• Title/Summary/Keyword: DDoS 공격 감내 네트워크 구조

Search Result 2, Processing Time 0.016 seconds

DDoS Attack Tolerant Network using Hierarchical Overlay (계층적 오버레이를 이용한 DDoS 공격 감내 네트워크)

  • Kim, Mi-Hui;Chae, Ki-Joon
    • The KIPS Transactions:PartC
    • /
    • v.14C no.1 s.111
    • /
    • pp.45-54
    • /
    • 2007
  • As one of the most threatening attacks, DDoS attack makes distributed multiple agents consume some critical resources at the target within the short time, thus the extent and scope of damage is serious. Against the problems, the existing defenses focus on detection, traceback (identification), and filtering. Especially, in the hierarchical networks, the traffic congestion of a specific node could incur the normal traffic congestion of overall lower nodes, and also block the control traffic for notifying the attack detection and identifying the attack agents. In this paper, we introduce a DDoS attack tolerant network structure using a hierarchical overlay for hierarchical networks, which can convey the control traffic for defense such as the notification for attack detection and identification, and detour the normal traffic before getting rid of attack agents. Lastly, we analyze the overhead of overlay construction, the possibility of speedy detection notification, and the extent of normal traffic transmission in the attack case through simulation.

Research on Effective Security Control Measures Against DDoS Attacks (DDoS 공격에 대한 효과적인 보안 관제 방안)

  • Jung, Il-Kwon;Kim, Jeom-Gu;Kim, Kiu-Nam;Ha, Ok-Hyun
    • Convergence Security Journal
    • /
    • v.9 no.4
    • /
    • pp.7-12
    • /
    • 2009
  • It is very difficult to completely block the DDoS attack, which paralyzes services by depleting resources or occupying the network bandwidth by transmitting a vast amount of traffic to the specific website or server from normal users' PCs that have been already infected by an outside attacker. In order to defense or endure the DDoS attack, we usually use various solutions such as IDS (Intrusion Detection System), IPS (Intrusion Prevention System), ITS (Intrusion Tolerance System), FW (Firewall), and the dedicated security equipment against DDoS attack. However, diverse types of security appliances cause the cost problem, besides, the full function of the equipments are not performed well owing to the unproper setting without considering connectivity among systems. In this paper, we present the effective connectivity of security equipments and countermeasure methodology against DDoS attack. In practice, it is approved by experimentation that this designed methdology is better than existing network structure in the efficiency of block and endurance. Therefore, we would like to propose the effective security control measures responding and enduring against discriminated DDoS attacks through this research.

  • PDF