pTrace：一种面向可控云计算的DDoS攻击源控制技术.pdfVIP

计算机研 究 与发 展 DOI：10．7544／issn1O0O一1239．2015 JournalofComputerResearchandDevelopment 52(10)：2212—2223，2015 pTrace：一种面 向可控云计算的DDoS攻击源控制技术 李保珲 。 徐克付 张 鹏 郭 莉。。 (北京邮电大学计算机学院 北京 100876) 。(中国科学院信息工程研究所 北京 100093) s(信息内容安全技术国家工程实验室(中国科学院信息工程研究所) 北京 100093) (delibh@126．corn) pTrace：A CounterTechnologyofDDoSAttackSourceforControllableCloud Computing LiBaohui，，u，XuKefu ，ZhangPeng。 ，andGuoLi’。 (SchoolofComputerScience，BeijingUniversityofPostsandTelecommunications，Beijing100876) 。(InstituteofInformationEngineering，ChineseAcademyofSciences，Beijing100093) 。(NationalEngineeringLaboratoryforInformationSecurityTechnology (InstituteofInformationEngineering，Chinese AcademyofSciences)，Beijing100093) Abstract Currently，agrowingnumberofattack sourcesofdistributeddenialofservice (DDoS)are migratingtocloud computing and bringing agreater securitychallengetothewholecyberspace． However，theresearchoneffectivelysuppressingtheseattacksourcesisstilldeficient．So，thispaper DroposesamethodpTracetodefeattheDDoS attacksourcesin cloud，which comprising thepacket filtermodu1e inFilterand themaliciousprocessretroactivemodulempTrace．inFiltermainly filters Dacketswith forged source address． And， mpTrace firstly identifies attack streams and their correspondingsourceaddresses，thentracemaliciousprocessesbasedontheobtained sourceaddresses． W ehave implemented aprototype system underOpenstack and Xen environment．Experimental resuItsandanalysisshow thatinFiltercan preventlarge—scaleDDoS attack frombeing launched in cloudcenterwithlowertimeconsumption，andmpTracecan identifyaattackflow correctlywhen its flow rateisabout2．5timesthenormaltraffic，tracingmaliciousprocessesinmstimeleve1．Atlast， thismethodreducestheimpactbothon puppetcloudtenantandthevictim outsidecloud． Keywords controllablecloudcomputing；packetsfiltering；maliciousprogram tracebacking；info