利用路由器自适应限流防御分布拒绝服务攻击.pdfVIP

1000-9825/2002/13(07) 1220-08 ©2002 Journal of Software 软 件 学 报 Vol.13, No.7 Using Adaptive Router Throttles Against Distributed Denial-of-Service · Attacks 1 2 LIANG Feng , David Yau 1(Zhejiang Provincial Key Laboratory of Fiber Optical Communication Technology, Zhejiang University of Technology, Hangzhou 310014, China); 2(Departme nt of Computer Science, Purdue University, IN 47907, USA) E-mail: liangf@ Received December 7, 2001; accepted April 29, 2002 Abstract: In this paper, an adaptive router throttle algorithm is presented to defend a server against distributed denial-of -service (DDoS) attacks . The key point of the algorithm is that the server asks selected upstream routers k hops away to install throttles on traffic flows destined for it so that the server ’s service capacity can be allocated among all flows with a max-min like fairness. The algorithm effectiveness is evaluated by using a realistic Internet topology and various models for attacker and good user distributions and behaviors. The results indicate that this server-centric router throttling is a promising approach to countering DDoS attacks. Key words: network security; DDoS; router; Internet; computer network In a distributed denial-of-service (DDoS) attack[1,2] , thousands of malicious or compromised hosts coordinate to send a large volume of aggregate traffic to a victim. Network nodes near the victim will progressively become more vulnerable to resource overruns , as a node that is closer to the server most likely has less service capacity while delivering a larger fraction of the attacking traffic. In particular, the victim itself is most vulnerable. Former works on against DDoS attacks either drop or rerou