防禦分散式阻絕服務攻擊之近似最佳化過濾及路由策略

Abstract

分散式阻絕服務攻擊已成為今日網際網路之嚴重威脅。在分散式阻絕服務攻擊發生時，眾多惡意封包佔據了網路伺服器的資源，導致合法使用者資源存取之困難。即使在使用了過濾器機制來防範分散式阻絕服務攻擊，仍無法保證合法使用者完全不受此攻擊之損害。 在本論文中，我們將分散式阻絕服務攻擊之攻擊與防禦情境摸擬成一個兩階段的數學規劃問題。在內層問題中，防禦者試圖以分配其有限防禦資源來最大化受分散式阻絕服務攻擊損害之合法流量。而在外層問題則敘述分散式阻絕服務攻擊者之試圖以分配其有限攻擊資源來最小化合法流量。同時為了求得此問題的最佳解，我們採用以拉格蘭日鬆弛法為基礎的演算法來處理內層問題，而利用以次梯度法為基礎的演算法來處理外層問題。

Distributed Denial-of-Service (DDoS) attacks have become an impending threat toward today’s Internet. During DDoS attacks, numerous malicious packets occupy a victim server and lead to the difficulty of the legitimate user’s access. Even if the filtering thwarts DDoS attacks, no legitimate users can escape the collateral damage. In this thesis, we model the DDoS attack-defense scenario as a two-level mathematical programming problem. In the inner problem, a defender tries to allocate the limited defense resources for the maximization of the legitimate traffic. In the outer problem, a DDoS attacker tries to allocate the limited attack resources in order to minimize the legitimate traffic. A Lagrangean relaxation-based algorithm is proposed to solve the inner problem, and a subgradient-based algorithm is proposed to solve the outer problem.