| 引用本文： |
-
胡俊杰,周启航,高子博,张艺馨,单黎潇,王洁,吕志强.DDoS攻击检测与防御技术研究综述[J].信息安全学报,已采用 [点击复制]
- HuJunjie,ZhouQihang,GaoZibo,ZhangYixin,ShanLixiao,WangJie,LvZhiqiang.Advances in DDoS Attack Detection and Mitigation Techniques[J].Journal of Cyber Security,Accept [点击复制]
|
|
| |
|
|
| 本文已被：浏览 150次 下载 0次 |
|
| DDoS攻击检测与防御技术研究综述 |
|
胡俊杰, 周启航, 高子博, 张艺馨, 单黎潇, 王洁, 吕志强
|
|
|
| (中国科学院信息工程研究所) |
|
| 摘要: |
| 分布式拒绝服务（DDoS）攻击是影响互联网基础设施、云服务和关键业务系统可用性的重要安全威胁，其规模、复杂性和发生频率持续上升。随着攻击即服务、物联网僵尸网络和应用层协议滥用的发展，攻击者不仅能够发起Tbps级容量型洪泛，还可通过低速率、脉冲化、目标分散和多向量组合等策略规避既有检测机制。传统防御手段在面对超大规模攻击流量、加密业务流量、应用层资源消耗和自适应攻击策略时，逐渐暴露出响应时延较高、跨域协同不足、策略更新周期较长和可扩展性有限等局限，推动网络防御架构向弹性化、协同化和可编程化方向演进。本文以“研究问题、技术路线与能力边界”为分析框架，系统梳理DDoS攻击检测与防御技术从传统网络防御、软件定义网络（SDN）防御到可编程数据平面防御的演进脉络。首先分析DDoS攻击生命周期、攻击分类体系与新型攻击趋势，重点讨论地毯式轰炸、脉冲攻击、HTTP/2 Rapid Reset和多向量混合攻击对基于阈值、时间窗口和单点观测的检测范式带来的挑战；随后围绕边界过滤、流量清洗、CDN分布式缓解、源端溯源与机器学习检测等方向归纳传统防御研究的主要方法、部署条件与失效边界；进而从控制平面过载、Packet-In洪泛、流表耗尽和控制通道安全等攻击面分析SDN防御方案的设计权衡；进一步综述以P4可编程交换机为代表的数据平面防御技术，涵盖在网测量、在网检测、线速缓解、数据平面机器学习与快慢路径协同。最后对三代防御技术在检测位置、响应时延、吞吐能力、资源开销和适用场景等方面进行对比，并讨论对抗鲁棒性、加密流量检测、智能化调度、跨域协同和工程可部署性等开放问题。综合分析表明，单一技术难以同时满足带宽吸收、状态跟踪、语义识别和低时延响应需求，融合云清洗、SDN编排、可编程数据平面和应用层防护的混合防御架构具有工程可行性，可通过分层防御和快慢路径协同提升DDoS防御体系的纵深防护能力。 |
| 关键词: 分布式拒绝服务攻击 入侵检测 软件定义网络 可编程数据平面 流量分析 |
| DOI： |
| 投稿时间：2026-02-11修订日期：2026-06-30 |
| 基金项目:中国科学院网络测评技术重点实验室，网络安全防护技术北京市重点实验室（No. 2022YFB3103900），优才计划（B类）（No. E5YY07111K4） |
|
| Advances in DDoS Attack Detection and Mitigation Techniques |
|
HuJunjie, ZhouQihang, GaoZibo, ZhangYixin, ShanLixiao, WangJie, LvZhiqiang
|
| (Institute of Information Engineering, Chinese Academy of Sciences) |
| Abstract: |
| Distributed denial-of-service (DDoS) attacks remain a major threat to the availability of Internet infrastructure, cloud services, and critical online businesses, and their scale, complexity, and frequency continue to increase. With the growth of DDoS-as-a-service, IoT botnets, and application-layer protocol abuse, attackers can not only launch Tbps-scale volumetric floods but also evade existing defenses through low-rate behaviors, pulsing patterns, target dispersion, and multi-vector combinations. Traditional defenses are increasingly limited when facing massive traffic volumes, encrypted services, application-layer resource exhaustion, and adaptive attack strategies, because they often suffer from high response latency, insufficient cross-domain coordination, slow policy updates, and limited scalability. This paper surveys DDoS detection and mitigation techniques through a problem-driven framework that connects research challenges, technical approaches, and capability boundaries across three generations of defenses: traditional network defense, software-defined networking (SDN), and programmable data plane defense. We first analyze the DDoS attack lifecycle, classification taxonomy, and emerging trends, focusing on the challenges posed by carpet bombing, pulsing attacks, HTTP/2 Rapid Reset, and multi-vector attacks to detection paradigms based on thresholds, time windows, and single-point observation. We then review traditional defenses, including perimeter filtering, traffic scrubbing, CDN-based distributed mitigation, source-side traceback and collaboration, and machine-learning-based detection, with attention to their deployment assumptions and failure boundaries. Next, we examine SDN defenses from the perspective of attack surfaces such as control-plane overload, Packet-In flooding, flow-table exhaustion, and control-channel security. We further review P4-enabled programmable data-plane defenses, covering in-network measurement, in-network detection, line-rate mitigation, data-plane machine learning, and fast-slow path collaboration. Finally, we compare the three generations in terms of detection location, response latency, throughput capability, resource overhead, and applicable scenarios, and discuss open challenges including adversarial robustness, encrypted traffic detection, intelligent scheduling, cross-domain collaboration, and deployability. Our analysis suggests that no single technique can simultaneously satisfy bandwidth absorption, state tracking, semantic understanding, and low-latency response requirements. Hybrid architectures combining cloud scrubbing, SDN orchestration, programmable data planes, and application-layer protection offer a practical direction for improving defense-in-depth against evolving DDoS threats. |
| Key words: Distributed denial-of-service intrusion detection software-defined networking programmable data plane traffic analysis |
|
|
|
|
|
