论文标题
我的爱（Syn-）cookie：可编程数据平面中的SYN洪水缓解措施
Me Love (SYN-)Cookies: SYN Flood Mitigation in Programmable Data Planes
论文作者
论文摘要
SYN洪水攻击是对Internet上的一种常见攻击策略，该策略试图通过导致服务拒绝（DOS）的请求超载服务。连接设置的高度不对称成本 - 将主要负担放在attackee上 - 使SYN洪水成为有效而流行的DOS攻击策略。滥用广泛使用的TCP作为攻击矢量，利用幼稚的连接阻塞策略对恶意流量及其预防的检测变得复杂。现代可编程数据平面设备能够处理10 GBIT/S范围内的流量，而无需超载。我们讨论如何利用他们的性能来捍卫整个网络免受SYN洪水攻击。因此，我们分析了不同的防御策略，SYN身份验证和SYN Cookie，并讨论移植到不同目标数据平面的实现困难：软件，网络处理器和FPGA。我们为所有三个平台提供原型实现和性能数字。此外，我们完全披露了导致本工作中描述的实验的工件。
The SYN flood attack is a common attack strategy on the Internet, which tries to overload services with requests leading to a Denial-of-Service (DoS). Highly asymmetric costs for connection setup - putting the main burden on the attackee - make SYN flooding an efficient and popular DoS attack strategy. Abusing the widely used TCP as an attack vector complicates the detection of malicious traffic and its prevention utilizing naive connection blocking strategies. Modern programmable data plane devices are capable of handling traffic in the 10 Gbit/s range without overloading. We discuss how we can harness their performance to defend entire networks against SYN flood attacks. Therefore, we analyze different defense strategies, SYN authentication and SYN cookie, and discuss implementation difficulties when ported to different target data planes: software, network processors, and FPGAs. We provide prototype implementations and performance figures for all three platforms. Further, we fully disclose the artifacts leading to the experiments described in this work.
