Denial of Service Cheat Sheet / 拒绝服务攻击应急指南

Introduction / 介绍

This cheat sheet describes a methodology for handling denial of service (DoS) attacks on different layers. It also serves as a platform for further discussion and analysis, since there are many different ways to perform DoS attacks.

本指南描述了处理不同层级的拒绝服务（DoS）攻击的方法。它还作为一个进一步讨论和分析的平台，因为执行DoS攻击的方式有很多种。

Fundamentals / 基础知识

Because anti-DoS methods cannot be one-step solutions, your developers and application/infrastructure architects must develop DoS solutions carefully. They must keep in mind that "availability" is a basic part of the CIA triad.

由于反DoS方法不能是一步到位的解决方案，您的开发人员和应用程序/基础设施架构师必须谨慎地开发DoS解决方案。他们必须牢记，“可用性”是CIA三要素的基本部分。

Remember that if every part of the computing system within the interoperability flow does not function correctly, your infrastructure suffers. A successful DoS attack hinders the availability of instances or objects to a system and can eventually render the entire system inaccessible.

请记住，如果互操作性流程中的计算系统各个部分不能正常工作，您的基础设施就会受到影响。成功的DoS攻击会阻碍系统实例或对象的可访问性，最终可能导致整个系统不可访问。

To ensure systems can be resilient and resist a DoS attack, we strongly suggest a thorough analysis on components within your inventory based on functionality, architecture and performance (i.e. application-wise, infrastructure and network related).

为了确保系统具有弹性和抵御DoS攻击的能力，我们强烈建议根据功能、架构和性能（即应用程序、基础设施和网络相关）对您的库存组件进行全面分析。

This DoS system inventory should look for potential places where DoS attacks can cause problems and highlight any single points of system failures, which can range from programming related errors to resource exhaustion. It should give you a clear picture of what issues are at stake (e.g. bottlenecks, etc.). To resolve problems, a solid understanding of your environment is essential to develop suitable defense mechanisms. These could be aligned with:

此DoS系统库存应寻找可能导致DoS攻击出现问题的潜在位置，并突出任何单点系统故障，这些故障可能从编程相关错误到资源耗尽不等。它应为您提供一个清晰的图景，了解哪些问题是关键（例如，瓶颈等）。要解决问题，对您的环境有一个全面的理解对于开发合适的防御机制至关重要。这些可以与以下内容对齐：

1. Scaling options (up = inner hardware components, out = the number of complete components).
   中文：扩展选项（向上 = 内部硬件组件，向外 = 完整组件的数量）。
2. Existing conceptual / logical techniques (such as applying redundancy measurements, bulk-heading, etc. - which expands your in-house capabilities).
   中文：现有的概念/逻辑技术（例如应用冗余度量、批量处理等——这可以扩展您内部的能力）。
3. A cost analysis applied to your situation.

This document adopts a specific guidance structure from CERT-EU to analyze this subject, which you may need to change depending on your situation. It is not a complete approach but it will help you create fundamental blocks which should be utilized to assist you in constructing anti-DoS concepts fitting your needs.

Analyzing DoS attack surfaces

In this cheat sheet, we will use the DDOS classification as documented by CERT-EU to examine DoS system vulnerabilities. It uses the seven OSI model and focuses three main attack surfaces, namely Application, Session and Network.

1) Overview of potential DoS weaknesses

It is important to understand that each of these three attack categories needs to be considered when designing a DoS-resilient solution:

Application attacks focus on rendering applications unavailable by exhausting resources or by making it unusable in a functional way.

Session (or protocol) attacks focus on consuming server resources, or resources of intermediary equipment like firewalls and load-balancers.

Network (or volumetric) attacks focus on saturating the bandwidth of the network resource.

网络（或体积）攻击旨在耗尽网络资源的带宽。

Note that OSI model layers 1 and 2 are not included in this categorization, so we will now discuss these layers and how DoS applies to them.

请注意，OSI 模型的第 1 层和第 2 层不包括在本分类中，因此我们现在将讨论这些层以及 DoS 如何应用于它们。

The physical layer consists of the networking hardware transmission technologies of a network. It is a fundamental layer underlying the logical data structures of the higher-level functions in a network. Typical DoS scenarios that involve the physical layer involve system destruction, obstruction, and malfunction. For example, a Georgian elderly woman sliced through an underground cable, resulting in the loss of internet for the whole of Armenia.

