DDoS攻击从检测到流量识别总体防御方案研究

分布式拒绝服务(DDoS)攻击是互联网安全的严重威胁,攻击发生时会有大规模流量淹没目标网络和主机。能够准确快速地检测到攻击,区分合法拥塞流量和攻击流量,对攻击流量加以清洗,对于DDoS攻击的防御来说十分重要。采用信息熵对流量参数进行实时统计来检测攻击,用累积和(CUSUM)算法控制熵值连续变化情况。检测到攻击后,依据目的 IP数量前后增长情况找出受害者,对流向受害者处的流量进行重点观察。由于大规模的攻击流量与合法的拥塞流量非常相似,难以识别,在此对流本身的相似性进行考察,使用流相关系数算法辨别攻击流量和合法拥塞流量,为流量清洗工作提供依据。

基于相似系数的DDOS攻击检测研究

针对服务器的DDOS攻击,在分析流量基础上,提出一种利用相似系数检测DDOS攻击的算法。该算法以单位时间的数据量作为计算项,统计实验数据值,通过与阈值的比较检测DDOS攻击。此算法具有在线检测、实时性强的特点,对插入式DDOS攻击检测尤其有效。实验表明,在阈值参数取值适当的情况下,DDOS攻击的检测准确率有较高的提升。

The History, Trend, Types, and Mitigation of Distributed Denial of Service Attacks

Over time, the world has transformed digitally and there is total dependence on the internet. Many more gadgets are continuously interconnected in the internet ecosystem. This fact has made the Internet a global information source for every being. Despite all this, attacker knowledge by cybercriminals has advanced and resulted in different attack methodologies on the internet and its data stores. This paper will discuss the origin and significance of Denial of Service (DoS) and Distributed Denial of Service (DDoS). These kinds of attacks remain the most effective methods used by the bad guys to cause substantial damage in terms of operational, reputational, and financial damage to organizations globally. These kinds of attacks have hindered network performance and availability. The victim’s network is flooded with massive illegal traffic hence, denying genuine traffic from passing through for authorized users. The paper will explore detection mechanisms, and mitigation techniques for this network threat.