基于SDN的UDP反射攻击响应方案

doi:10.19678/j.issn.1000-3428.0053065

计算机工程 ›› 2020, Vol. 46 ›› Issue (1): 121-128. doi: 10.19678/j.issn.1000-3428.0053065

基于SDN的UDP反射攻击响应方案

丁伟^a, 张千风^a, 周文烽^b

东南大学 a. 网络空间安全学院;b. 计算机科学与工程学院, 南京 211189

收稿日期:2018-11-07 修回日期:2019-02-27 出版日期:2020-01-15 发布日期:2019-03-19
作者简介:丁伟(1962-),女,教授、博士,主研方向为网络安全、网络测量;张千风、周文烽,硕士研究生。
基金资助:
国家自然科学基金（61602114）；国家重点研发计划（2018YFB1800202）。

UDP Reflection Attack Response Scheme Based on SDN

DING Wei^a, ZHANG Qianfeng^a, ZHOU Wenfeng^b

a. School of Cyber Science and Engineering;b. School of Computer Science and Engineering, Southeast University, Nanjing 211189, China

Received:2018-11-07 Revised:2019-02-27 Online:2020-01-15 Published:2019-03-19

摘要/Abstract

摘要： 针对字符发生器协议、域名系统协议、网络时钟协议、简单网络管理协议、简单服务发现协议这5种类型的用户数据报协议（UDP）反射攻击放大器，提出基于入侵检测系统（IDS）的UDP反射攻击响应方案。在定位到反射攻击放大器的前提下，结合网络边界的软件定义网络技术，采用基于OpenFlow流表的响应规则对控制命令报文进行过滤，从而阻止UDP反射攻击。在中国教育和科研计算机网南京主节点的网络边界上的测试结果验证了该响应方案的可操作性和有效性。

关键词: 用户数据报协议, 反射攻击放大器, 软件定义网络, 反射攻击响应, 网络边界

Abstract: Based on an Intrusion Detection System(IDS),this paper proposes a response scheme for User Datagram Protocol(UDP) reflection attacks from 5 kinds of UDP reflection attack amplifiers,including Character Generator Protocol(CharGen),Domain Name System(DNS),Network Time Protocol(NTP),Simple Network Management Protocol(SNMP) and Simple Service Discovery Protocol(SSDP).After the reflection attack amplifier is located,the scheme combines Software Defined Network(SDN) on the network boundary with response rules based on OpenFlow tables to filter control command messages,so UDP reflection attacks can be prevented.Test results on the network boundary of Nanjing main node of China Education and Research Computer Network(CERNET) demonstrate the operability and effectiveness of the proposed response scheme.

Key words: User Datagram Protocol(UDP), reflection attack amplifier, Software Defined Network(SDN), reflection attack response, network boundary

中图分类号:

TP393

丁伟, 张千风, 周文烽. 基于SDN的UDP反射攻击响应方案[J]. 计算机工程, 2020, 46(1): 121-128.

DING Wei, ZHANG Qianfeng, ZHOU Wenfeng. UDP Reflection Attack Response Scheme Based on SDN[J]. Computer Engineering, 2020, 46(1): 121-128.

