分布式拒绝服务攻击模拟系统设计与实现

发布时间：2018-06-12 23:28

本文选题：分布式拒绝服务攻击 + 数据包　；参考：《电子科技大学》2014年硕士论文

【摘要】：随着分布式拒绝服务攻击事件的日益增多和造成的损失越来越大,分布式拒绝服务检测和防御越来越成为计算机和网络安全防御的重点。但由于分布式拒绝服务攻击的特点,决定了其检测和防御的高误报率、低准确性和低时效性。本课题在现有的实验条件下,搭建合适的网络环境来进行分布式拒绝服务攻击的实验模拟。并通过编写流量检测软件,针对在发生攻击时的网络流量进行统计概率学分析,构建数学模型,并将该数学模型用软件实现,编写了一个能够检测分布式拒绝服务攻击的检测软件。该数学模型和检测软件具有较高的准确性,较低的误报率和较好的时效性,能够广泛应用于很多较为复杂的网络环境中。同时,根据实验结果和检测结果,结合计算机网络相关知识,提出了一些针对分布式拒绝服务攻击的检测和防御方法。1、攻击网络环境搭建分别通过在同一个子网的其他主机以及不在同一个子网的其他主机使用拒绝服务攻击工具对受害主机进行攻击,同时,在受害主机上运行自己写的监控程序,根据监控结果来判断是否发生了拒绝服务攻击,系统资源使用情况,攻击的力度怎么样,攻击者的位置以及攻击者的地址等等的相关信息。在实验中,所有傀儡机以及目标主机都连在2mbps带宽的网络上,其中部分的傀儡机和目标主在同一个子网,即连在同一个路由器上,而其他的傀儡机则在不同的子网中,分别从不同机的位置对目标主机进行攻击。其中,每台傀儡机中又安装了若干台虚拟机,这样做是为了搭建僵尸网络,由于实验条件限制,无法做到构建足够多的真实傀儡机组成的僵尸网络,因此,通过这个方法来达到僵尸网络的构建。2、抓包分析通过抓取数据包进行统计学分析和计算来进行分析,同时对数据包以及系统资源进行进行检测分析,根据分析结果判断是否发生了拒绝服务攻击。通过编写流量检测软件,针对在发生攻击时的网络流量进行统计概率学分析,构建数学模型,并将该数学模型用软件实现,编写能够检测分布式拒绝服务攻击的检测软件,同时,根据实验结果和检测结果,结合计算机网络相关知识,提出了一些针对分布式拒绝服务攻击的检测和防御方法。
[Abstract]:With the increasing number and loss of distributed denial of service attacks, distributed denial of service detection and defense become the focus of computer and network security defense. However, because of the characteristics of distributed denial of service (DDoS) attacks, its detection and defense are characterized by high false alarm rate, low accuracy and low timeliness. In this paper, we set up a suitable network environment to simulate the distributed denial of service attack under the existing experimental conditions. By writing the flow detection software, the statistical probabilistic analysis of network traffic in the event of attack is carried out, and the mathematical model is constructed, and the mathematical model is realized by software. A detection software is developed to detect distributed denial of service attacks. The mathematical model and detection software have higher accuracy, lower false alarm rate and better timeliness, and can be widely used in many complex network environments. At the same time, according to the experimental results and test results, combined with the relevant knowledge of computer networks, This paper proposes some methods of detection and defense against distributed denial of service attacks. The attack network environment is constructed by using denial-of-service attacks on other hosts in the same subnet and other hosts not on the same subnet, respectively. The tool attacks the victim host, At the same time, running the self-written monitoring program on the victim host, judging whether there has been a denial of service attack, the use of system resources, and the intensity of the attack, according to the monitoring results. Information about the attacker's location and the attacker's address, etc. In the experiment, all the puppet machines and the target hosts are connected to the 2mbps bandwidth network. Some of the puppet machines and the target host are connected to the same subnet, that is, to the same router, while the other puppet machines are in different subnets. Attack the target host from different locations. Among them, several virtual machines are installed in each puppet machine, which is designed to build a botnet. Due to the limitations of experimental conditions, it is not possible to build a botnet consisting of enough real puppet machines. Through this method to achieve botnet construction. 2, grab packet analysis through fetching data packets for statistical analysis and calculation to analyze, at the same time, data packets and system resources for detection and analysis, A denial of service attack is judged according to the results of the analysis. By writing the flow detection software, the statistical probabilistic analysis of the network traffic in the event of attack is carried out, and the mathematical model is constructed, and the detection software that can detect the distributed denial of service attack is written. At the same time, according to the experimental results and detection results, combined with the related knowledge of computer networks, some detection and defense methods against distributed denial of service attacks are proposed.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】