期刊名称：Journal of Theoretical and Applied Information Technology
印刷版ISSN：1992-8645
电子版ISSN：1817-3195
出版年度：2012
卷号：45
期号：1
页码：160-167
出版社：Journal of Theoretical and Applied
摘要：Detection and traceback of distributed denial of service (DDoS/DoS) attacks have become a challenge for network security. In this paper, we propose a lightweight cooperative detection framework (CCBFF) based on counting bloom filter to detect and trace DDoS/DoS attack online. The CCBFF contains 2 counting bloom filters CBF1 and CBF2. The CBF1 distinguishes different network connection topology of a router by the "options" field of IP-V4, encodes the existing DDoS/DoS attacks and all connected device's addresses and stored them. By querying the CBF1, the CBF2 recognizes suspicious packets, accumulates them and sends out super alerts to the victim. According to super alerts, the CCBFF at the victim-end recognize DDoS/DoS attacks. The experiment results show that the CCBFF is effective in detection and traceback different DDoS attacks.
关键词：Counting Bloom Filter; Attack Feature Code; Cooperative Detection and Traceback Framework; DDOS/DOS Attack; Router Information Flag
