网络高流量分布式拒绝服务攻击防御机制研究综述  

Review of Network High Flow Distributed Denial of Service Attack and Defense Mechanisms

作　　者：李恒[1,2] 沈华伟[3] 程学旗[3] 翟永[1] LI Heng;SHEN Huawei;CHENG Xueqi;ZHAI Yong(National Geomatics Center of China, Beijing 100830, China;College of Engineering & Science, University of Chinese Academy of Sciences, Beijing 100049, China;Institute of Computing Technology of Chinese Academy of Sciences, Beijing 100190, China)

机构地区：[1]国家基础地理信息中心,北京100830 [2]中国科学院大学工程科学学院,北京100049 [3]中国科学院计算技术研究所,北京100190

出　　处：《信息网络安全》2017年第5期37-43,共7页Netinfo Security

基　　金：国家重点基础研究发展计划[2013CB329606];国家杰出青年科学基金[61425016];国家自然科学基金重点项目[61232010]

摘　　要：分布式拒绝服务(DDoS)攻击是一种极其常见的网络攻击方式,网络高流量的DDoS往往通过制造大量无用数据,造成网络拥塞,最终达到耗尽资源、中断正常服务的目的。目前针对网络高流量的DDoS攻击还没有较好的防御办法。文章基于前期研究及文献调研,对国内外网络高流量DDoS防御机制的研究进展进行了归纳总结,重点对其防御原理、检测防御和抵抗防御方法进行了总结;对当前高流量DDoS攻击检测防御和抵抗防御机制进行了展望,以期有助于构建全面有效的网络高流量DDoS防御系统。Distributed Denial of Service(DDoS)attack is one of the extremely familiar networkattack methods.In the condition of high flow capacity,DDoS causes network congestion by meansof manufacturing useless data,finally leading to resource exhausting and normal service interrupt.No effective defense for now is against the high flow capacity DDoS.Based on preliminary studyand literature researches,this thesis summarizes and analyses the domestic and international researchprogress of network high fl ow DDoS defense mechanisms,emphasis on attacks detection and defenseprinciple and attack test,makes a summary of features and disadvantages of different detection anddefense mechanisms,in order to establish the comprehensive and effective network high fl ow DDoSdefense mechanisms.

关 键 词：分布式拒绝服务(DDoS) 高流量 攻击检测 攻击防御 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]