双栈网络防火墙中syn flood攻击的检测与防御-detection and defense of syn flood attack in double stack network firewall.docxVIP

AbstractTheextensiveuseofInternettechnologyhasbroughtgreatconveniencetomodernsociety,however,moreandmoresevereproblemsregardingonnetworksecurityhavealsoemergedatthesametime.EspeciallytheDDoSattacks,representedbySYNFlood,posemassivethreatstothenetworksecurity.ThispaperanalyzestherationaleofexistingDDoSattackindetail,summerizingalltheavailabledetectionalgorithms.SubsequentlythispaperproposestwoalgorithmswhichcoulddetectSYNFloodattackquicklyunderlargescalenetwork:theadaptivethresholdalgorithmandthealgorithmbasedonslidingwindowentropy.Byconductingthecomparisonintheoryandexperimentbetweenthetwoalgorithms,thispapersuggeststhattheadaptivethresholdalgorithmcouldfulfilltheefficiencyrequirementsbetter.Inthenext,thispaperintroducestwopopularSYNFloodprotectionmethods:SYNCookieandSYNProxy,andproposessolutionsregardingontheirdefects.Becausebothmethodscannotmeettherequirementsofefficiencyandsecurity,anewalgorithmbasedonsamplinginwindowisintroduced,whichisknownasthevictimIPdecisionalgorithm.ThisalgorithmcandetectthevictimsIPaddressquickly,sothefirewallcandiscardtheattackflowsusingtheresults.Meanwhile,thispaperproposedafastrecoverymechanismonbasisofadaptivethresholdalgorithmtoreducenegativeeffectscausedbydroppedpackets,whichcouldrecoverthefirewallfromdroppacketstatetonormalstate.Atlast,thispaperimplementstheattackdetectionandprotectionalgorithmsindual-stackfirewall,andteststhevalidityandperformancerespectively.Thevalidity,whichismeasuredbyfiveindicators,isdetectedinactivetest.Thesystemperformanceimprovement,whichismeasuredbytwoindicators:memoryusageandCPUutilization,isdetectedinpassivetest.TheresultsindicatethatthemethodsofdetectionandprotectionagainstSYNFloodproposedbythispapercanimprovethesystemefficiencysubstantiallywhenfirewallisattacked,whileconsumingonlyasmallamountofextramemory.Keywords:DualStack;Firewall;SYNFloodattack;Adaptivethreshold目录摘要.........................................................................................................................IAbstract.......