基于控制与数据分离的映射系统DDoS攻击防御机制设计与实现

发布时间：2018-04-01 00:04

本文选题：控制与数据分离　切入点：映射系统　出处：《北京交通大学》2017年硕士论文

【摘要】：随着互联网的不断发展,互联网暴露出很多问题,其安全隐患越来越严重。要解决现有互联网存在的问题,有效预防DDoS攻击,构建新的网络体系机制具有重大意义。在诸多研究中,身份与位置分离、控制与数据分离成为研究的重点。控制与数据分离的映射系统在“智慧协同网络体系基础研究”基础上,将控制功能集中于控制器中,进一步实现控制与转发分离。控制器是整个映射系统的心脏,控制器性能的优劣对其整体性能有很大的影响。DDoS攻击通过网络发送大量请求,消耗网络资源,造成服务器拒绝服务,若控制器发生故障则会影响整个网络的运行。映射系统中的终端作为系统重要组成部分代表用户,终端受到攻击则会降低网络资源利用率和用户体验。本文主要研究基于映射系统的DDoS攻击检测防御机制的设计与实现。首先,本文分析了该领域的国内外研究现状。对身份与位置分离、控制与转发分离和DDoS攻击以及检测防御研究进行概述,并介绍了控制与数据分离的映射系统,随后进一步介绍了 DDoS攻击以及检测防御方法。其次,本文对控制与数据分离的映射系统进行分析。研究以控制器和主机为目标的DDoS攻击方法,根据攻击目标的不同有针对的设计DDoS攻击检测防御相关功能模块。主要工作包括:1)分析目标为控制器的DDoS攻击,DDoS攻击通过伪造大量接入标识触发大量映射请求来攻击控制器;2)研究映射请求解析过程;3)研究映射请求的消息结构,根据映射请求中的信息设计实现端口与接入标识映射模块、接入标识异常检测功能模块;4)分析目标为映射系统中主机的DDoS攻击,通过位置分散的傀儡机攻击接入映射系统的主机;5)分析DDoS攻击特征,根据攻击发生时流量和特征元素熵值的变化,设计实现流量信息统计处理功能模块和DDoS攻击检测防御功能模块,流量信息统计处理模块包括流量统计信息的获取以及分类处理,DDoS攻击检测防御模块包括流量矩阵、熵值矩阵的构建,根据数学统计计算方法得到测量值与阈值,进行比较;6)根据比较结果,使用统计计算结果定位攻击源,然后使用流量限制的方法防御DDoS攻击。最后,本文模拟控制与数据分离的映射系统并测试其连通性。在此测试环境下,先模拟背景流量测试在没有DDoS攻击的情况下的性能,然后模拟DoS攻击和DDoS攻击测试控制与数据分离的映射系统中DDoS攻击防御机制的功能和性能,最后对结果进行分析,验证了控制与数据分离的映射系统中DDoS攻击防御机制的实现。
[Abstract]:With the continuous development of the Internet, the Internet has exposed a lot of problems, and its security risks are becoming more and more serious. It is necessary to solve the existing Internet problems and effectively prevent DDoS attacks. Building a new network architecture mechanism is of great significance. In many studies, identity and location are separated. The mapping system of control and data separation concentrates the control function on the controller based on the basic research of intelligent cooperative network system. The controller is the heart of the whole mapping system. The performance of the controller has a great influence on its overall performance. DDoS attacks send a large number of requests through the network and consume network resources. If the controller fails, it will affect the operation of the whole network. The terminal in the mapping system represents the user as an important part of the system. When the terminal is attacked, the utilization of network resources and user experience will be reduced. This paper mainly studies the design and implementation of DDoS attack detection and defense mechanism based on mapping system. In this paper, the status quo of research in this field is analyzed. The research on identity and location separation, control and forwarding separation, DDoS attack and detection and defense are summarized, and the mapping system of control and data separation is introduced. Secondly, this paper analyzes the mapping system of the separation of control and data, and studies the DDoS attack method which takes controller and host as the target. The main work includes: 1) analyzing the DDoS attack of the target as the controller / DDoS attack triggers a large number of mapping requests by falsifying a large number of access identifiers. Attack controller 2) study the mapping request parsing process 3) study the message structure of the mapping request, According to the information in the mapping request, the mapping module of port and access identification is designed and implemented. The function module of abnormal detection of access identification is designed to analyze the DDoS attack of the host computer in the mapping system. The attack characteristics of DDoS are analyzed by using the distributed puppet machine attack access mapping system. According to the change of the flow rate and the entropy value of the feature element, The traffic information statistic processing module and the DDoS attack detection and defense function module are designed and implemented. The traffic information statistics processing module includes the traffic statistics information acquisition and the classification processing. The DDoS attack detection and defense module includes the flow matrix. The entropy matrix is constructed, the measured value and threshold are obtained according to the mathematical statistical calculation method, and the comparison is made. 6) according to the comparison results, the source of the attack is located by using the statistical calculation results, and then the method of traffic restriction is used to defend against the DDoS attack. This paper simulates the mapping system of control and data separation and tests its connectivity. In this test environment, the performance of background traffic testing without DDoS attack is first simulated. Then the function and performance of the DDoS attack defense mechanism in the mapping system of DoS attack and DDoS attack test control and data separation are simulated. Finally, the results are analyzed to verify the implementation of the DDoS attack defense mechanism in the mapping system with the separation of control and data.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】