低速率TCP拒绝服务攻击的检测响应机制

Detection and response of low-rate TCP-targeted denial of service attacks

低速率TCP拒绝服务攻击利用传输控制协议(TCP)重传超时机制,爆发时会严重降低合法TCP流吞吐量的流量特性.分析发现,合法流量和包含攻击包流量采样在功率谱密度上存在显著差异.通过分析大量历史数据中这种差异的统计特性,提出了以低频功率和为指标的检测方法.同时基于现有的漏桶限流和增加路由器接收缓存的响应方法,提出了结合包队列和漏桶的响应方法,主要原理是在漏桶周期性平滑流量的同时,将多余流量暂存在一个包队列中以在下一个周期发送.数学分析证明了该响应方法具有合理的资源要求.仿真实验表明,提出的检测方法具有极低的漏报率和误报率,与已有的典型方法相比,提出的响应方法能够在具有一般性的攻击场景下更加有效地抑制攻击流量,并且在已有方法失效的情况下仍能保证吞吐量维持在接近正常的水平.

Low rate TCP-targeted denial of service （DOS） attack makes use of time-out and retransmission mechanism in transmission control protocol （TCP） and could severely decrease the throughput of legitimate TCP traffic. With its attacking traffic pattern, obvious difference was found between the power spectrum density （PSD） of legitimate and attack traffic samples. The statistical characteristic of this difference in history data was analyzed, arid a detection method using the summation of low frequency was proposed. Meanwhile, based on the methods of leak bucket and the increasing of routing buffer, a response method was provided, which uses leak bucket periodically for smoothing the flow and uses buffer for holding extra traffic to send in next period, and its reasonable resource requirement was proved. Simulations show that for more general attack scenarios than the existing methods, the detection method has very low positive and negative false ratio, and the response method can depress attack flows more effectively than the previous methods and maintain the iegitimate throughput in a normal level while the orevious methods failed.