针对RED脆弱性的分布式LDoS攻击构造

针对RED脆弱性的分布式LDoS攻击构造 Construction of Distributed LDoS Attack Aiming at Vulnerability of RED 赵磊 ZHAO Lei1 1 first-author 张笑盈 ZHANG Xiaoying1 1 王丽娜 WANG Lina1 1 2 郭迟 GUO Chi1 1 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 武汉大学空天信息安全与可信计算教育部重点实验室 武汉大学空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing of Ministry of Education,Wuhan University Key Laboratory of Aerospace Information Security and Trusted Computing of Ministry of Education,Wuhan University 针对随机早期检测（random early detection,RED）算法在慢速拒绝服务攻击（low-rate deny of serv-ice,LDoS）面前的脆弱性问题,本文通过对比路由器分别在RED和尾丢弃Drop-Tail算法管理下遭受LDoS攻击时的队列平均占用率及吞吐量,指出虽然路由器在RED算法下具有较大的空闲缓冲区,却不能对网络流量攻击起到缓冲作用.仿真对比实验表明,LDoS攻击使得路由器在RED下比Drop-Tail具有更大的链路损失带宽.指出现有LDoS的防范和检测方法的不足,构造了一种分布式LDoS攻击模型并给出一组模型实例,该模型说明现有突发流量检测方法不足以弥补RED脆弱性,也说明网络流量行为的关联复杂性. Aiming at the vulnerability of random early detection（RED） algorithm with the impact of LDoS attack,the queue average occupancy rate and throughput of routers with RED and Drop-Tail algorithms are contrasted and analyzed in this paper.Then,we propose that although the free buffer of routers with RED algorithm is larger than that with Drop-Tail algorithm,the larger free buffer can not positively resist against attacks.The simulation confirms our analysis and indicates that the loss of bandwidth of routers with RED is higher than that with Drop-Tail.By examining the detection approaches of LDoS,we point out the shortage of existing detection methods,and further construct a distributed LDoS attack model.On one hand,this model illustrates the shortage of burst traffic detection,on the other hand,shows the complex association of network traffic. 随机早期检测算法（RED） 网络流量攻击 脆弱性分析 分布式LDoS random early detection（RED） network traffic attack vulnerability analysis distributed LDoS 10.14188/j.1671-8836.2010.02.024 TP393.08 国家自然科学基金资助重大研究计划（90718006）;国家重点基础研究发展（973）计划（2007CB310801）;高等学校博士学科点专项科研基金资助项目（20070486107）;武汉大学博士研究生科研自主基金资助项目 2010-02-01 2021-04-01 2 56