抗DDoS攻击的主动队列管理算法

Active Queue Management Algorithm to Counter DDoS Attacks

提出一种能够在DDoS(distributed denial-of-service)攻击下保证现有正常网络流量的弹性随机公平蓝色(resilient stochastic fair blue,简称RSFB)算法.RSFB算法根据数据流标记概率来识别良性数据流,并将识别出的良性数据流记录更新到一个良性数据流队列(benign flow queue,简称BFQ)中.算法再根据BFQ中的良性数据流记录来保证良性数据流数据包的顺利传输.通过开展一系列实验,评估对比了RSFB算法和几个著名主动队列管理(active queue management,简称AQM)算法的抗DDoS攻击性能.实验结果表明,RSFB算法具有如下优点:1)具有高度的健壮性;2)能够在发生DDoS攻击时有效保证现有正常TCP数据流的吞吐率;3)抗DDoS攻击性能明显优于现有的主动队列管理算法.

A resilient stochastic fair blue （RSFB） algorithm is proposed to preserve the existing normal network throughput under DDoS attacks. RSFB algorithm identifies benign flows according to their marking probability, which is derived from the stochastic fair blue algorithm. All the identified benign flows are then recorded in a benign flow queue （BFQ）. Finally, the RSFB algorithm ensures the transportation of the packets from benign flows to the BFQ. A series of simulations are carried out to evaluate the anti-attack performance of RSFB and a serial of well known AQM algorithms. The results show that the RSFB algorithm i） is highly robust, ii） can well preserve the TCP throughput in the presence of DDoS attacks, iii） and obviously over performs the existing AQM algorithms when facing DDoS attacks.