基于速率限制的源端网络DDoS防御

分布式拒绝服务攻击(DDoS)给Internet网络带来了巨大的威胁,目前已提出的各种防御机制都无法有效解决DDoS攻击报文特征随机变化的问题,本文提出一个从源端网络检测和防御制方法阻止DDoS攻击。仿真测试表明,该方法的防御效果显著优于被攻击端防御方法,减少DDoS攻击对于正常网络流的影响。

DDoS Defense Mechanism Based on Rate-Limiting in Source Network

Distributed denial-of-service attacks(DDoS) pose an immense threat to the Internet. Many defense mechanisms that have been presented are not efficient to handle the problem that the attributes of the attack net-flow change at random. This paper proposes a new defense mechanism of DDoS attacks, which identifies it with the net-flow symmetry attribute and the aggregation method based on Patricia tree and prevents the attack with rate-limiting method in source network. The simulation result shows that the mechanism has better defensibility than Victim-Network Defense Mechanisms and reduces the negative effect the DDoS attack imposes on the normal traffic.