网络设备参与的DDoS防御系统的构建与仿真  

Construction and simulation of network equipment participating in DDoS defense system

作　　者：张锦辉[1] 张文秀 Zhang Jinhui;Zhang Wenxiu(Nanjing Research Institute,Huawei Technologies Co.,Ltd.,Nanjing 210012,China;School of Government Audit,Nanjing Audit University,Nanjing 211815,China)

机构地区：[1]华为技术有限公司南京研究所,江苏南京210012 [2]南京审计大学政府审计学院,江苏南京211815

出　　处：《信息技术与网络安全》2019年第1期1-6,共6页Information Technology and Network Security

基　　金：江苏省教育厅高校哲学社会研究项目(2016SJB630046);南京审计大学政府审计研究基金(GAS161026)

摘　　要：分布式拒绝服务(DDoS)攻击严重威胁网络安全,现有DDoS防御方法存在被攻击时防御能力不足,无攻击时能力浪费问题。通过在发生DDoS攻击时,通知互联网服务提供商(ISP)将已发现的攻击元组流量在网络中短暂丢弃的方式,可以在保证DDoS防御的前提下,显著减少防御能力部署。仿真实验表明,对已知的攻击元组流量丢弃合理的时长,即可在仅检测0. 55%攻击流量的前提下,阻止99. 9%的攻击流量。同时,合法流量只有2%因误判被阻塞,防护对象的负载相对正常情况下仅上升1. 77%。Distributed Denial of Service( DDoS) attacks seriously threaten network security. Existing DDo S defense methods have problems that insufficient defense capabilities when attacked,and waste of ability when without attack. When a DDo S attack occurs,the ISP is notified to temporarily discard the discovered attacking tuple traffic in the network,which can significantly reduce the defense capability requirement while ensuring DDo S defense. Simulation experiments show that 99. 9% of the attack traffic can be blocked when detecting only 0. 55% of the attack traffic under the premise of the known attacking tuple traffic is discarded for a reasonable period of time. At the same time,only 2% of the normal traffic is blocked due to misjudgment,and the load of the protection object only rises by 1. 77% compared with normal.

关 键 词：分布式拒绝服务 攻击防御 网络安全 互联网服务提供商 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]