公开(公告)号：US20080028467A1

公开(公告)日：2008-01-31

申请号：US11624101

申请日：2007-01-17

申请人： Chris Kommareddy ,  Samrat Bhattacharjee ,  Mark Shayman ,  Richard La

发明人： Chris Kommareddy ,  Samrat Bhattacharjee ,  Mark Shayman ,  Richard La

IPC分类号： G06F7/04

CPC分类号： H04L63/1458 ,  H04L63/1425

摘要： A denial-of-service network attack detection system is deployable in single-homed and multi-homed stub networks. The detection system maintains state information of flows entering and leaving the stub domain to determine if exiting traffic exceeds traffic entering the system. Monitors perform simple processing tasks on sampled packets at individual routers in the network at line speed and perform more intensive processing at the routers periodically. The monitors at the routers form an overlay network and communicate pertinent traffic state information between nodes. The state information is collected and analyzed to determine the presence of an attack.

摘要翻译： 拒绝服务的网络攻击检测系统可部署在单宿主和多宿主存根网络中。 检测系统维护进入和离开存根域的流的状态信息，以确定退出流量是否超过进入系统的流量。 监视器以线速在网络中的各个路由器上对采样数据包执行简单的处理任务，并在周期性的路由器上进行更密集的处理。 路由器上的监控器形成覆盖网络，并在节点之间传递相关的流量状态信息。 收集和分析状态信息以确定是否存在攻击。

公开(公告)号：US08397284B2

公开(公告)日：2013-03-12

申请号：US11624101

申请日：2007-01-17

申请人： Chris Kommareddy ,  Samrat Bhattacharjee ,  Mark A. Shayman ,  Richard La

发明人： Chris Kommareddy ,  Samrat Bhattacharjee ,  Mark A. Shayman ,  Richard La

IPC分类号： G06F7/04

CPC分类号： H04L63/1458 ,  H04L63/1425

摘要： A denial-of-service network attack detection system is deployable in single-homed and multi-homed stub networks. The detection system maintains state information of flows entering and leaving the stub domain to determine if exiting traffic exceeds traffic entering the system. Monitors perform simple processing tasks on sampled packets at individual routers in the network at line speed and perform more intensive processing at the routers periodically. The monitors at the routers form an overlay network and communicate pertinent traffic state information between nodes. The state information is collected and analyzed to determine the presence of an attack.

摘要翻译： 拒绝服务的网络攻击检测系统可部署在单宿主和多宿主存根网络中。 检测系统维护进入和离开存根域的流的状态信息，以确定退出流量是否超过进入系统的流量。 监视器以线速在网络中的各个路由器上对采样数据包执行简单的处理任务，并在周期性的路由器上进行更密集的处理。 路由器上的监控器形成覆盖网络，并在节点之间传递相关的流量状态信息。 收集和分析状态信息以确定是否存在攻击。