摘要
目前,SYN FLOOD攻击占70%-80%;IP欺骗是常用的方式。如何防止IP欺骗的SYN攻击成为研究热点;设计是以red-hat5.0为实验平台,目的是构建一个防御IP欺骗SYN攻击的包过滤防火墙;设计所采用的方法是以RED算法为基础,结合TCP数据包重传机制,检验SYN数据包的IP地址真实性;设计过程是对的TCP请求数据包利用RED算法判断TCP请求的平均队列长度和包丢弃概率,平均队列长度超过系统负载最大值时直接按照随机分配的丢弃概率判断是否丢弃数据包;平均队列长度在系统负载之内时,如果当前的丢弃概率大于给定的阈值,则查找哈希表是否有相同的数据节点,找到则接受该数据包,没找到则保存数据包信息到哈希表,同时丢弃该包;经过分析研究验证表明该防火墙具有较好的吞吐量,同时正常数据包的通过率较高。
Currently, SYN FLOOD attacks accounted for 70%-80%. IP spoofing is a commonly used way. How to prevent IP spoo- fing attack of SYN has become a research hotspot. The design is based on redhat5. 0 platform, combined with RED algorithm design and im- plementation of a SYN attack resistance of packet filtering firewall, the firewall in mild and moderate attack in the case of judging whether a data packet dropping probability, when discarded stores the data packets to the hash table, host to the client retransmission TCP connection request, detecting whether the actual IP address, after analysis and experimental verification has better throughput, while the normal data packet through rate is also high. When subjected to severe attacks, directly using the RED in the random discard packets.
出处
《计算机测量与控制》
北大核心
2013年第7期1880-1881,1884,共3页
Computer Measurement &Control
基金
国家自然科学基金(60443004)
