考慮服務品質限制下利用路由選徑與資源配置防禦分散式阻絕服務攻擊

隨著網路使用的普及，網路攻擊事件層出不窮，尤其是分散式阻絕服務攻擊，往往造成網路上服務提供者資源的損失以及使用者服務品質的權益受損。因此在遭受攻擊時，網路管理者為了維持使用者的服務品質，利用備用資源配置去良好地設計一個網路是有其需要的。本論文中，在滿足服務品質限制下將利用路由選徑以及資源配置去防禦智慧型的分散式阻絕服務攻擊。我們將攻防的情境轉化成一個最大最小化的雙層數學規劃問題；內層問題 (最小化) 代表當一個網路遭受某種模式的攻擊時，網路管理者利用決定最少的防禦資源配置需求以及路由選徑策略與去維持網路內部使用者的服務品質，外層問題 (最大化) 則為網路管理者假設在給定攻擊流量時，有一攻擊者利用攻擊模式的調整以求最大化網路的整體防禦資源需求。為了求得最佳解，我們利用拉格蘭日鬆弛法為基礎的演算法來處理內層的問題，並利用次梯度法為基礎的演算法來解外層的問題。解出問題之後，我們預期發展出有效率且有效用的演算法。

關鍵字

分散式阻絕服務攻擊；拉格蘭日鬆弛法；服務品質；路由選徑；資源配置

並列摘要

As the popularity of networks is increasing, network attack events occur frequently, especially Distributed Denial-of-Service (DDoS) attacks. Upon such attacks, system resources are dramatically consumed and the Quality-of-Service (QoS) perceived by users significantly degrades. In order to achieve the objective of “continuity of services”, it is then essential that a network be well designed by spare resource allocation so as to maintain acceptable QoS levels upon such attacks. In this thesis, the problem of defense against intelligent DDoS attacks by routing and budget allocation (RB) under QoS constraints is considered. This problem is formulated as a max-min integer programming problem, where the inner (minimization) problem is for network administrators to determine the minimum amount of defense budget required and effective internal routing policies so as to defend the network against a given pattern of DDoS attacks under given QoS requirements, while the outer (maximization) problem is for network administrators to evaluate the worst-case defense resource required when attacks adjust the patterns of DDoS attack flows (AF) under a fixed total attack power. A Lagrangean relaxation-based algorithm is proposed to solve the inner problem, while a subgradient-based algorithm is proposed to solve the outer problem. It is expected that efficient and effective algorithms be developed accordingly.

並列關鍵字

Distributed Denial-of-Service ； Lagrangean Relaxation ； Quality-of-Service ； Routing Assignment ； Resource Allocation

參考文獻

[1] J. Mirkovic, P. Reiher, “A Taxonomy of DDoS Attack and DDoS Defense Mechanisms”, ACM SIGCOMM Computer Communications Review, Vol. 34, No. 2, April 2004.

[2] H. Wang, D. Zhang, K. G. Shin, “Change-Point Monitoring for the Detection of DoS Attacks”, IEEE Transactions on Dependable and Secure Computing, Vol. 1, No. 4, Octorber-December 2004.

[3] D. K. Y. Yau, J. C. S. Lui, F. Liang, Y. Yam, “Defending Against Distributed Denial-of-Service Attacks with Max-Min Fair Server-Centric Router Throttles”, IEEE/ACM Transactions on Networking, Vol. 13, No. 1, February 2005.

[4] Y. Xiang, Y. Lin, W. L. Lei, S. J. Huang, “Detecting DDoS attack based on network self-similarity”, IEE Proc.-Commun, Vol. 151, No. 3, June 2004.

[5] J. Mirkovic, P. Reiher, “D-WARD: A Source-End Defense against Flooding Denial-of-Service Attacks”, IEEE Transactions on Dependable and Secure Computing, Vol. 2, No. 3, July-September 2005.

國際替代計量

考慮服務品質限制下利用路由選徑與資源配置防禦分散式阻絕服務攻擊

全文下載

主題瀏覽