物理层由网络的网络硬件传输技术组成。它是网络中高级功能逻辑数据结构的基础层。涉及物理层的典型 DoS 场景包括系统破坏、阻塞和故障。例如，一位格鲁吉亚老妇人切断了地下电缆，导致整个亚美尼亚地区的互联网中断。

The data layer is the protocol layer that transfers data between adjacent network nodes in a wide area network (WAN) or between nodes on the same local area network (LAN) segment. Typical DoS scenarios are MAC flooding (targeting switch MAC tables) and ARP poisoning.

数据层是协议层，用于在广域网（WAN）中相邻网络节点之间或在同一局域网（LAN）段上的节点之间传输数据。典型的 DoS 场景包括 MAC 洪水攻击（针对交换机的 MAC 表）和 ARP 污染。

In MAC flooding attacks, a switch is flooded with packets that all have different source MAC addresses. The goal of this attack is to consume the limited memory used by a switch to store the MAC and physical port translation table (MAC table), which causes valid MAC addresses to be purged and forces the switch to enter a fail-over mode where it becomes a network hub. If this occurs, all data is forwarded to all ports, resulting in a data leakage.

在 MAC 洪水攻击中，交换机被填充了具有不同源 MAC 地址的数据包。这种攻击的目的是消耗交换机用于存储 MAC 和物理端口转换表（MAC 表）的有限内存，这会导致有效 MAC 地址被清除，并迫使交换机进入故障转移模式，使其成为网络集线器。如果发生这种情况，所有数据都会转发到所有端口，从而导致数据泄露。

[Future additions to sheet: The impact in relation to DoS and document compact remediation]

[未来表格添加内容：与 DoS 和文档紧凑修复相关的冲击]

In ARP poisoning attacks, a malicious actor sends spoofed ARP (Address Resolution Protocol) messages over the wire. If the attacker's MAC address becomes linked to the IP address of a legitimate device on the network, the attacker can intercept, modify or stop data that was intended for the victim IP address. The ARP protocol is specific to the local area network and could cause a DoS on the wire communication.

在 ARP 污染攻击中，恶意行为者通过有线发送伪造的 ARP（地址解析协议）消息。如果攻击者的 MAC 地址与网络中合法设备的 IP 地址相关联，攻击者可以拦截、修改或停止原本打算发送给受害者 IP 地址的数据。ARP 协议是针对局域网的，可能导致有线通信中的 DoS。

Packet filtering technology can be used to inspect packets in transit to identify and block offending ARP packets. Another approach is to use static ARP tables but they prove difficult to be maintained.

可以使用数据包过滤技术来检查传输中的数据包，以识别和阻止恶意 ARP 数据包。另一种方法是使用静态 ARP 表，但它们难以维护。

Application attacks / 应用攻击

Application layer attacks usually make applications unavailable by exhausting system resources or by making it unusable in a functional way. These attacks do not have to consume the network bandwidth to be effective. Rather they place an operational strain on the application server in such a way that the server becomes unavailable, unusable or non-functional. All attacks exploiting weaknesses on OSI layer 7 protocol stack are generally categorised as application attacks. They are the most challenging to identify/mitigate.

应用层攻击通常通过耗尽系统资源或以功能性的方式使其不可用，从而使应用程序不可用。 这些攻击不需要消耗网络带宽就能有效。相反，它们以某种方式对应用程序服务器施加运营压力，使服务器变得不可用、不可用或非功能性。所有利用OSI第7层协议栈弱点的攻击通常被归类为应用攻击。它们是最具挑战性的识别/缓解攻击。

[Future additions to sheet: List all attacks per category. Because we cannot map remediations one on one with an attack vector, we will first need to list them before discussing the action points.]

[表格未来补充：按类别列出所有攻击。因为我们不能将修复措施与攻击向量一一对应，所以我们首先需要列出它们，然后再讨论行动要点。]

Slow HTTP attacks deliver HTTP requests very slow and fragmented, one at a time. Until the HTTP request was fully delivered, the server will keep resources stalled while waiting for the missing incoming data. At one moment, the server will reach the maximum concurrent connection pool, resulting in a DoS. From an attacker's perspective, slow HTTP attacks are cheap to perform because they require minimal resources.

