针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源...针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。展开更多
Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and...Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and the iSCSl-storage area network （SAN） systems, have become increasingly common in today＇s local area network （LAN） environments. The emergence of new storage techniques, such as object-based storage （OBS） and content aware storage （CAS）, significantly improves the functionality of storage devices to meet further needs for storage sub-systems. However, these may impact system performance. This papercompares the performance of NFS, iSCSI storage, object-based storage devices （OSDs）, and CAS-based storage systems in an environment with no data sharing across host machines. A gigabit ethernet network is used as the storage network. Test results demonstrate that the performances of these systems are compa- rable with CAS being much better than the others for write operations. The performance bottlenecks in these systems are analyzed to provide insight into how future storage systems may be improved and possible optimization methods. The analysis shows how the I/O interfaces in these systems affect the application performance and that network-based storage systems require optimized I/O latency and reduced network and buffer processing in the servers.展开更多
文摘针对传统的IP欺骗攻击缓解方法存在运算开销大、缺乏灵活性等问题,提出了一种基于动态限制策略的软件定义网络(software defined network,SDN)中IP欺骗攻击缓解方法。首先,利用Packet-In消息中三元组信息回溯攻击路径,定位IP欺骗攻击源头主机;然后,由控制器制定动态限制策略对连接攻击源头主机的交换机端口的新流转发功能进行限制,待限制期满再恢复其转发新流的功能,限制期的大小随着被检测为攻击源的次数而增长。研究结果表明:这种动态的限制策略可阻隔攻击流进入SDN网络,从而有效避免SDN交换机、控制器以及链路过载;由于在限制期间无需再对这些限制的交换机端口进行实时监测,该方法在应对长时攻击时较传统方法具有更高的缓解效率和更少的资源消耗。
基金Supported by the National Natural Science Foundation of China(No. 60273006)the Basic Research Foundation of Tsinghua National Laboratory for Information Science and Technology(TNList)
文摘Dramatically increasing amounts of digital data are placing huge requirements on storage systems.IP-networked storage systems, such as the network file system （NFS）-based network-attached storage （NAS） systems and the iSCSl-storage area network （SAN） systems, have become increasingly common in today＇s local area network （LAN） environments. The emergence of new storage techniques, such as object-based storage （OBS） and content aware storage （CAS）, significantly improves the functionality of storage devices to meet further needs for storage sub-systems. However, these may impact system performance. This papercompares the performance of NFS, iSCSI storage, object-based storage devices （OSDs）, and CAS-based storage systems in an environment with no data sharing across host machines. A gigabit ethernet network is used as the storage network. Test results demonstrate that the performances of these systems are compa- rable with CAS being much better than the others for write operations. The performance bottlenecks in these systems are analyzed to provide insight into how future storage systems may be improved and possible optimization methods. The analysis shows how the I/O interfaces in these systems affect the application performance and that network-based storage systems require optimized I/O latency and reduced network and buffer processing in the servers.
