摘要
针对字符发生器协议、域名系统协议、网络时钟协议、简单网络管理协议、简单服务发现协议这5种类型的用户数据报协议(UDP)反射攻击放大器,提出基于入侵检测系统(IDS)的UDP反射攻击响应方案。在定位到反射攻击放大器的前提下,结合网络边界的软件定义网络技术,采用基于OpenFlow流表的响应规则对控制命令报文进行过滤,从而阻止UDP反射攻击。在中国教育和科研计算机网南京主节点的网络边界上的测试结果验证了该响应方案的可操作性和有效性。
Based on an Intrusion Detection System(IDS),this paper proposes a response scheme for User Datagram Protocol(UDP)reflection attacks from 5 kinds of UDP reflection attack amplifiers,including Character Generator Protocol(CharGen),Domain Name System(DNS),Network Time Protocol(NTP),Simple Network Management Protocol(SNMP)and Simple Service Discovery Protocol(SSDP).After the reflection attack amplifier is located,the scheme combines Software Defined Network(SDN)on the network boundary with response rules based on OpenFlow tables to filter control command messages,so UDP reflection attacks can be prevented.Test results on the network boundary of Nanjing main node of China Education and Research Computer Network(CERNET)demonstrate the operability and effectiveness of the proposed response scheme.
作者
丁伟
张千风
周文烽
DING Wei;ZHANG Qianfeng;ZHOU Wenfeng(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;School of Computer Science and Engineering,Southeast University,Nanjing 211189,China)
出处
《计算机工程》
CAS
CSCD
北大核心
2020年第1期121-128,共8页
Computer Engineering
基金
国家自然科学基金(61602114)
国家重点研发计划(2018YFB1800202)
关键词
用户数据报协议
反射攻击放大器
软件定义网络
反射攻击响应
网络边界
User Datagram Protocol(UDP)
reflection attack amplifier
Software Defined Network(SDN)
reflection attack response
network boundary
