SYN Flood攻击的原理及防御  

The Principle and Defense of SYN Flood Attack

作　　者：张文川[1] ZHANG Wenchuan(Lanzhou Petrochemical College of Vocational Technology,Lanzhou 730060,China)

机构地区：[1]兰州石化职业技术学院,甘肃兰州730060

出　　处：《软件工程》2019年第3期29-31,共3页Software Engineering

基　　金：全国工业和信息化职业教育教学指导委员会工信行指委"基于校企合作人才培养模式的信息化教学的研究与实践"项目编号:【2018】20号

摘　　要：SYN-Flood攻击是当前网络上最为常见的DDoS攻击,也是最为经典的拒绝服务攻击,它利用了TCP协议实现上的一个缺陷,通过向网络服务所在端口发送大量的伪造源地址的攻击报文,就可能造成目标服务器中的半开连接队列被占满,从而阻止其他合法用户进行访问。为了有效防范这种攻击,在分析攻击原理的基础上,发现可以使用TCP代理防御及TCP源探测防御方法来解决这个问题,经过测试证明,该办法能够有效降低SYNFlood攻击造成的危害。SYN-Flood attack is the most common DDoS attack and the most classic denial-of-service attack on the current network.It takes advantage of a flaw in TCP protocol implementation and sends a large number of attack packets of forged source addresses to the port where the network service is located,which may cause the semi-open connection queue in the target server to be occupied,thus preventing other legal users from accessing.In order to effectively prevent this attack,on the basis of analyzing the attack principle,it is found that TCP proxy defense and TCP source detection defense methods can be used to solve this problem.Testsprove that this method can effectively reduce the harm caused by SYN Flood attack.

关 键 词：DDOS攻击 STNFlood攻击 TCP代理防御 TCP源探测防御 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]