基于SDN和NFV的链路洪泛攻击检测与防御

发布时间：2018-03-17 19:52

本文选题：分布式拒绝服务攻击　切入点：链路洪泛攻击　出处：《武汉大学》2017年硕士论文　论文类型：学位论文

【摘要】：DDoS攻击对企业网络造成非常严重的破坏,虽然业界提出了许多的防御方法,但是攻击者不断的改变攻击策略绕过防御系统。近来,学术界提出了一种新型的DDoS攻击——链路洪泛攻击,并且已经有攻击者利用链路洪泛攻击的原理攻击了网络的关键链路,导致用户无法访问受攻击的服务器。与DDoS攻击不同,现有的防御机制很难检测到链路洪泛攻击,因为它们经常利用大规模合法的低速流量来攻击目标链路,而且还会不断的改变攻击的目标链路。我们设计并实现了检测和防御链路洪泛攻击的防御系统LFADefender。该系统利用了软件定义网络具有全网视图以及可以对网络流进行追溯的功能,和网络功能虚拟化技术的弹性部署特性,以有效地检测和缓解LFA攻击。在LFADefender中,我们提出了一种链路洪泛攻击中目标链路检测方法和一种用于链路拥塞检测的虚拟监控功能。此外,我们在LFADefender中引入了链路洪泛攻击缓解机制,该机制基于重路由和流溯源等技术来缓解链路洪泛攻击。实验评估表明,LFADefender.可以准确检测链路洪泛攻击并快速响应,同时LFADefender在网络控制和数据平面间的通信引入了较小的开销。
[Abstract]:The DDoS attack has caused very serious damage to the enterprise network. Although the industry has proposed many defense methods, the attacker has constantly changed the attack strategy to bypass the defense system. A new type of DDoS attack, link flooding attack, has been proposed by academic circles, and some attackers have used the principle of link flooding attack to attack the critical link of the network, which makes the user unable to access the server under attack, which is different from the DDoS attack. Existing defense mechanisms are difficult to detect link flooding attacks because they often use large, legitimate, low-speed traffic to attack the target link. We have designed and implemented the defense system LFADefender. this system uses software to define a network with a view of the whole network and can trace the network flow. And the flexible deployment features of network function virtualization technologies to effectively detect and mitigate LFA attacks. In LFADefender, We propose a target link detection method in link flooding attack and a virtual monitoring function for link congestion detection. In addition, we introduce a link flood attack mitigation mechanism into LFADefender. The mechanism is based on rerouting and stream tracing techniques to mitigate link flooding attacks. The experimental results show that LFADefender. can accurately detect link flooding attacks and respond quickly, and LFADefender introduces small overhead in network control and data plane communication.
【学位授予单位】：武汉大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】