多管理域合作检测DDoS攻击的一个方法

为有效地防御分布式拒绝服务 DDoS(Distributed Denial of Service) 的 攻击,提出了基于多域间入侵检测系统 IDSs(Intrusion Detection Systems) 合作的攻击检测模型.围绕重要网络资源,构建了以〈路由器,IDS〉对为基础的闭合的IDS 合作环,通过环上节点间信息共享和合作组内的警报关联分析,能够在DDoS攻击数据包汇聚成致命攻击流之前捕获攻击特征并采取相关措施.提出了合作环组织方式、共享信息交换方式、警报关联算法以及各节点系统逻辑结构.利用原型多域合作入侵检测 MDCI(Multiple Domains Cooperative Intrusion-detection)系统实施了DDoS攻击实验,针对实验数据分析可以看出,合作环模型有效地提高了IDS系统对DDoS攻击的预警速度. 

Method of cooperative detecting DDoS attacks across multiple domains

To prevent the DDoS(distributed denial of service) attacks effectivel y, a cooperative detection model was proposed based on the cooperation among the IDSs(intrusion detection systems) distributed in multiple administrative domai ns. Surrounding some valuable network assets, the enclosed defense ring was set up that consists of 〈IDS, Router〉 pairs with the IDS monitoring specific route r traffic. The IDSs reside in the ring were allotted to a cooperation group. With the information exchanging and alert correlating within the group, the signature s of DDoS attacks aimed at the network assets could be captured timely before th e overwhelming attack flooding aggregates. The construction method of cooperatio n rings, the information exchange mode, alerts correlation method and infrastruc ture of cooperative IDS entity were proposed. Some experiments were conducted wi th the MDCI(multiple domains cooperative intrusion-detection) system, a protot ype system. Results show that the prototype improves detection performance effec tively.