文档介绍：合肥工业大学
硕士学位论文
基于分布式的DDoS攻击及防范技术研究
姓名:黄强
申请学位级别:硕士
专业:计算机应用技术
指导教师:叶震
2011-04
基于分布式的 DDoS 攻击及防范技术研究
摘要
互联网的迅速发展使人们对网络的依赖越来越大,网络的安全性也就越来越受到
人们的重视。但是,由于网络本身(特别是 TCP/IP 协议)的安全缺陷,各种攻击不可能
消失,其中拒绝服务(Denial of Service,简称 DoS)攻击以其攻击范围广、隐蔽性强、
简单有效等特点成为常见的网络攻击技术之一,极大地影响了网络和业务主机系统的
有效服务,特别是分布式拒绝服务(DDoS, Distributed Denial of Service)攻击,由于其
隐蔽性和分布性而难于检测和防御,从而严重威胁着互联网的安全。
本文从分析当前 DoS/DDoS 攻击的原理入手,在分析并研究了 DoS/DDoS 攻击的
常见攻击形式和 DRDoS 攻击原理的基础上,对 DDoS/DRDoS 攻击进行合理分类,即
分为带宽耗用型攻击、资源衰竭型攻击和编程缺陷型攻击三种。接着,就目前常见的
DDoS 攻击防御措施做了简要的介绍,这几种常见的防御措施有流量/带宽限制策略、
网络边界硬化策略、攻击监测策略以及攻击响应策略。并在这几种常见的防御措施基
础上提出了一种新的防御措施即 DDoS 客服协同防御机制。该机制提出了从傀儡机
(DDoS)和服务器端进行协同防御的机制。对于像 UDP flood 以及 ICMP Smurf 这类非
面向连接的攻击,主要在傀儡机端采用流量检测和协议分析的方法;对于面向连接的
攻击,我们采用客服协同的 SYN Cookie 技术,从而主动有效地防御攻击 DDoS。最后,
介绍了有关网络仿真的相关知识,并利用网络仿真软件进行了仿真实验,初步
验证了 DDoS 客服协同防御机制的有效性。

关键词:DDoS,客服协同,傀儡机,
Based distributed DDoS attacks and Prevention Research

Abstract
The has e increasingly important to current society. It is ch
anging our way munication, business mode, andevene veryday life. U
nfortunately, because of the deficiency in work (especially the TCP/IP p
rotocol), there are a lot of attacks, among which DoS (Denial of Service) attacks
e work attacks techniques by the characteristics, such as
extensive area, strong concealment, simpleness and eficiency, etc. And DoS attacks
affected the effective service work and host systems. In particular, DDoS (D
istributed Denail of Service) attacks are greatly threatening , since they are
difficult to recognize and defense due to their concealment and distribution.
In this paper, we fast analyze the principle of DoS/DDoS attacks, after s
urveying the DoS/DDoS's definition and typical attack approaches, we update the
classification of DDoS/DRDoS attacks, including 3 categories such as bandwidth
consumption-type attacks,resourse exhaustion attacks,programming defective
attacks. Next,we make a brief introduce of mon defense methods t