下一代互联网DDoS防御关键技术研究

项目名称： 下一代互联网DDoS防御关键技术研究

项目编号： No.61272450

项目类型： 面上项目

立项/批准年度： 2013

项目学科： 自动化技术、计算机技术

项目作者： 王劲松

作者单位： 天津理工大学

项目金额： 82万元

中文摘要： 拒绝服务攻击尤其是分布式拒绝服务攻击由于其攻击强度高、易伪造等特点已成为计算机网络最严重的安全威胁之一。本项目研究下一代互联网DDoS防御关键技术，主要内容如下：⑴研究Capabilities机制的完整性，包括研究防御DDoS攻击的Capabilities机制的框架、基于Capabilities机制与Filter机制的防御DDoS攻击的联合防御体系。⑵研究Capabilities机制的安全性与灵活性，包括如何防御Capabilities机制引入的DoC攻击、如何防御复杂的DDoS攻击（如：短时间的突发DDoS攻击）以及如何增强Capabilities机制灵活性以适应不同数据的传输。⑶研究Capabilities机制的效率、网络性能以及可扩展性，包括如何提高Capabilities机制的效率、设计有效的异常流量检测机制、合理的丢包策略以及应用控制学理论进行拥塞控制以提高网络性能。

中文关键词： 下一代互联网；网络安全；分布式拒绝服务攻击；防御体系；异常流量

英文摘要： Denial of Service (DoS) attacks, especially Distributed Denial of Service (DDoS) attacks, have become the most serious security threats because of their high-intensity attacks, forgery and other features.This project researches on the key technologies of DDoS defense in Next Generation Internet ,including the following：⑴Studying the integrity of the Capabilities mechanism,the framework of the Capabilities mechanisms for defending DDoS attacks ，the joint defense system for defending against DDoS attacks based on Capabilities mechanism and Filter mechanisms. ⑵Studying the security and flexibility of the Capabilities mechanisms, how to Defend against DoC(Denial-of-Capabilities) attacks introduced by Capabilities mechanism; how to defend against DDoS attacks (such as a short-term burst DDoS attacks) and how to enhance the flexibility of Capabilities mechanism to adapt to different data transmission.⑶ Studying the efficiency, network performance and scalability of the Capabilities mechanism:how to improve the efficiency of the Capabilities mechanism; how to design effective anomaly traffic detection mechanism, packet loss strategy and use control theory for congestion control to improve the network performance.

英文关键词： Next Generation Internet；Network Security；DDoS；Defence System；Abnormal Flow Detection