加强对量化DDoS攻击的缓解:一种混合FPGA/软件过数据路径
Denis Salopek1, Miljenko Mikuc1
1Faculty of Electrical Engineering and Computing, University of Zagreb, 10000 Zagreb, Croatia.
Sensors (Basel, Switzerland)
|September 9, 2023
概括
本研究介绍了用于高速网络安全的混合硬件/软件数据包过器. 这种新的设计通过将规则卸载到FPGA硬件上来改善分布式拒绝服务 (DDoS) 攻击的缓解,从而提高性能.
科学领域:
- 计算机工程 计算机工程
- 网络安全 网络安全
- 网络安全 网络安全
背景情况:
- 现代互联网需要高性能网络设备来分类和过数据包.
- 大量的分布式拒绝服务 (DDoS) 攻击需要高效的数据包处理和过解决方案.
- 现有的解决方案往往缺乏负担能力,灵活性或即时可用性.
研究的目的:
- 为了研究一个混合硬件/软件包过器原型.
- 为满足对高速,可配置的网络处理设备的需求.
- 为DDoS数据包过提供一个具有成本效益的替代方案.
主要方法:
- 开发了一种混合过器,将可重新配置的FPGA技术与商品硬件上的高速软件过相结合.
- 实施了一种新的方法,将过规则卸载到硬件上.
- 使用最长前匹配 (LPM) 算法与数以百万计的IP前的allowlists/blocklists.
主要成果:
- 与仅使用软件过相比,实现了近30%的性能提升.
- 证明的改进取决于规则,卸载方法和交通类型.
- 验证了IPv4流量的高速DDoS数据包过的有效性.
结论:
- 混合过器为网络安全提供了具有成本效益的解决方案.
- 在网络边缘部署可以减轻DDoS攻击并保护设备,包括物联网.
- 通过提供高效的数据包过功能来提高整体网络安全性.
相关概念视频
Upsampling
261
Managing signal sampling rates is essential in digital signal processing to maintain signal integrity. A decimated signal, characterized by a reduced frequency range due to its lower sampling rate, can be upsampled by inserting zeros between each sample. This upsampling process expands the original spectrum and introduces repeated spectral replicas at intervals dictated by the new Nyquist frequency. To refine this zero-inserted sequence, it is passed through a lowpass filter with a cutoff...
261
Downsampling
182
When considering a sampled sequence with zero values between sampling instants, one can replace it by taking every N-th value of the sequence. At these integer multiples of N, the original and sampled sequences coincide. This process, known as decimation, involves extracting every N-th sample from a sequence, thereby creating a more efficient sequence.
The Fourier transform of the decimated sequence reveals a combination of scaled and shifted versions of the original spectrum. This...
The Fourier transform of the decimated sequence reveals a combination of scaled and shifted versions of the original spectrum. This...
182
Fast Decoupled and DC Powerflow
233
The fast decoupled power flow method addresses contingencies in power system operations, such as generator outages or transmission line failures. This method provides quick power flow solutions, essential for real-time system adjustments. Fast decoupled power flow algorithms simplify the Jacobian matrix by neglecting certain elements, leading to two sets of decoupled equations:
233
Aliasing
159
Accurate signal sampling and reconstruction are crucial in various signal-processing applications. A time-domain signal's spectrum can be revealed using its Fourier transform. When this signal is sampled at a specific frequency, it results in multiple scaled replicas of the original spectrum in the frequency domain. The spacing of these replicas is determined by the sampling frequency.
If the sampling frequency is below the Nyquist rate, these replicas overlap, preventing the original...
If the sampling frequency is below the Nyquist rate, these replicas overlap, preventing the original...
159
Design Example: Analyzing Capacity Contours for Flood Risk Assessment
66
Flood risk assessment involves careful planning and analysis to ensure the safety of communities near water retention structures. Capacity contours are a vital tool in this process, as they illustrate the potential spread of water at specific levels in a given area. In the context of building a bund across a small valley, these contours play a critical role in evaluating the safety of nearby residential areas.In this example, the bund is intended to store stormwater in the valley. The engineers...
66
Cascaded Op Amps
663
Operational amplifiers (op-amps) are versatile electronic components that can be interconnected in a cascade - one after another in a linear sequence. This cascading is possible due to their infinite input resistance and zero output resistance, allowing them to maintain their input-output relationships even when connected in series.
In a cascaded system, each op-amp is referred to as a stage. The output of one stage drives the input of the subsequent stage. As the input signal passes through...
In a cascaded system, each op-amp is referred to as a stage. The output of one stage drives the input of the subsequent stage. As the input signal passes through...
663


