DDOS攻击检测和防御模型.pdfVIP

维普资讯 ISSN 1000—9825，CODEN RUXUEW E—mail：jos@iscas．ac．cn JournalofSoftware，Vo1．18，No．9，September2007，PP．2245—2258 http：／／www．jos．org．cn DOI：10．13600osl82245 Te1／Fax：+86—10 @2007byJournalofSoftware．Allrightsreserved． 木 DDOS攻击检测和防御模型 孙知信 ，姜举良，焦 琳1．2 (南京邮电大学 计算机学院，江苏 南京 210003) (南京邮电大学 计算机技术研究所，江苏 南京 210003) DDOSAttackDetectingandDefendingM odel SUN Zhi—Xin， ． JIANGJu—Liang_-． JIAO Lin (CollegeofComputer．NanjingUniversityofPostsandTe1ec0mmunicati0ns，Nanjing210003，China) (InstituteofComputerTechnology，NanjingUniversityofPostsandTelecommunications，Nanjing210003，China) +Correspondingauthor：Phn：+86—25E—mail：sunzx@njupt．edu．cn，http：／w／ww．njupt．edu．cn SunZX，JiangJL，JiaoL．DDOSattackdetectinganddefendingmode1．JournalofSoftware，2007，l8(9)： 2245-2258．http：／／www．jos．org．cn／1000—9825／18／2245．htm Abstract： ThispaperpresentstheAPA—ANTI—DDoS (aggregate—basedprotocolanalysisanti—DDoS)modelto detectanddefendtheDDoSattack．APA—ANTI—DDoSmodelcontainstheabnormaltraffi caggregatemodule，the protocolanalysismoduleandthetrafficprocessingmodule．Theabnormaltrafficaggregatemoduleclassifiesthe networktrafficinto normaltrafficand theabnormaltraffic；theprotocolanalysismoduleanalyzesthepotential featuresofDDoS attacktrafficintheabnormaltraffic：thetrafficprocessingmodulefilterstheabnormaltraffi c accordingtothecurrentfeaturesofDDoS attack，andresumesthenon—attacktrafficwiththehelp oftestingthe congestion control feature of the traffic． The paper then implements the APA—ANTI—DDoS system ．The experimentalresultsshow thatAPA—ANTIDDOSmodelcanprimelydetectanddefendDDOSattackandresumethe non—attacktrafficatthetimeofmiscarriageofjusticetoguaranteethelegalcommunicationtraffic． Key words： distributed denialofserviceattack；congestion control；floodattack；ag