Collaborative Research: DefCOM: Distributed Defense Against DDoS Attacks

协作研究：DefCOM：针对 DDoS 攻击的分布式防御

• 批准号: 0430073
• 负责人: Peter Reiher
• 金额: $ 18万
• 依托单位: University of California-Los Angeles
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-09-01 至 2007-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0430073&HistoricalAwards=false
• 关键词: Collaborative; Research; DefCOM; Distributed; Defense

Collaborative Research: DefCOM - Distributed Defense against DDoS Jelena Mirkovic, University of DelawarePeter Reiher, UCLAAward 0430228AbstractThis project investigates a distributed cooperative solution to the problem of distributed denial-of-service attacks. The proposed defense system, DefCOM, combines the advantages of victim-end defenses (accurate attack detection) and source-end defenses (efficient response and precise separation of the legitimate traffic from the attack traffic). It also enlists the help of backbone routers to control attack traffic in partial deployment scenarios where many potential sources do not deploy a source-end defense.DefCOM nodes will be deployed in source, victim and core networks, and will cooperate via an overlay to detect and stop attacks. Overlay communication will ensure effective operation even if DefCOM nodes are sparsely and non-contiguously deployed. DefCOM's response to attacks is twofold: defense nodes reduce the attack traffic, freeing the victim's resources; and they also cooperate to detect legitimate traffic within the suspicious stream and ensure its correct delivery to the victim. Because networks deploying defense nodes directly benefit from their operation, DefCOM has a workable economic model to spur its deployment. DefCOM further offers a framework for existing security systems to join the overlay and cooperate in the defense. These features create excellent motivation for wide deployment, and the possibility of a large impact on the DDoS threat.

合作研究：DEFCOM-针对DDOS Jelena Mirkovic的分布式防御，DELAWAREPETER REIHER，UCLAAWARD 0430228ABSTRATTINTINP THINIS项目调查了分布式合作解决方案，以解决分布式拒绝服务的问题。 拟议的防御系统DEFCOM结合了受害者末端防御（准确的攻击检测）和源端防御（有效的响应和合法流量与攻击流量的精确分离）的优势。 它还邀请了骨干路由器的帮助，以在部分部署方案中控制攻击流量，其中许多潜在的来源不部署源端防御。DEFCOM节点将部署在源，受害者和核心网络中，并将通过覆盖层进行合作以检测和停止攻击。 即使DEFCOM节点稀疏和不连续部署，叠加通信也将确保有效操作。 DEDCOM对攻击的反应是双重的：防御节点减少了攻击流量，从而释放了受害者的资源；他们还合作以检测可疑流中的合法流量，并确保其正确交付给受害者。 由于部署国防节点的网络直接从其运营中受益，因此DEFCOM具有可行的经济模型来刺激其部署。 DEFCOM进一步为现有的安全系统提供了一个框架，以加入覆盖层并在防御中合作。 这些功能为广泛部署带来了极好的动力，并可能对DDOS威胁产生重大影响。