缓慢的HTTP攻击非常慢且分块地发送HTTP请求，一次一个。直到HTTP请求完全发送，服务器将保持资源停滞，等待缺失的传入数据。 在某一时刻，服务器将达到最大并发连接池，导致DoS攻击。从攻击者的角度来看，缓慢的HTTP攻击成本低廉，因为它们需要最少的资源。

Software Design Concepts / 软件设计概念

• Using validation that is cheap in resources first: We want to reduce impact on these resources as soon as possible. More (CPU, memory and bandwidth) expensive validation should be performed afterward.
  中文：首先使用资源消耗低效的验证：我们希望尽快减少对这些资源的影响。更昂贵（CPU、内存和带宽）的验证应在之后进行。
• Employing graceful degradation: This is a core concept to follow during application design phase, in order to limit impact of DoS. You need to continue some level of functionality when portions of a system or application break. One of the main problems with DoS is that it causes sudden and abrupt application terminations throughout the system. A fault tolerant design enables a system or application to continue its intended operation, possibly at a reduced level, rather than failing completely if parts of the system fails.
  中文：采用优雅降级：这是在应用程序设计阶段遵循的核心概念，以限制DoS的影响。当系统或应用程序的部分出现问题时，您需要继续一定程度的操作。DoS的一个主要问题是它会导致整个系统中断和突然的应用程序终止。容错设计使系统或应用程序能够在系统部分失败的情况下继续其预期操作，而不是完全失败。
• Prevent single point of failure: Detecting and preventing single points of failure (SPOF) is key to resisting DoS attacks. Most DoS attacks assume that a system has SPOFs that will fail due to overwhelmed systems. We suggest that you employ stateless components, use redundant systems, create bulkheads to stop failures from spreading across the infrastructure, and make sure that systems can survive when external services fail. Prevention
  中文：防止单点故障：检测和防止单点故障（SPOF）是抵抗DoS攻击的关键。大多数DoS攻击都假设系统存在SPOFs，这些SPOFs会因为系统过载而失败。我们建议您使用无状态组件，使用冗余系统，创建隔离舱以阻止故障在基础设施中扩散，并确保系统在外部服务失败时仍能生存。预防措施
• Avoid highly CPU consuming operations: When a DoS attack occurs, operations that tend to use a lot of CPU resources can become serious drags on system performance and can become a point of failure. We strongly suggest that you review performance issues with your code, including problems that are inherent in the languages that you are using. See Java JVM-IBM and Microsoft-IIS
  中文：避免高CPU消耗操作*：当DoS攻击发生时，那些倾向于使用大量CPU资源的操作可能会严重拖慢系统性能，并可能成为故障点。我们强烈建议您审查代码中的性能问题，包括您所使用语言中固有的问题。参见Java JVM-IBM 和 Microsoft-IIS *
• Handle exceptions: When a DoS attack occurs, it is likely that applications will throw exceptions and it is vital that your systems can handle them gracefully. Again, a DoS attack assumes that an overwhelmed system will not be able to throw exceptions in a way that the system can continue operating. We suggest that you go through your code and make sure that exceptions are handled properly. See Large-Scale-Systems Java and Java
  中文：处理异常：当DoS攻击发生时，应用程序可能会抛出异常，而您的系统能够优雅地处理这些异常至关重要。同样，DoS攻击假设一个过载的系统将无法以使系统能够继续运行的方式抛出异常。我们建议您审查代码，确保异常得到适当处理。参见大规模系统 Java 和 Java
• Protect overflow and underflow Since buffer overflow and underflow often lead to vulnerabilities, learning how to prevent them is key. OWASP Overflow-Underflow-C Overflow
  中文：保护溢出和下溢 由于缓冲区溢出和下溢往往会导致漏洞，学习如何防止它们是关键。OWASP Overflow-Underflow-C Overflow
• Threading: Avoid operations which must wait for completion of large tasks to proceed. Asynchronous operations are useful in these situations.
  中文：线程：避免必须等待大任务完成才能进行的操作。在这些情况下，异步操作很有用。
• Identify resource intensive pages and plan ahead.
  中文：识别资源密集型页面并提前规划。

