IPv6与隧道多地址性的DoS攻击放大问题研究

发布时间：2018-07-11 09:51

本文选题：IPv + 隧道　；参考：《计算机研究与发展》2014年07期

【摘要】：DoS攻击是威胁IPv4网络安全的重要问题之一.随着IPv6的发展,相关安全问题也逐步体现并影响IPv6网络的正常运行.该文指出利用IPv6和隧道主机的多地址性,攻击者可获得大量合法IPv6地址,通过伪装成多个虚拟主机实施对目标设备的DoS攻击.这种攻击具有大量的可用地址范围,且受控于同一真实主机,通过不断使用新地址和多地址间配合,可避开以IP为单位的传统检测与防御策略,并可有效放大攻击节点数目或减少实际攻击节点数量.为此提出了基于地址特征分类的防御框架(defense framework based on addresses classification,DFAC).通过分类不同地址特征,构造特征子集,在特征子集基础上实施对虚拟主机攻击的检测和防御,解决虚拟主机引发的放大问题.原型系统实验结果表明,DFAC有效地降低了上述DoS攻击对系统负载的影响.
[Abstract]:Dos attack is one of the most important issues threatening IPv4 network security. With the development of IPv6, the related security problems gradually reflect and affect the normal operation of IPv6 network. This paper points out that with the multi-address of IPv6 and tunnel hosts, an attacker can obtain a large number of legitimate IPv6 addresses and carry out dos attacks on the target devices by masquerading as multiple virtual hosts. This attack has a large range of available addresses and is controlled by the same real host. By constantly using new addresses and multiple addresses, it can avoid the traditional IP detection and defense strategy. And can effectively enlarge the number of attack nodes or reduce the actual number of attack nodes. A defense framework based on address feature classification (defense framework based on addresses classification DFAC) is proposed. By classifying different address features and constructing feature subsets, the detection and defense of virtual host attacks are implemented on the basis of feature subsets to solve the problem of magnification caused by virtual hosts. The experimental results of the prototype system show that DFAC can effectively reduce the impact of the dos attack on the system load.
【作者单位】：哈尔滨工业大学网络与信息安全技术研究中心;
【基金】：国家“九七三”重点基础研究发展计划基金项目(2012BAH37B01) 国家自然科学基金项目(61202457) 国家“八六三”高技术研究发展计划基金项目(2011AA010705,2012AA012506,2012AA012502)
【分类号】：TP393.08

【参考文献】