DDoS攻击的检测与溯源探析  

Detection and Traceability Analysis of DDoS Attacks

作　　者：龚应龙 曾霞霞 郭伟彬 郑宇 胡明霞 GONG Yinglong;ZENG Xiaxia;GUO Weibin;ZHENG Yu;HU Mingxia(School of Computer and Control Engineering,Minjiang University,Fuzhou,China,350121)

机构地区：[1]闽江学院计算机与控制工程学院,福州350121

出　　处：《福建电脑》2022年第1期11-14,共4页Journal of Fujian Computer

基　　金：闽江学院校长基金项目(No.103952020032)资助。

摘　　要：分布式拒绝服务攻击是当前流行的网络攻击手段之一,影响力巨大。本文主要探讨了DDoS攻击的检测方法和IP溯源技术,重点分析3种DDoS检测方法:流量、日志、数据包分析法,提出了运用数据包切片标记实现对伪造IP攻击溯源的方法。通过搭建分布式DDoS攻击实验环境,综合应用流量监控、日志分析和数据包切片标记的方法实现了对DDoS的IP溯源。通过反复实验测试,证明方法的可行性、准确率可达90%。Distributed denial-of-service attack is one of the most popular network attack methods and has great influence.This paper mainly discusses the detection methods of DDoS attacks and IP tracing technology,focuses on analyzing three DDoS detection methods:traffic,log and packet analysis,and proposes a method to trace forged IP attacks by using packet slice marking.By setting up the experimental environment of distributed DDoS attack,the IP tracing of DDoS attack is realized by integrating the methods of traffic monitoring,log analysis and packet slice marking.Through repeated experiments,the feasibility and accuracy of the method can reach 90%.

关 键 词：分布式拒绝服务攻击 傀儡机 靶机 包标记 

分 类 号：TN915.08[电子电信—通信与信息系统]