https://www.ecice06.com/CN/Y2020/V46/I1/121

图/表 7

20200115110414

20200115110417

20200115110420

20200115110422

20200115110426

20200115110429

20200115110433

参考文献

[1] PRINCE M.The DDoS that knocked spamhaus offline(and how we mitigated it)[EB/OL].[2018-10-15].https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/.
[2] NETSCOUT's 14th annual worldwide infrastructure security report[EB/OL].[2018-10-15].https://www.netscout.com/report/.
[3] DING Wei,WANG Li,SU Qi.UDP reflection attacks interception based on ACL[J].Journal of Huazhong University of Science and Technology(Nature Science Edition),2016,44(11):21-25.(in Chinese)丁伟,王力,苏琪.基于ACL的UDP反射攻击拦截[J].华中科技大学学报(自然科学版),2016,44(11):21-25.
[4] THOMAS D R,CLAYTON R,BERESFORD A R.1000 days of UDP amplification DDoS attacks[C]//Proceedings of 2017 APWG Symposium on Electronic Crime Research.Washington D.C.,USA:IEEE Press,2017:79-84.
[5] LI Gang.Research of scanning and DRDoS attack detection based on netflow[D].Nanjing:Southeast University,2016.(in Chinese)李刚.基于流记录的扫描和反射攻击行为主机检测[D].南京:东南大学,2016.
[6] ZHANG Weiwei,GONG Jian,DING Wei.NBOS:a fine network management system based on flow technology[C]//Proceedings of the 19th Annual Conference of CERNET.Jinan:Management Committee of CERNET,2012:41-46.(in Chinese)张维维,龚俭,丁伟,等.NBOS:一个基于流技术的精细化网管系统[C]//中国教育和科研计算机网CERNET第十九届学术年会论文集.济南:中国教育和科研计算机网CERNET管理委员会,2012:41-46.
[7] TAO Naiyong.The principle and protection methods of DDoS amplification attack[J].Telecommunication Network Technology,2017(10):89-93.(in Chinese)陶乃勇.DDoS放大攻击原理及防护方法[J].电信网技术,2017(10):89-93.
[8] JOHNSON D,DEERING S.Reserved IPv6 subnet anycast addresses:RFC2526[S].IETF,1999:1-3.
[9] JARRAYA Y,MADI T,DEBBABI M.A survey and a layered taxonomy of software-defined networking[J].Communications Surveys and Tutorials,2014,4(4):1955-1980.
[10] MCKEOWN N,ANDERSON T,BALAKRISHNAN H,et al.OpenFlow:enabling innovation in campus networks[J].ACM SIGCOMM Computer Communication Review,2008,38(2):69-74.
[11] LI Hefei,HUANG Xinli,ZHENG Zhengqi.Detection method of DDoS attack based on software defined network and its application[J].Computer Engineering,2016,42(2):118-123.(in Chinese)李鹤飞,黄新力,郑正奇.基于软件定义网络的DDoS攻击检测方法及其应用[J].计算机工程,2016,42(2):118-123.
[12] CHEN C C,CHEN Y R,LU W C,et al.Detecting amplification attacks with software defined networking[C]//Proceedings of IEEE Conference on Dependable and Secure Computing.Washington D.C.,USA:IEEE Press,2017:7-10.
[13] RIJSWIJK-DEIJ R V,SPEROTTO A,PRAS A.DNSSEC and its potential for DDoS attacks:a comprehensive measurement study[C]//Proceedings of Conference on Internet Measurement.New York,USA:ACM Press,2014:449-460.
[14] US-CERT.DNS amplification attacks[EB/OL].[2018-10-15].https://www.us-cert.gov/ncas/alerts/TA13-088A.
[15] MAREK M,OLAFUR G.Deprecating the DNS ANY meta-query type[EB/OL].[2018-10-15].https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/.
[16] FINCH T.The qmail ANY query bugs[EB/OL].[2018-10-15].https://fanf.livejournal.com/122220.html.
[17] ANDREWS M.Extension Mechanisms for DNS(EDNS) EXPIRE option:RFC 7314[S].Internet Systems Consortium,2014:1-4.
[18] DAGON D,ANTONAKAKIS M,VIXIE P,et al.Increased DNS forgery resistance through 0x20-bit encoding:security via leet queries[C]//Proceedings of ACM Conference on Computer and Communications Security.Alexandria,USA:[s.n.],2008:211-222.
[19] BERTI-EQUILLE L,ZHAUNIAROVICH Y.Profiling DRDoS attacks with data analytics pipeline[C]//Proceedings of 2017 ACM Conference on Information and Knowledge Management.New York,USA:ACM Press,2017:1983-1986.
[20] PAXSON V.An analysis of using reflectors for distributed denial-of-service attacks[J].ACM SIGCOMM Computer Communication Review,2001,31(3):38-47.

选择文件类型/文献管理软件名称

选择包含的内容

基于SDN的UDP反射攻击响应方案

UDP Reflection Attack Response Scheme Based on SDN

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	崔允贺, 赵建朋, 杨鸿珍, 李显超. 基于曲线决策融合的SDN饱和攻击检测方法[J]. 计算机工程, 2024, 50(8): 123-132.
[2]	郭雷, 荆山, 魏亮, 赵川. 基于软件定义网络的Crossfire攻击防御方法[J]. 计算机工程, 2024, 50(10): 216-227.
[3]	刘向举, 赵犇, 方贤进, 徐杨洋. SDN中基于过程优化的动态负载均衡策略[J]. 计算机工程, 2023, 49(8): 137-145.
[4]	赵徐炎, 崔允贺, 钱清, 郭春, 申国伟. 基于虚拟扩展网络的虚拟机及路由路径联合部署[J]. 计算机工程, 2023, 49(8): 154-162.
[5]	陈何雄, 罗宇薇, 韦云凯, 郭威, 杭菲璐, 何映军, 杨宁. 基于联邦学习的SDN异常流量协同检测技术[J]. 计算机工程, 2023, 49(3): 168-176.
[6]	刘宇宸, 唐菀, 杨喜敏, 张艳. 引入区块链的SDN路由一致性检测[J]. 计算机工程, 2023, 49(11): 160-168.
[7]	王奎宇, 宋晓勤, 缪娟娟, 张昕婷, 雷磊. 基于SDN的高性能QoS保障低轨道卫星星间路由算法[J]. 计算机工程, 2022, 48(5): 185-190,199.
[8]	叶和元, 韩俐, 孙士民. SDN中基于蚁群优化的网络测量节点选择算法[J]. 计算机工程, 2022, 48(5): 191-199.
[9]	杜欣欣, 胡晓辉, 赵佳楠. 一种软件定义车载自组织网络的QoS路由算法[J]. 计算机工程, 2022, 48(11): 184-191,200.
[10]	赵季红, 张文娟, 乔琳琳, 张梦雪. 服务功能链中基于机器学习的QoE评估与预测[J]. 计算机工程, 2022, 48(1): 163-169.
[11]	左攀, 束永安. DCN中基于前馈神经网络的动态多路径负载均衡方法[J]. 计算机工程, 2021, 47(9): 113-119.
[12]	徐啸, 顾玲丽, 陈建平, 傅启明, 陆悠. 一种智能多路径路由及子流分配协同算法[J]. 计算机工程, 2021, 47(9): 136-144,152.
[13]	张鹏, 陈博. 基于图神经网络的智能路由机制[J]. 计算机工程, 2021, 47(12): 171-176,184.
[14]	杨雪婷, 李重. 车联网中基于车辆行为预测的身份认证方案[J]. 计算机工程, 2021, 47(1): 129-138.
[15]	王莅晟, 伊鹏, 谷允捷, 江逸茗. SDN中基于流重定向的MPLS标签算法[J]. 计算机工程, 2020, 46(8): 203-209.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于SDN的UDP反射攻击响应方案

UDP Reflection Attack Response Scheme Based on SDN

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献

相关文章 15

编辑推荐

Metrics

本文评价