Detecting and fingerprinting network-based DDoS mitigation solutions

检测和识别基于网络的 DDoS 缓解解决方案

• 批准号: 485727-2015
• 负责人: ElKhatib, Khalil
• 金额: $ 1.82万
• 依托单位: University of Ontario Institute of Technology
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2015
• 资助国家: 加拿大
• 起止时间: 2015-01-01 至 2016-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=585170
• 关键词: Detecting; fingerprinting; network; based; DDoS

Distributed Denial of Service (DDoS) is one of the most common threats to organizations, where a large number of infected systems simultaneously send requests to a target website, crippling the website and rendering it unavailable to regular clients. DDoS can result in loss of revenue and profitability, reduction in productivity, and decline in stock price. As a result, companies invest heavily in various DDoS mitigation solutions to detect and defend against these attacks. Part of the process of black box testing a company's DDoS mitigation solution is to first identify potential servers and services that may be targeted, which is normally done in the reconnaissance phase of the testing. However, the reconnaissance process can become very complicated and less transparent when the company is protecting its infrastructure with a Web Application Firewall (WAF) or utilizing a Content Distribution Network (CDN). The objective of the project is to automate the reconnaissance process to accurately fingerprint the various DDoS mitigation solutions deployed on a company's infrastructure.

分布式拒绝服务（DDoS）是组织最常见的威胁之一，其中大量的 许多受感染的系统同时向目标网站发送请求，使网站瘫痪， 使得普通客户无法使用它。DDoS可能导致收入和盈利能力的损失， 生产力和股价下跌。因此，公司在各种DDoS缓解方面投入巨资 检测和防御这些攻击的解决方案。黑盒测试公司DDoS的部分过程 缓解解决方案是首先确定可能成为目标的潜在服务器和服务，这通常是 在测试的侦察阶段完成。然而，侦察过程可能变得非常 当公司使用Web应用程序保护其基础架构时， 防火墙（WAF）或利用内容分发网络（CDN）。该项目的目标是自动化 侦察过程，以准确识别部署在 公司的基础设施。