基于NTP反射放大攻击的DDoS追踪研究

姜开达; 章思宇; 孙强

doi:10.3969/j.issn.1000-436x.2014.z1.007

您当前的位置：

首页 >

文章列表页 >

基于NTP反射放大攻击的DDoS追踪研究

网络空间完全 | 更新时间：2024-06-05

- 基于NTP反射放大攻击的DDoS追踪研究
- Research on tracking DDoS based on NTP reflection amplification attack
- 通信学报 2014年35卷第Z1期页码：31-35
- 作者机构：
  
  上海交通大学网络信息中心，上海 200240
- 作者简介：
  
  [ "姜开达（1980-），男，安徽池州人，上海交通大学工程师，主要研究方向为网络与信息安全。" ]
  [ "章思宇（1989-），男，上海人，上海交通大学助理工程师，主要研究方向为网络与信息安全。" ]
  [ "孙强（1975-），男，山东郓城人，上海交通大学助理工程师，主要研究方向为系统运维和网络安全。" ]
- 基金信息：
- DOI：10.3969/j.issn.1000-436x.2014.z1.007
  中图分类号： TP393.08
- 网络出版日期：2014-10，
  
  纸质出版日期：2014-10-25
- 稿件说明：
移动端阅览
姜开达, 章思宇, 孙强. 基于NTP反射放大攻击的DDoS追踪研究[J]. 通信学报, 2014,35(Z1):31-35.

Kai-da JIANG, Si-yu ZHANG, Qiang SUN. Research on tracking DDoS based on NTP reflection amplification attack[J]. Journal on communications, 2014, 35(Z1): 31-35.
姜开达, 章思宇, 孙强. 基于NTP反射放大攻击的DDoS追踪研究[J]. 通信学报, 2014,35(Z1):31-35. DOI： 10.3969/j.issn.1000-436x.2014.z1.007.

Kai-da JIANG, Si-yu ZHANG, Qiang SUN. Research on tracking DDoS based on NTP reflection amplification attack[J]. Journal on communications, 2014, 35(Z1): 31-35. DOI： 10.3969/j.issn.1000-436x.2014.z1.007.

摘要

摘要：提出了一种利用NTP反射型放大攻击的特点，通过对中国大陆开放公共NTP服务的主机定期发起主动探测（执行monlist指令），利用返回信息对全球范围NTP反射类DRDoS攻击事件进行长期追踪观察和统计分析。追踪从2014年2月开始，初始探测范围为大陆近1.4万台NTP服务主机，每隔2 h一个周期持续进行了164天，观测到了针对数十万个IP地址的疑似DDoS攻击行为。

Abstract

Based on characteristics of NTP reflection amplification attack

proposes a method of regularly launching ac

关键词

Keywords

references

Matthew prince,technical details behind a 400 Gbit/s NTP amplification DDoS attack [EB/OL ] . http://blog.cloudflare.com/technical-details-behind-a-400gbit/s-ntp-amplification-ddos-attack http://blog.cloudflare.com/technical-details-behind-a-400gbit/s-ntp-amplification-ddos-attack .

CNCERT . 关于警惕近期多发NTP反射放大攻击的预警通报 [EB/OL ] . http://www.cert.org.cn/publish/main/10/2014/20140314085001237248 948/20140314085001237248948_.html,2014 http://www.cert.org.cn/publish/main/10/2014/20140314085001237248 948/20140314085001237248948_.html,2014 .

CNCERT . On guard against recent multiple NTP reflection/ amplification attacks alert notification [EB/OL ] . http://www.cert.org.cn/publish/main/10/2014/20140314085001237248948/20140314085001237 248948_html,2014 http://www.cert.org.cn/publish/main/10/2014/20140314085001237248948/20140314085001237 248948_html,2014 .

洪海 DDoS 放大攻击原理及防护方法 [EB/OL ] . http://www.nsfocus.com/images/6_about/journal/12_20_023_j.pdf,2013 http://www.nsfocus.com/images/6_about/journal/12_20_023_j.pdf,2013 .

HONG H DDoS amplification attacks principles and protective methods [EB/OL ] . http://www.nsfocus.com/images/6_about/journal/12_20_023_j.pdf,2013 http://www.nsfocus.com/images/6_about/journal/12_20_023_j.pdf,2013 .

KUHRER M , HUPPERICH T , ROSSOW C , et al . Exit from hell? reducing the impact of amplification DDoS attacks [A ] . 23rd USENIX Security Symposium [C ] . San Diego,California , 2014 .

Christian Rossow,amplification hell:revisiting network protocols for DDoS abuse [A ] . 21st Network and Distributed System Security Symposium [C ] . San Diego,California , 2014 .

JENKINS Q . Answers about recent DDoS attack on spamhaus [EB/OL ] . http://www.spamhaus.org/news/article/695/answers-aboutrecent-ddos-attack-on-spamhaus,2013 http://www.spamhaus.org/news/article/695/answers-aboutrecent-ddos-attack-on-spamhaus,2013 .

DURUMERIC Z , BAILEY M J , HALDERMAN A . An internet-wide view of internet-wide scanning [A ] . 23rd USENIX Security Symposium ， San Diego,California , August 2014 .

WALT KELLY P . ntpq-standard NTP query program [EB/OL ] . http://www.eecis.udel.edu/～mills/ntp/html/ntpq.html,2012 http://www.eecis.udel.edu/～mills/ntp/html/ntpq.html,2012 .

IANA . IANA IPv4 address space registry [EB/OL ] . http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml,2014 http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml,2014 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于虚拟散列安全访问路径VHSAP的云计算路由平台防御DDoS攻击方法

使用补偿非参数CUSUM方法检测DDoS攻击