分布式拒绝服务的研究综述

Research Summarization of DDoS

DDoS(分布式拒绝服务)攻击是Internet的一个重大隐患,它雇佣Internet上很多的协从主机消耗目的主机和合法客户端之间的临界资源,经常在源端到目地端的通路上造成网络拥塞,达到搅乱正常的Internet操作的目的.现在已有的安全机制对这类攻击没有提供有效的防护措施.大量的攻击机器通过使用源地址欺骗使得现有的跟踪无法凑效,而且攻击者应用合法的数据包和变化的包信息使得描述和过滤攻击流都变得无效.本文分析DDoS攻击的原理和典型的攻击类型,探讨了两种常规检测模型,比较了几种数据挖掘的检测算法,提出了检测算法需要解决的问题.

Distributed denial-of-service （DDoS） attacks present an immense threat to the Internet. They engage the power of a vast number of coordinated Internet hosts to consume some critical resource at the target and deny the service to legitimate clients. As a side effect, they frequently create network congestion on the way from a source to the target, thus disrupting normal Internet operation. The existing security mechanisms do not provide effective defense against these attacks. A large number of attacking machines and the use of source IP address spoofing make the trace back impossible. The use of legitimate packets for the attack and the varying of packet fields disable characterization and filtering of the attack streams. This paper analyzes the principle of DDoS attacks and typical attack types, researches into two detection models and proposes a detection model. Several kinds of technology of data mining are introduced, some data mining arithmetic compared and some problems to be resolved are proposed accordingly.