On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets
On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets
复制标题
DOI：
10.1145/383059.383061
复制
发表时间：
2001-10
期刊：
影响因子：
--
通讯作者：
Kihong Park;Heejo Lee
中科院分区：
文献类型：
--
作者：
Kihong Park;Heejo Lee
拒绝服务（DoS）攻击已成为Internet上一个亟待解决的问题。在本文中，我们描述和评估基于路由的分布式数据包过滤（DPF），分布式拒绝服务（DDoS）攻击预防的一种新方法。我们证明了DPF实现了主动性和可扩展性，并且我们证明了DPF在减轻DDoS攻击方面的有效性与幂律网络拓扑结构之间存在密切关系。首先，我们表明，DPF能够主动过滤出一个显着的欺骗数据包流的一部分，并防止攻击数据包到达他们的目标摆在首位。不能主动削减的IP流非常稀疏，因此可以定位它们的来源-即，IP回溯---在一个小的，恒定数量的候选网站。我们表明，这两个主动和被动的性能效果可以实现基于路由的过滤不到20%的互联网自治系统（AS）的网站。其次，我们证明了这两个互补的性能指标依赖于底层AS图的属性。特别是，我们表明，互联网AS拓扑结构的幂律结构导致连接属性，这是至关重要的，在促进观察到的性能效果。
Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.