基于多阈值包过滤策略的DDoS防范机制研究

The Study on Defending DDoS Based on Multi-threshold Packet Filtering Policy

DDoS(Distributed Denial of Service),即"分布式拒绝服务"攻击,DDoS攻击的本质是通过不对等的方式,对目标机发出非正常服务要求,耗尽目标机本身的资源,使其无法提供正常服务,具有较大的危害性。传统的基于流量分析和阈值策略的防范机制使用单阈值或双阈值来判断攻击行为,虽然可以较为便捷地实现DDoS防范,然而这样也导致防范精度较低。文中针对基于流量阈值的基础上提出反馈型多阈值过滤机制,通过建立将回收圈的统计数据反馈给阈值的计算机制,有效地提高了攻击防范精度。仿真实验证明,该系统相对于以前的技术,其具备较高的防范精度。

Traditional flow analysis and threshold strategy prevention polices use single threshold or double threshold to determine attack behavior.It is easily to realize a DDoS system.But the accuracy is lower.In this paper,we present a double-layer multi-threshold filtering mechanism by using the statistical calculation of recovery loop feedback to the threshold.Simulation results show that the system has a higher prevention accuracy compared with the previous system.