Anycast for DDoS-猫眼课题宝

针对 DDoS 的任播

DOI：

--

发表时间：

2017

期刊：

影响因子：

--

通讯作者：

中科院分区：

--

文献类型：

--

作者：

J. H. Kuipers

在这项工作中，我们调查的im- 对任播服务的DDoS攻击的影响以及任播侦察的可能性，作为一种可能的缓解对DDoS攻击的影响。到分析DDoS攻击对我们结合DDoS的任播服务的影响攻击数据和为研究目的开发的任播测试平台。我们使用来自捕获的真实的DDoS攻击[2]和模拟DDoS的DDoS攻击数据基于捕获的僵尸网络trac的攻击。选播测试平台由9个站点分布在世界各地，能够测量哪些IP到达每个站点使用主动测量。DDoS攻击防御和缓解是一个热门、广泛、活跃的研究领域。一种缓解方法用于减轻DDoS攻击的效果是（任播）网络侦察- 纪念日选播服务通常可以分散传输负载，根据站点容量在站点之间进行分配。但任播服务可以侦察以各种其他方式分散DDoS流量的负载。Anycast服务例如，可以将所有（DDoS）流量重定向到一个站点，安装了擦洗装置。我们使用一种方法来重建任播测试床，称为AS路径前置，并测量了其中几个缓解措施的影响，战略。其他几种选播配置和操作方法存在，如BGP社区，但我们决定选择AS路径前置只有能够更彻底地评估这种方法，并防止attribu- 当两种方法同时使用时会出现问题。

In this work we investigate the im- pact of DDoS attacks on anycast services and the possibilities of anycast recon- �guration as a possible mitigation against the e�ects of a DDoS attacks. To analyse the e�ects of a DDoS attack on anycast services we combined DDoS attack data and an anycast testbed developed for research purposes. We used DDoS attack data from captured real DDoS attacks [2] and simulated DDoS attacks based on captured botnet tra�c. The anycast testbed consists of 9 sites spread around the world and is capable of measuring which IPs reach each instance using active measurements. DDoS attack defense and mitigation is a popular and broad subject and active research domain. One mitigation method used to alleviate the e�ects of a DDoS attack is (anycast) network recon�g- uration. Anycast services are generally con�gured to spread the tra�c load across sites according to site capacity. But anycast services can be recon�gured to spread the load of DDoS tra�c in various other ways. The anycast service could for instance be con�gured to redirect all (DDoS) tra�c to one site with scrubbing devices installed. We recon�gured the anycast testbed using a method called AS-path prepending and measured the impact of several of these mitiga- tion strategies. Several other anycast con�guration and manipulation methods exist, such as BGP communities, but we decided to choose AS-path prepending only to be able to evuluate this method more thoroughly and prevent attribu- tion problems when two methods are used at the same time.