降质攻击及其防范研究

发布时间：2018-09-01 13:13

【摘要】：拒绝服务(Denial of Service,DoS)攻击已经演变成为互联网上攻击次数最多、攻击流量最大的网络攻击,对其研究是网络安全研究领域的一个热点和难点问题。降质(Reduction of Quality,RoQ)攻击是一种非典型的DoS攻击,能够减少或抑制网络中的TCP流量,显著降低各种TCP应用的服务质量。而且,它具有很强的隐蔽性,防范起来更加困难。为此,我们展开降质攻击及其防范的研究,主要内容和贡献如下:1、首先,对国内外的研究现状进行了分类比较,发现在研究的三个阶段分别存在以下问题:在攻击原理和流量特征研究中,不同研究者往往会有不同角度的理解;在单条链路的检测方法研究中,检测精确度不理想;缺少从全网角度进行防范的研究。接下来,针对这些问题展开相关研究。2、根据攻击的基本原理,设计了攻击模型并进行了定量定性地评估和分析,对TCP安全漏洞进行了分析,从中发掘攻击特点及典型的流量特征,并为两种攻击特征建立了数学分析模型。3、在攻击评估和流量特征分析的基础上,提出了一种针对RoQ攻击的特征提取和检测方法。它使用小波多分辨率分析方法提取了异常突变特征,同时,还使用了二次频谱分析方法提取了局部异常流量的周期性特征,从而明显提高了检测的精确度。而且,只要合理地使用二次频谱分析,就能够提取流量中具有任何结构的周期特征,从而应对具有更加复杂攻击周期的降质攻击。实验表明该检测方法的误报率和漏报率都很低。4、为了能够从网络全局角度分析和识别该攻击,提出了一种在骨干网络流量中监测、定位和识别攻击的方法。它使用主元分析和频谱分析技术对骨干流量进行流量建模分析,实现了对网络全局流量的异常监测,能同时分析判断多条链路的异常情况,并能准确定位和识别攻击。这是研究中首次从网络全局角度分析降质攻击行为,能够同时监测和识别多条子网链路上发生的降质攻击。同时,也为进一步提高整个网络安全运行和管理能力以及大数据分析等问题提出了很好的思路。在实验中使用了CERNET骨干网络流量数据,结果表明该方法是有效可行的。
[Abstract]:Denial of service (Denial of Service,DoS) attacks have evolved into the most frequent attacks and the most frequent attacks on the Internet. The research on denial of service (Denial of Service,DoS) attacks is a hot and difficult issue in the field of network security research. Degraded (Reduction of Quality,RoQ) attack is an atypical DoS attack, which can reduce or suppress the TCP traffic in the network, and significantly reduce the quality of service (QoS) of various TCP applications. Moreover, it has very strong concealment, it is more difficult to prevent. For this reason, we have launched a study on quality reduction attacks and their prevention, the main contents and contributions are as follows: 1. First of all, the current research situation at home and abroad has been classified and compared. It is found that in the three stages of the research, the following problems exist: in the research of attack principle and traffic characteristics, different researchers often have different angles of understanding, and in the research of detection methods of single link, the detection accuracy is not ideal. Lack of prevention from the point of view of the whole network. Then, according to the basic principle of the attack, the attack model is designed, and the quantitative and qualitative evaluation and analysis are carried out, and the security vulnerabilities of TCP are analyzed. In this paper, the attack characteristics and the typical traffic characteristics are explored, and the mathematical analysis model. 3 is established for the two attack features. Based on the attack evaluation and traffic feature analysis, a feature extraction and detection method for RoQ attacks is proposed. It uses wavelet multi-resolution analysis method to extract the abnormal mutation feature, and also uses the quadratic spectrum analysis method to extract the periodic feature of the local abnormal flow, which obviously improves the accuracy of detection. Furthermore, as long as the quadratic spectrum analysis is used reasonably, the periodic characteristics of any structure in the traffic can be extracted, so as to cope with the degradation attack with more complex attack period. Experiments show that the false positive rate and false alarm rate of this detection method are very low. In order to analyze and identify the attack from the global point of view of the network, a method of monitoring, locating and identifying attacks in backbone network traffic is proposed. It uses principal component analysis and spectrum analysis techniques to model and analyze backbone traffic. It realizes the abnormal monitoring of network global traffic. It can simultaneously analyze and judge the abnormal situation of multiple links, and can accurately locate and identify attacks. This is the first time in the study that the degradation attack behavior is analyzed from the global point of view of the network, and it can simultaneously monitor and identify the degradation attacks occurring on multiple subnet links. At the same time, it also provides a good way to improve the network security operation and management ability and big data analysis. The CERNET backbone network traffic data are used in the experiment, and the results show that this method is effective and feasible.
【学位授予单位】：清华大学
【学位级别】：博士
【学位授予年份】：2015
【分类号】：TP393.08

【相似文献】