This paper presents a mechanism for detecting flooding-attacks. The simplicity of the mechanism lies in its statelessness and low computation overhead, which makes the detection mechanism itself immune to flooding-att...This paper presents a mechanism for detecting flooding-attacks. The simplicity of the mechanism lies in its statelessness and low computation overhead, which makes the detection mechanism itself immune to flooding-attacks. The SYN-flooding, as an instance of flooding-attack, is used to illustrate the anomaly detection mechanism. The mechanism applies an exponentially weighted moving average (EWMA) method to detect the abrupt net flow and applies a symmetry analysis method to detect the anomaly activity of the network flow. Experiment shows that the mechanism has high detection accuracy and low detection latency.展开更多
针对随机早期检测(random early detection,RED)算法在慢速拒绝服务攻击(low-rate deny of serv-ice,LDoS)面前的脆弱性问题,本文通过对比路由器分别在RED和尾丢弃Drop-Tail算法管理下遭受LDoS攻击时的队列平均占用率及吞吐量,指出虽然...针对随机早期检测(random early detection,RED)算法在慢速拒绝服务攻击(low-rate deny of serv-ice,LDoS)面前的脆弱性问题,本文通过对比路由器分别在RED和尾丢弃Drop-Tail算法管理下遭受LDoS攻击时的队列平均占用率及吞吐量,指出虽然路由器在RED算法下具有较大的空闲缓冲区,却不能对网络流量攻击起到缓冲作用.仿真对比实验表明,LDoS攻击使得路由器在RED下比Drop-Tail具有更大的链路损失带宽.指出现有LDoS的防范和检测方法的不足,构造了一种分布式LDoS攻击模型并给出一组模型实例,该模型说明现有突发流量检测方法不足以弥补RED脆弱性,也说明网络流量行为的关联复杂性.展开更多
基金TheNationalHighTechnologyResearchandDevelopmentProgramofChina(863Program) (No .2 0 0 2AA14 5 0 90 )
文摘This paper presents a mechanism for detecting flooding-attacks. The simplicity of the mechanism lies in its statelessness and low computation overhead, which makes the detection mechanism itself immune to flooding-attacks. The SYN-flooding, as an instance of flooding-attack, is used to illustrate the anomaly detection mechanism. The mechanism applies an exponentially weighted moving average (EWMA) method to detect the abrupt net flow and applies a symmetry analysis method to detect the anomaly activity of the network flow. Experiment shows that the mechanism has high detection accuracy and low detection latency.
文摘针对随机早期检测(random early detection,RED)算法在慢速拒绝服务攻击(low-rate deny of serv-ice,LDoS)面前的脆弱性问题,本文通过对比路由器分别在RED和尾丢弃Drop-Tail算法管理下遭受LDoS攻击时的队列平均占用率及吞吐量,指出虽然路由器在RED算法下具有较大的空闲缓冲区,却不能对网络流量攻击起到缓冲作用.仿真对比实验表明,LDoS攻击使得路由器在RED下比Drop-Tail具有更大的链路损失带宽.指出现有LDoS的防范和检测方法的不足,构造了一种分布式LDoS攻击模型并给出一组模型实例,该模型说明现有突发流量检测方法不足以弥补RED脆弱性,也说明网络流量行为的关联复杂性.
