对抗DDoS攻击的新型分布式大规模流量清洗方案  

A Novel Distributed Large-Scale Traffic Cleaning Scheme against DDoS Attacks

作　　者：高汉成 黄海平[1,2] GAO Hancheng;HUANG Haiping(School of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing 210023,China;Jiangsu High Technology Research Key Laboratory for Wireless Sensor Networks,Nanjing 210023,China)

机构地区：[1]南京邮电大学计算机学院,南京210023 [2]江苏省无线传感网高技术研究重点实验室,南京210023

出　　处：《信息网络安全》2025年第1期78-87,共10页Netinfo Security

基　　金：国家自然科学基金[62072252]。

摘　　要：随着网络安全威胁的不断加剧,分布式拒绝服务对网络稳定性和业务连续性带来了前所未有的挑战。文章提出一种新型分布式大规模流量清洗方案,旨在有效应对DDoS攻击。该方案利用实时端口流量镜像技术和深度包检测技术,实现对恶意流量的快速识别和清洗,并且通过在网络边缘设备上直接清洗攻击流量,避免了带宽浪费和网络拥塞。实验通过模拟正常流量和恶意流量,利用所提方案对流量进行监控和清洗,实验结果表明,该方案能显著提高DDoS攻击流量的拦截和清洗效率,具有较好的实际应用价值。With the increasing severity of cybersecurity threats,especially the Distributed Denial of Service(DDoS)attacks,pose significant challenges to network stability and business continuity.This paper proposed a novel distributed large-scale traffic cleaning solution aimed at effectively combating DDoS attacks.The scheme utilized real-time port traffic mirroring technology and deep packet detection technology to rapidly identify and cleanse malicious traffic.Furthermore,by directly cleansing attack traffic on network edge devices,it preventd bandwidth waste and network congestion.Experiments were conducted by simulating normal and malicious traffic and applying the proposed scheme for traffic monitoring and cleansing.The results demonstrate that the scheme can significantly enhance the interception and cleansing efficiency of DDoS attack traffic,holding substantial practical application value and theoretical significance.

关 键 词：网络安全 分布式拒绝服务攻击 流量清洗 深度包检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]