面向虚实结合网络的攻击阻断系统的设计与实现

发布时间：2018-05-02 23:18

本文选题：网络安全 + 拒绝服务攻击　；参考：《北京邮电大学》2014年硕士论文

【摘要】：互联网的便捷性、高效性和低成本等优势,使得各行各业都通过互联网来开展业务。尤其云计算的出现,更是加快互联网的发展速度。但是由于互联网的设计以及云计算的发展的不成熟,使得互联网存在着较大的安全隐患,很容易遭受到黑客的攻击。随着互联网的发展,网络攻击造成的损失也随之增长,每年因为网络攻击造成的损失在千亿美元以上。拒绝服务攻击是占总攻击比重最大的一种,它具有发起门槛低、破坏巨大和难以有效防御等特点,一直是黑客最常用的攻击手段。近年来,拒绝服务攻击出现了新的形式,从物理网络发展到云计算中的网络,这种新的形式的攻击目前还没有有效的应对措施,这给云计算乃至互联网的发展带来很大的不确定性。本文针对在一个大规模的虚实结合网络中防御拒绝服务攻击这一个特定需求,设计并实现了一个面向虚实结合网络的攻击阻断系统。系统综合了多种拒绝服务攻击的防御技术,经过入侵检测、攻击路径重构、阻断决策和分布式阻断等步骤之后,能够高效的阻断两种网络中的拒绝服务攻击和其他大规模的攻击,同时尽量降低网络升销,这在云计算飞速发展的今天具有极强的现实意义。本系统的特色在于能够在虚拟网络中实现溯源和阻断,完成跨越物理和虚拟网络两种域的阻断；运用改进的遗传算法选择最佳位置进行阻断,提高阻断效率；还能够动态优化的已部署的阻断规则,降低数据包的平均匹配时延；此外在虚拟网络的阻断中通过采集攻击样本特征的方式区分正常流和攻击流,有效的提高阻断的正确率。最后对系统进行了全面的测试,测试结果表明系统能够对各类型拒绝服务攻击进行阻断,能够很好的保护网络的安全。
[Abstract]:The convenience, efficiency and low cost of the Internet make all kinds of industries carry out business through the Internet. In particular, the emergence of cloud computing, but also to speed up the development of the Internet. However, due to the design of the Internet and the immature development of cloud computing, the Internet has a large security hidden danger, which is easy to be attacked by hackers. With the development of the Internet, the losses caused by network attacks are increasing, and the losses caused by network attacks are more than one hundred billion dollars each year. Denial of service attack is one of the most important attacks. It has the characteristics of low threshold, huge damage and difficult to defend effectively. It has always been the most commonly used attack method of hackers. In recent years, denial-of-service attacks have emerged in new forms, from physical networks to cloud computing networks. This brings a lot of uncertainty to the development of cloud computing and even the Internet. In order to protect against denial of service attack in a large scale virtual reality network, an attack blocking system is designed and implemented in this paper. The system integrates a variety of denial of service attack defense techniques, after intrusion detection, attack path reconstruction, blocking decision and distributed blocking, etc. It can effectively block the denial of service attacks and other large-scale attacks in the two networks, while at the same time reduce the network sales, which has a strong practical significance in the rapid development of cloud computing today. The characteristic of this system is that it can realize traceability and blocking in virtual network, complete the blocking across physical and virtual network domain, select the best position to block by using improved genetic algorithm, and improve the blocking efficiency. It can also dynamically optimize the deployed blocking rules and reduce the average matching delay of the packets. In addition, in the virtual network blocking, the normal flow and the attack flow can be distinguished by collecting attack sample characteristics, which can effectively improve the blocking accuracy. Finally, a comprehensive test of the system is carried out. The test results show that the system can block all types of denial of service attacks, and can protect the security of the network very well.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】