基于NTP反射放大攻击的DDoS追踪研究

doi:10.3969/j.issn.1000-436x.2014.z1.007

Abstract

Kai-da JIANG,Si-yu ZHANG,Qiang SUN. Research on tracking DDoS based on NTP reflection amplification attack[J]. Journal on Communications, 2014, 35(Z1): 31-35.

Figures/Tables 5

References 9

[1]	Matthew prince,technical details behind a 400 Gbit/s NTP amplification DDoS attack[EB/OL]. .
[2]	CNCERT. 关于警惕近期多发NTP反射放大攻击的预警通报[EB/OL]. .CNCERT. On guard against recent multiple NTP reflection/ amplification attacks alert notification[EB/OL]. .
[3]	洪海 DDoS 放大攻击原理及防护方法[EB/OL]. . HONG H DDoS amplification attacks principles and protective methods[EB/OL]. .
[4]	KUHRER M , HUPPERICH T , ROSSOW C ,et al. Exit from hell? reducing the impact of amplification DDoS attacks[A]. 23rd USENIX Security Symposium[C]. San Diego,California, 2014.
[5]	Christian Rossow,amplification hell:revisiting network protocols for DDoS abuse[A]. 21st Network and Distributed System Security Symposium[C]. San Diego,California, 2014.
[6]	JENKINS Q . Answers about recent DDoS attack on spamhaus[EB/OL]. .
[7]	DURUMERIC Z , BAILEY M J , HALDERMAN A . An internet-wide view of internet-wide scanning[A]. 23rd USENIX Security Symposium， San Diego,California, August 2014.
[8]	WALT KELLY P . ntpq-standard NTP query program[EB/OL]. .
[9]	IANA. IANA IPv4 address space registry[EB/OL]. .

Metrics

Recommended 0

No Suggested Reading articles found!

remote address	port	local address	count	m	ver	rstr	avgint	lstint
87.78.66.249	80	101.227.12.9	9 596	7	2	0	0	0
64.15.129.232	80	101.227.12.9	6 480	7	2	0	0	0
108.17.9.156	80	101.227.12.9	7 523	7	2	0	0	0
46.165.210.131	80	101.227.12.9	350	7	2	0	0	0
46.165.210.148	80	101.227.12.9	1 186	7	2	0	0	2
71.203.68.184	8 080	101.227.12.9	219	7	2	0	21	5
173.32.98.151	80	101.227.12.9	164	7	2	0	3	6
107.170.223.127	80	101.227.12.9	131	7	2	0	15	83
37.221.210.15	27 226	101.227.12.9	11 676	7	2	0	0	223
91.121.60.36	3 306	101.227.12.9	1 622	7	2	0	0	233
192.210.150.174	27 226	101.227.12.9	942	7	2	0	3	245
86.19.247.107	5 223	101.227.12.9	10 878	7	2	0	0	671

NTP服务器	数量
有返回时间信息	1 806 173
有返回版本信息	43 813
有返回系统信息	183 034
有返回CPU 类型	43 498
支持monlist指令	13 628

源端口	出现次数	百分比/%	对应不同IP数量
80	139 138 322	54.01	261 023
3 074	21 937 198	8.52	68 604
5 223	9 486 832	3.68	25 845
53	6 151 737	2.39	21 727
22	4 394 336	1.71	6 224
25 565	4 308 035	1.67	6 286
123	3 009 873	1.17	43 476
3 040	2 451 088	0.95	3 101
27 015	2 418 990	0.94	3 063
8 080	2 261 423	0.88	6 629

网站IP数量	国家/地区	百分比/%
95 028	美国	36.41
24 067	法国	9.22
19 369	英国	7.42
15 144	加拿大	5.80
12 565	德国	4.81
10 852	澳大利亚	4.16
8 701	巴西	3.33
8 073	荷兰	3.09
5 930	俄罗斯	2.27
4 167	波兰	1.60

[1]	CHEN Xingshu,HUA Qiang,WANG Yitong,GE Long,ZHU Yi. Research on low-rate DDoS attack of SDN network in cloud environment [J]. Journal on Communications, 2019, 40(6): 210-222.
[2]	Hongyan QIAN,Hao XUE,Ming CHEN. UDM:NFV-based prevention mechanism against DDoS attack on SDN controller [J]. Journal on Communications, 2019, 40(3): 116-124.
[3]	Junfeng TIAN,Liuling QI. DDoS attack detection method based on conditional entropy and GHSOM in SDN [J]. Journal on Communications, 2018, 39(8): 140-149.
[4]	Heng HE,Yan HU,Lianghan ZHENG,Zhengyuan XUE. Efficient DDoS attack detection and prevention scheme based on SDN in cloud environment [J]. Journal on Communications, 2018, 39(4): 139-151.
[5]	Miao WANG,Li-ming WANG,Zhen XU,Duo-he MA. Research on DDoS detection in multi-tenant cloud based on entropy change [J]. Journal on Communications, 2016, 37(Z1): 204-210.
[6]	UZhi-jun W,UIYi C,UEMeng Y. VHSAP-based approach of defending against DDoS attacks for cloud computing routing platforms [J]. Journal on Communications, 2015, 36(1): 30-37.
[7]	. Research on tracking DDoS based on NTP reflection amplification attack [J]. Journal on Communications, 2014, 35(Z1): 7-35.
[8]	Guang JIN,Fei ZHANG,Jiang-bo QIAN,Hong-hao ZHANG. DDoS defense with IP traceback and path identification [J]. Journal on Communications, 2011, 32(2): 61-67.
[9]	Jun-feng TIAN,Hong-tao ZHU,Dong-dong SUN,Zhi-ming BI,Qian LIU. Model of coorperation defense DDoS attack based on client reputation [J]. Journal on Communications, 2009, 30(3): 12-20.
[10]	Ren-yan LU,Lei CHEN,Xin LIU,De-jian YE. Defense scheme of DoS,DDoS attack in streaming media service [J]. Journal on Communications, 2009, 30(10A): 58-62.
[11]	Guang JIN,Jian-gang YANG,Yuan LI,Hui-zhan ZHANG. Optimal path identification to defend against DDoS attacks [J]. Journal on Communications, 2008, 29(9): 46-53.
[12]	Fen YAN,Yi-qun CHEN,Hao HUANG,Xin-chun YIN. Detecting DDoS attack based on compensation non-parameter CUSUM algorithm [J]. Journal on Communications, 2008, 29(6): 128-134.
[13]	Zhi-jun WU,Dong ZHANG. Attack simulation and signature extraction of low-rate DDoS [J]. Journal on Communications, 2008, 29(1): 71-76.
[14]	Bao-feng HUANG. IP traceback scheme based on histroy marking [J]. Journal on Communications, 2006, 27(11A): 85-87.
[15]	IJin-ming L,ANGRu-chuan W. Study of a new packet marking scheme for DDoS attack source traceback [J]. Journal on Communications, 2005, 26(11): 18-23.

Research on tracking DDoS based on NTP reflection amplification attack

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 5

References 9

Related Articles 15

Metrics

Recommended 0