DDoS防御机制分类和一种新的DDoS检测框架

摘要

DDoS is one of the critical threats and among the hardest security problems in today's Internet.DDOS defense mechanisms in two ways is first classified. The first classification according to the reaction points, the second divides the DDoS defenses according to the phases of attacks. And then A framework designed for the large LAN to defend the inside network's servers from DDOS attacking is proposed. The framework is based on the statistical features of IP address distribution, and DDOS attacks are detected according to the likeness of adjacent time. a clear view of DDoS defensemechanisms is purposed,and expected that the implementation of the framework could offer more information for network manager to diagnose the trouble.%DDoS攻击是当今Internet面临的主要威胁之一,也是一个最严重的安全问题.首先将DDoS防御机制进行分类.一种方法根据响应位置的不同来分类,另一种方法是根据不同的阶段来分类.然后提出了一种适合局域网的防御框架,它可以保护内网的服务器.此框架基于IP地址分布的统计特征,通过计算相邻时刻的相似度来检测DDoS攻击.目的是为研究者提供清晰的DDoS防御机制分类,并期望该框架能有助于网络管理者诊断网络.