设计的攻击可使域间路由系统路由节点级联失效,从而导致整个域间路由系统崩溃.这类攻击的触发流量和响应行为均是合法的,对该类攻击的检测是网络安全领域研究的重难点课题之一.首先,本文分析现有可导致域间路由系统级联失效的攻击方法,提出BGP级联失效攻击的两阶段攻击模型,分析各阶段攻击特征和攻击起效时间.接着,根据不同的攻击阶段,对现有BGP级联失效攻击的检测方法进行分类和阐述,从实时性、准确性和代价等多方面进行了综合评价.最后,对当前研究存在的问题进行总结,并对未来研究发展进行展望.Attacks aiming at the vulnerabilities of a BGP self-adaptation mechanism may lead to a cascading failure of the routers, and the inter-domain routing system may even crash. The safety monitoring technologies of existing inter-domain routing systems cannot efficiently detect an attack because the attack flows and updates are practically valid. This is becoming an important and difficult research topic in the field of network security.In this paper, we first analyze the attack methods that may give rise to a cascading failure of an inter-domain routing system, propose a two-stage attack model of BGP cascading failure attacks, and extract the features and onset time of each attack stage. We then classify and elaborate on the current detection approaches, and evaluate them comprehensively from the perspectives of real-time implementation, accuracy, and cost. Finally, the current research issues are described and possible directions for future research are suggested.

关 键 词：域间路由系统 级联失效攻击 检测 两阶段攻击模型 攻击起效时间 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]