防禦阻絕服務式攻擊之設計與實作

Design and Implementation of Defense Against Denial of Service

沈宗毅(Tsung-Yi Shen)

指導教授 ： 黃士殷

元智大學/資訊學院/資訊工程學系/碩士(2002年)

摘要

阻絕服務式攻擊一直是各大知名網站頭痛的問題，在現行的網路環境中，對於阻絕服務式攻擊一直沒有有效的防禦方式，遭到此種攻擊方式往往只能採消極的方式來解決；而阻絕服務式攻擊不僅單單只是影響攻擊目標，封包傳輸路徑上的網路流量、設備均可能受到影響[17]，而無法正常的提供服務，造成局部性的網路癱瘓。
有鑒於此，本篇論文提出一個新的架構來解決此惱人的問題，以不變動現行的網路傳輸協定與程式爲前提，提供一個有效的方法降低阻絕服務式攻擊影響，並設計了懲罰與封包追蹤的機制，讓不注重安全的管理員有所警惕；本系統以動態服務的概念設計了相關的模組，可以動態的載入、卸載及變更設定相關的模組，並以多階段與分散式分析的方式，降低分析所需的效能，攻擊分析以目標網路位址爲分析重點，與一般傳統針對來源網路位址的防禦方式不同，採用目標網路位址分析可避免封包來源網路位址僞造的問題，並且攻擊目標一般而言僅有少數幾個，分析上較爲容易，也避免浪費分析無用的欄位而導致降低設備的處理能力。

關鍵字

動態設定 ； 目標網路位址 ； 追蹤來源

並列摘要

DoS(Denial of Service) is an annoying problem for every famous website all the time. At present, it''s no effective way to defend the DoS attack in our network environment, so it''s often taking the negative way to solve the DoS attack. And the DoS is not only effecting on attack target, it''s also effecting on the equipment and the network flow of packet transmission route to cause not able to provide regular service and result in partial network paralyzed.
For this reason, we bring up a new framework to solve the annoying problem in this thesis. As a prerequisite as not to vary on present network protocol and formula, we provide an effective method to reduce the effect from the DoS attack, and we design the punishment and packet trace to alert some administrators who are not concern about network security.
Our system is designed the related module by dynamic configure service concept, it can load, unload and modify related module dynamically, and use the plenty phase and distributed analysis way to reduce the efficacy of analysis. System analyzes Dos attack with an emphasis on destination network IP address, it''s different from defense against source network IP address in ordinary tradition way. To analyze destination network IP address can avoid the fake packet source network IP address problem, and the attack target is only a few number in general, so it''s easy to analyze and also avoid losing equipment''s handle ability from analyzing useless section.

並列關鍵字

dynamic configure ； destination IP address ； traceback

參考文獻

[1] CERT Incident Note. IN-99-07：”Distributed Denial of Service Tools”, November 1999

[2] CERT Coordination Center. “Denial of Service Attacks”, CERT Tech Tips, October 1997

[3] CERT Advisory. CA-1996-01：“UDP Port Denial-of-Service Attack”, February 1996

[4] CERT Advisory. CA-1998-01：” Smurf IP Denial-of-Service Attacks”, January 1998

[9] Xianjun Geng and Andrew B. Whinston. “Defeating Distributed Denial of Service Attacks”, IT Professional, July