基于StackSF的DDoS攻击和IP欺骗新型防御机制

A New Defense Mechanism against DDoS Attacks and IP Spoofing Based on StackSF

针对互联网上的主机正面临着IP欺骗和大规模分布式拒绝服务(DDoS)攻击威胁,提出一种新的防御机制——StackSF.该机制不同于以往的方法,它是通过数据包标记和临界过滤器分析每个数据包的信息内容,过滤掉攻击数据包并检测出遭受欺骗的源IP地址.同时,还可以防御各种方式的IP欺骗的攻击.

Today＇s Internet hosts are threatened by IP spoofing attacks and large scale Distributed Denial-of-Service （DDoS） attacks. We propose a new defense mechanism, StackSF, which unlike previous approaches, through Packet marking and threshold filter, StackSF can filter out attack packets and to detect spoofed source IP addresses, on a per-packet basis. It also could defend against many IP spoofing attacks at the same time.