基于速率限制的源端网络DDoS防御

分布式拒绝服务攻击(DDoS)给Internet网络造成了巨大的威胁。目前已提出的各种防御机制都无法有效解决DDoS攻击报文特征随机变化的问题。文章提出一个从源端网络检测和防御DDoS的机制。该机制结合网路流的对称性和Patricia树的汇聚方法检测DDoS攻击,并利用速率限制方法阻止DDoS攻击。仿真测试表明,该方法的防御效果显著优于被攻击端防御方法,减少DDoS攻击对正常网络流的影响。

DDOS Defense Mechanism Based on Rate-Limiting in Source Network

Distributed denial-of-service attacks(DDoS) pose an immense threat to the Internet.Many defense mechanisms that had been presented are not efficient to handle the question that the attributes of the attack net-flow change at random.This paper proposes a new defense mechanism of DDoS attacks,which identifies DDoS attacks with the net-flow symmetry attribute and the aggregation method based on Patricia tree and prevents the attack with rate-limiting method in source network.The simulation result shows that the mechanism is better defensibility than Victim-Network Defense Mechanisms and reduces the negative effect the DDoS attack imposes on the normal traffic.