一種新的過濾SYN洪水攻擊的方法

本文提出了一種新的過濾SYN 洪水攻擊的方法。這種方法（故意丟棄過濾）通過觀
察客戶的協(xié)議一致性行為判定客戶的請求是否正常。它的主要思想是故意丟棄每個連接請求上的第一個SYN 數(shù)據(jù)包，后續(xù)的SYN 只有遵守TCP 超時與重傳機(jī)制才能通過。分析表明，我們的方法能有效地降低攻擊的成功率，同時連接建立的延遲也是可以接受的。
關(guān)鍵字：SYN 洪水；超時與重傳機(jī)制；協(xié)議一致性；故意丟棄；邊界路由器
Abstract: This paper presents a novel scheme for filtering SYN flooding attacks.
The scheme (Purposive Discarding based Filtering) decides whether the client’s
request is legitimate or not by observing client’s protocol consistency behavior.
The main idea is to purposely discard the first SYN packet of each connection request.
Subsequent SYN packet from a request is passed only if it adheres to the TCP’s
timeout and retransmission mechanism. Our analysis shows that the proposed scheme
reduces the attacker’s successful attack rate significantly with an acceptable
increase in connection establishment delay.
Keyword: SYN flooding; timeout and retransmission mechanism; protocol consistency;
purposive discarding; edge router