Collaborative Research: DefCOM - Distributed Defense against DDoS Attacks

协作研究：DefCOM - 针对 DDoS 攻击的分布式防御

• 批准号: 0430228
• 负责人: B. David Saunders
• 金额: --
• 依托单位: University of Delaware
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-09-01 至 2009-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0430228&HistoricalAwards=false
• 关键词: Collaborative; Research; DefCOM; Distributed; Defense

Collaborative Research: DefCOM - Distributed Defense against DDoS Jelena Mirkovic, University of DelawarePeter Reiher, UCLAAward 0430228AbstractThis project investigates a distributed cooperative solution to the problem of distributed denial-of-service attacks. The proposed defense system, DefCOM, combines the advantages of victim-end defenses (accurate attack detection) and source-end defenses (efficient response and precise separation of the legitimate traffic from the attack traffic). It also enlists the help of backbone routers to control attack traffic in partial deployment scenarios where many potential sources do not deploy a source-end defense.DefCOM nodes will be deployed in source, victim and core networks, and will cooperate via an overlay to detect and stop attacks. Overlay communication will ensure effective operation even if DefCOM nodes are sparsely and non-contiguously deployed. DefCOM's response to attacks is twofold: defense nodes reduce the attack traffic, freeing the victim's resources; and they also cooperate to detect legitimate traffic within the suspicious stream and ensure its correct delivery to the victim. Because networks deploying defense nodes directly benefit from their operation, DefCOM has a workable economic model to spur its deployment. DefCOM further offers a framework for existing security systems to join the overlay and cooperate in the defense. These features create excellent motivation for wide deployment, and the possibility of a large impact on the DDoS threat.

合作研究：DefCOM -分布式防御DDoS Jelena Mirkovic，特拉华大学Peter Reiher，UCLA Award 0430228摘要该项目研究了分布式拒绝服务攻击问题的分布式协作解决方案。 建议的防御系统，DefCOM，结合了受害者端防御（准确的攻击检测）和源端防御（有效的响应和精确的分离的合法流量从攻击流量）的优点。 它还在部分部署场景中寻求骨干路由器的帮助，以控制攻击流量，其中许多潜在的来源没有部署源端防御。DefCOM节点将部署在源网络、受害者网络和核心网络中，并将通过覆盖层进行合作，以检测和阻止攻击。 覆盖通信将确保有效的操作，即使DefCOM节点稀疏和非连续部署。 DefCOM对攻击的响应是双重的：防御节点减少攻击流量，释放受害者的资源;它们还合作检测可疑流中的合法流量，并确保将其正确传递给受害者。 由于部署防御节点的网络直接受益于它们的运行，DefCOM有一个可行的经济模型来刺激其部署。 DefCOM还为现有的安全系统提供了一个框架，以加入覆盖并在防御中进行合作。 这些功能为广泛部署创造了良好的动力，并可能对DDoS威胁产生重大影响。