| 摘要: |
| 提出一种自适应路由器限流算法防御分布拒绝服务攻击的机制.该算法的关键是由被攻击者要求经挑选的相距k跳(hop)的上游路由器对目的为被攻击者的数据流进行限流,从而将被攻击者的服务支援在各数据流之间达到一种类最大-最小公平的流量分配.还在一个实际的因特网拓扑上针对攻击数据流和合法数据流的不同分布和流量模型考察了算法的效果.结果表明这种以服务器为中心的路由器限流是对抗分布拒绝服务攻击的一种很有前途的方法. |
| 关键词: 网络安全 分布拒绝服务 路由器 因特网 计算机网络 |
| DOI： |
| 分类号: |
| 基金项目:Supported by the Natural Science Foundation of Zhejiang Province of China under Grant No.697053 (浙江省自然科学基金); CERIAS, the National Science Foundation of US under Grant No.CCR-9875742 (CAREER) |
|
| Using Adaptive Router Throttles Against Distributed Denial-of-Service Attacks |
|
LIANG Feng,David Yau
|
| Abstract: |
| In this paper, an adaptive router throttle algorithm is presented to defend a server against distributed denial-of-service (DDoS) attacks. The key point of the algorithm is that the server asks selected upstream routers k hops away to install throttles on traffic flows destined for it so that the server's service capacity can be allocated among all flows with a max-min like fairness. The algorithm effectiveness is evaluated by using a realistic Internet topology and various models for attacker and good user distributions and behaviors. The results indicate that this server-centric router throttling is a promising approach to countering DDoS attacks. |
| Key words: network security DDoS router Internet computer network |
