收稿日期: 2009-05-15
修回日期: 2009-07-28
网络出版日期: 2010-01-15
基金资助
国家自然科学基金项目(60970028)和国家863基金项目(2007AA01Z475,2007AA01Z465,2007AA01A414)资助
An efficiency evaluation methodology of DoS attack and defense mechanisms based on queueing theory
Received date: 2009-05-15
Revised date: 2009-07-28
Online published: 2010-01-15
王必达 , 连一峰 . 一种基于排队论的DoS攻防绩效评估方法[J]. 中国科学院大学学报, 2010 , 27(1) : 107 -116 . DOI: 10.7523/j.issn.2095-6134.2010.1.014
This paper presents a new efficiency evaluation methodology of DoS attack and defense mechanisms based on queueing theory. The unified index system and evaluation algorithm were proposed for various types of DoS attack and prevention. We also built queueing models to do the quantitative assessment and analyze objectively the efficiency of UDP Flood and SYN Flood. Network simulation tools were used in typical DoS attack scenarios. The rationality of the queueing models is verified through comparison of the experimental data with the results derived by the models. In addition, the utilization of this evaluation method in efficiency comparison of different types of DoS attack and defense mechanisms is illuminated through examples.
[1] Mirkovic J, Hussain A, Wilson B, et al. A user-centric metric for denial-of-service measurement //Experimental Computer Science on Experimental Computer Science. Berkeley, CA, USA: USENIX Association, 2007: 7.
[2] Su P, Chen X, Tang H. DoS attack impact assessment based on 3GPP QoS indexes //Proceedings of the 2008 3rd International Conference on Innovative Computing Information and Control Volume 00. Washington, DC, USA: IEEE Computer Society, 2008: 103.
[3] Aburrous M, Hossain M, Thabatah F, et al. Intelligent quality performance assessment for E-Banking security using fuzzy logic //Proceedings of the Fifth International Conference on Information Technology. New Generations, Washington, DC, USA: IEEE Computer Society, 2008: 420- 425.
[4] Chen T W, Sortais M, Schafer M, et al. Performance analysis of a denial of service protection scheme for optimized and QoS-aware handover
[J]. Computer Networks: The International Journal of Computer and Telecommunications Networking, 2005, 49(3):449- 464.
[5] Yin Q. Research of SIP DoS attack defense mechanism based on queue theory
[J]. Journal of Chongqing University of Posts and Telecommunications (Natural Science Edition), 2008, 20(4):471- 474 (in Chinese). 殷 茜. 基于排队论的SIP DoS攻击防御机制的研究
[J]. 重庆邮电大学学报:自然科学版, 2008, 20(4):471- 474.
[6] Wang Y, Lin C, Li Q, et al. A queueing analysis for the denial of service (DoS) attacks in computer networks
[J]. Computer Networks: The International Journal of Computer and Telecommunications Networking, 2007, 51(12):3564-3573.
[7] Bellaiche M, Gregoire J. Measuring defense systems against flooding attacks //Wireless Communications and Mobile Computing Conference. 2008: 600- 605.
[8] Zhang S J, Li J H, Chen X Z, et al. Method research for defending against distributed denial-of-service attacks based on dynamic game theory
[J]. Journal of Shanghai Jiaotong University, 2008, 42(2):198-201 (in Chinese). 张少俊, 李建华, 陈秀真, 等. 基于动态博弈理论的分布式拒绝服务攻击防御方法 . 上海交通大学学报, 2008, 42(2):198-201.
[9] Shi P, Lian Y F. Game-theoretical effectiveness evaluation of DDoS defense //The Seventh International Conference on Networking. 2008: 427- 433.
[10] Willig A. A short introduction to queueing theory
[M]. Technical University Berlin, 1999.
[11] Tijms H. New and old results for the M/D/c queue
[J]. AEU-International Journal of Electronics and Communications, 2006, 60(2):125-130.
[12] Bertsekas D P, Gallager. Data networks
[M]. 2nd edition. Prentice Hall, 1992.
[13] Fall K, Varadhan K. The ns manual . 2009- 01- 06 05- 01]. http://www.isi.edu/nsnam/ns/doc/index.html.
[14] Fui-Hoon F, Nah. A study on tolerable waiting time: how long are web users willing to wait?
[J]. Behaviour & Information Technology, 2004, 23(3):153.
[15] Thomas R. UNIX IP stack tuning guide . 2000-12- 03 05- 01]. http://www.cymru.com/Documents/ip-stack-tuning.html.
/
| 〈 |
|
〉 |
