TC: Small: Dynamic Early Filtering of Botnet Garbage Traffic

TC：小：僵尸网络垃圾流量的动态早期过滤

• 批准号: 0916857
• 负责人: Chin-Tser Huang
• 金额: $ 20万
• 依托单位: University South Carolina Research Foundation
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-02-01 至 2014-01-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0916857&HistoricalAwards=false
• 关键词: TC; Small; Dynamic; Early; Filtering

Currently in the Internet there is an increasing number of unwanted, unsolicited "garbage" packets mainly generated by botnets, which can launch Distributed Denial-of-Service attacks, worm attacks, and spam. These garbage packets are allowed to traverse the Internet to cause severe traffic burdens, waste communication resources, and disrupt the Internet?s normal functions. Such packets need to be discarded as close to their sources as possible to increase the availability and reliability of the Internet.This project aims to establish a comprehensive and sustainable architecture that coordinates the routers in the Internet to achieve early filtering of botnet garbage packets in Internet traffic. The architecture comprises four major components: rule generation component, rule dissemination component, rule management component, and rule security component. The objective is to investigate and quantify the tradeoff between the saved bandwidth originally consumed by the garbage traffic and the throughput slowdown introduced by the routers' extra filtering overhead, and find optimal solutions under the tradeoff function. The evaluation plan will use benchmarks developed under various traffic traces and network topologies to evaluate the performance of the developed algorithms and technologies, and derive insights on how far and wide the filtering rules should be disseminated and installed under different attack scenarios in order to optimize the performance.Completion of the project will create techniques and software that improve the security and capacity of the Internet overall. Additionally, early filtering of garbage traffic will limit the damages caused by large-scale botnet attacks, reduce operational costs for ISPs, enhance the performance of many online services and applications, and increase the reliability of critical national infrastructures.

目前，在互联网上有越来越多的不必要的，未经请求的“垃圾”数据包，主要是由僵尸网络，它可以发动分布式拒绝服务攻击，蠕虫攻击和垃圾邮件。这些垃圾数据包被允许穿越互联网，造成严重的流量负担，浪费通信资源，扰乱互联网？的正常功能。这类数据包需要在尽可能靠近其来源的地方被丢弃，以提高互联网的可用性和可靠性。本项目旨在建立一个全面的、可持续的架构，协调互联网中的路由器，实现互联网流量中僵尸网络垃圾数据包的早期过滤。该体系结构包括四个主要组件：规则生成组件、规则分发组件、规则管理组件和规则安全组件。其目的是调查和量化之间的权衡节省的带宽原来消耗的垃圾流量和吞吐量放缓引入路由器的额外的过滤开销，并找到最佳的解决方案下的权衡功能。该评估计划将使用根据各种流量跟踪和网络拓扑开发的基准来评估所开发的算法和技术的性能，并了解在不同的攻击情况下，过滤规则应在多大程度上传播和安装，以优化性能。该项目的完成将创造出提高互联网整体安全性和容量的技术和软件。此外，垃圾流量的早期过滤将限制大规模僵尸网络攻击造成的损害，降低ISP的运营成本，提高许多在线服务和应用程序的性能，并提高关键国家基础设施的可靠性。