research on the active ddos filtering algorithm based on ip flow活跃的ddos滤波算法研究基于ip流.pdf

Int. J. Communications, Network and System Sciences, 2009, 7, 600-607 doi:10.4236/ijcns.2009.27067 Published Online October 2009 (http://www.SciRP.org/journal/ijcns/). Research on the Active DDoS Filtering Algorithm Based on IP Flow 1 1 2 3 Rui GUO , Hao YIN , Dongqi WANG , Bencheng ZHANG 1 Department of Computer Science and Technology, Tsinghua University, Beijing, China 2 The Computing Center, Northeastern University, Shenyang, China 3Electronic Scouting and Commanding Department, College of Shenyang Artillery, Shenyang, China Email : gr@ Received May 22, 2009; revised July 7, 2009; accepted September 5, 2009 ABSTRACT Distributed Denial-of-Service (DDoS) attacks against public web servers are increasingly common. Coun- tering DDoS attacks are becoming ever more challenging with the vast resources and techniques increasingly available to attackers. It is impossible for the victim servers to work on the individual level of on-going traf- fic flows. In this paper, we establish IP Flow which is used to select proper features for DDoS detection. The IP flow statistics is used to allocate the weights for traffic routing by routers. Our system protects servers from DDoS attacks without strong client authentication or allowing an attacker with partial connectivity in- formation to repeatedly disrupt communications. The new algorithm is thus proposed to get efficiently maximum throughput by the traffic filtering, and its feasibility and validity have been verified in a real net- work circumstance. The experiment shows that it is with high average detection and with low fa