Research On Techniques For DDoS Attack Detection And Response

Distributed denial-of-service (DDoS) attacks have been one of the most threats to the Internet. These attacks are launched easily, but their impact is terrible. A DDoS attack is characterized by an explicit attempt by attackers to prevent legitimate users from using a service. So it has caused great financial loss, and restricted the network development.This dissertation systemically addresses the main DDoS attack methods, architecture, processes and tools. Then we illuminate the research status, basic theory and some typical methods of DDoS attack detection and filtering.This dissertation focuses on the techniques for DDoS attack detection and response, aiming at core or backbone network for blocking or mitigating DDoS attacks that might threat all Internet. To detect and respond more exactly, we divide the backbone network traffic into four kinds of flows: TCP, UDP, ICMP and Others. Based on the character of flows and their proportion in the traffic, we propose detecting methods and response strategies for each flow. And in this dissertation, we propose a system model loosely distributed for DDoS attack detection and response.Moreover we prove the validity of our detecting methods and response strategies through adding real DoS attack data to real backbone network flow data. We also build a 210-node three-level network by using Internet topology generator for largescale simulations. By modifying some source codes of ns2, we test our detection and response system model under various TCP and UDP DDoS attacks. On the basis of the results display and analysis, our system has been proved to be fairly competent to counter DDoS attacks.