SSDC:一個基於伺服器端之Coremelt及Crossfire分散式阻斷服務攻擊的偵測辦法;SSDC:A Server Side Solution to Detect Coremelt and Crossfire DDoS Attacks

NCUIR > College of Electrical Engineering & Computer Science > Graduate Institute of Computer Science and Information Engineering > Electronic Thesis & Dissertation > Item 987654321/74644

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/74644

Title:	SSDC:一個基於伺服器端之Coremelt及Crossfire分散式阻斷服務攻擊的偵測辦法;SSDC:A Server Side Solution to Detect Coremelt and Crossfire DDoS Attacks
Authors:	黃熙程;Huang, Hsi-Cheng
Contributors:	資訊工程學系
Keywords:	封包側錄;VyOS;Linux;DDoS;LFA;Packet sniffer;VyOS;Linux;DDoS;LFA
Date:	2017-07-17
Issue Date:	2017-10-27 14:34:59 (UTC+8)
Publisher:	國立中央大學
Abstract:	由於缺乏有效的解決方法，DoS 及DDoS Attack是現今不斷肆虐在網際網路上，造成嚴重破壞的攻擊。DoS 及DDoS Attack的種類與手法繁多，其中、Crossfire 及 Coremelt 這兩種分散式阻斷服務攻擊 (DDoS Attack) 被資安專家視為難解的問題。主要的原因是造成這些攻擊的攻擊封包並不會送向被攻擊主機(被攻擊的主機通常是網路上的各種伺服器)，而是在攻擊者控制的機器間傳遞。這個特色導致無論從受害主機端或是從ISPs端均難以得知實際參與攻擊的惡意主機。而即使遭攻擊的主機發現長時間都無使用者與其連線，遭攻擊的主機也僅能感覺狀況異常，而無法得知其是否遭受Crossfire 及 Coremelt DDoS攻擊。因此在本論文中我們將發展出一server side的偵測系統，用以偵測server side是否遭受Crossfire及Coremelt DDoS attack，且偵測系統在遭受Crossfire 及 Coremelt DDoS攻擊時被癱瘓的網段之位置。 ;Due to the lack of effective solutions, DoS and DDoS attack is common on the internet now which cause serious damage. There are numerous types of DoS and DDos attack. Among them, Crossfire and Coremelt DDos Attack are considered as difficult problems by computer security experts. The main reason is that the attack packets which caused by Coremelt and Crossfire are not send to the target host machines directly but the machines controlled by attacker. (The target host machines are usually servers on the internet.) This feature of Coremetl and Crossfire leads to that it’s difficult to know the actual host machines which are participated in the attack from both the ISP side and the victim side. So that the target servers can only feel the abnormal situation but not know whether they suffered from Crossfire and Coremelt attack, even if target servers find that there are no client connections for a long time. In this project we will develop an server side system to detect whether the server side machine suffered from Crossfire and Coremelt attack and the location of the network segment which were paralyzed by Crossfire and Coremelt.
Appears in Collections:	[Graduate Institute of Computer Science and Information Engineering] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	264	View/Open

社群 sharing

Loading...