路由器端防范DDos攻击机制综述

防范DDos攻击一直是网络安全领域一个重要的课题.DDos攻击的爆炸式增长使得这方面的防范机制和策略面临了新的挑战,同时也出现了很多在路由器端防范DDos攻击的方法.综述了目前基于路由器端防范DDos攻击的各种方法,并将这些方法分成3类进行阐述,包括基于拥塞的、基于异常的和基于源的,分别包含了聚集拥塞控制机制,在线包统计多层树结点、基于监视源IP地址防范DDos策略、正常数据流量模式机制和出口过滤、基于路由信息、IP跟踪等机制.还重点讨论了攻击响应部分,包括响应的位置、包过滤和速率限制、回退策略.最后给出了结论.

A Survey on Defending DDos Attack in Router

Defending DDos attack has always been a key issue in the area of network security.Recently,DDos attack grows quite quickly and the mechanism of defending this faces new challenge.Also methods of defending DDos attack in the router appear accordingly.This paper attempts to survey all those methods and classify them into three typies,including congestion-based methods such as Aggregate Congestion Control(ACC),anomaly-based methods such as Multi-Level Tree for On-line Packet Statistics(MULTOPS),Defend DDos Using Source IP Address Monitoring(SIM) and Normal models of network flows and source-based methods such as Egress filtering,Route-based and IP traceback-based methods.Then it focuses on attack response,including egress filtering,packets filtering and rate limit,and the pushback method.Finally some remarks on defending DDos attack in routers are given.