Session / 会话

• Limit server side session time based on inactivity and a final timeout: (resource exhaustion) While sessions timeout is most of the time discussed in relation to session security and preventing session hijacking, it is also an important measure to prevent resource exhaustion.
  中文：根据不活跃状态和最终超时限制服务器端会话时间：（资源耗尽）虽然会话超时通常与会话安全和防止会话劫持相关讨论，但它也是防止资源耗尽的重要措施。
• Limit session bound information storage: The less data is linked to a session, the less burden a user session has on the webserver's performance.
  中文：限制会话绑定的信息存储：与会话关联的数据越少，用户会话对Web服务器性能的负担就越小。

Input validation / 输入验证

• Limit file upload size and extensions: This tactic prevents DoS on file space storage or other web application functions which will use the upload as input (e.g. image resizing, PDF creation, etc. (resource exhaustion) - Checklist.
  中文：限制文件上传大小和扩展名：这种策略可以防止文件空间存储或其他使用上传作为输入的Web应用程序功能（例如图像缩放、PDF创建等）遭受拒绝服务攻击（资源耗尽）- 检查清单。
• Limit total request size: To make it harder for resource-consuming DoS attacks to succeed. (resource exhaustion)
  中文：限制总请求大小：为了使资源消耗型DoS攻击更难成功。（资源耗尽）
• Prevent input based resource allocation: Again, to make it harder for resource-consuming DoS attacks to succeed. (resource exhaustion)
  中文：防止基于输入的资源分配：再次，为了使资源消耗型DoS攻击更难成功。（资源耗尽）
• Prevent input based function and threading interaction: User input can influence how many times a function needs to be executed, or how intensive the CPU consumption becomes. Depending on (unfiltered) user input for resource allocation could allow a DoS scenario through resource exhaustion. (resource exhaustion)
  中文：防止基于输入的功能和线程交互：用户输入可以影响函数需要执行的次数，或者CPU消耗的强度。如果根据（未过滤的）用户输入进行资源分配，可能会通过资源耗尽导致DoS场景。（资源耗尽）
• Input based puzzles like captchas or simple math problems are often used to 'protect' a web form. The classic example is a webform that will send out an email after posting the request. A captcha could then prevent the mailbox from getting flooded by a malicious attacker or spambot. Puzzles serve a purpose against functionality abuse but this kind of technology will not help defend against DoS attacks.
  中文：基于输入的谜题，如验证码或简单的数学问题，通常被用来‘保护’一个网页表单。一个经典的例子是，在提交请求后，该网页表单会发送一封电子邮件。验证码可以防止恶意攻击者或垃圾邮件机器人使邮箱被洪水般地攻击。谜题可以防止功能滥用，但这种技术并不能帮助防御DoS攻击。

Access control / 访问控制

• Authentication as a means to expose functionality: The principle of least privilege can play a key role in preventing DoS attacks by denying attackers the ability to access potentially damaging functions with DoS techniques.
  中文：将身份验证作为暴露功能的一种手段：最小权限原则在防止DoS攻击中可以发挥关键作用，通过拒绝攻击者使用DoS技术访问可能造成损害的功能。
• User lockout is a scenario where an attacker can take advantage of the application security mechanisms to cause DoS by abusing the login failure.
  中文：用户锁定是一种攻击者可以利用应用程序安全机制通过滥用登录失败来造成DoS的情景。

Network attacks / 网络攻击

For more information on network attacks, see:

有关网络攻击的更多信息，请参阅：

Juniper eSecurityPlanet

[Future additions to cheat sheet: Discuss attacks where network bandwidth gets saturation. Volumetric in nature. Amplification techniques make these attacks effective. List attacks: NTP amplification, DNS amplification, UDP flooding, TCP flooding]

[未来补充至速查表：讨论网络带宽饱和的攻击。本质上是体积型的。放大技术使这些攻击有效。列出攻击：NTP放大攻击、DNS放大攻击、UDP洪水攻击、TCP洪水攻击]

Network Design Concepts / 网络设计概念

• Preventing single point of failure: See above.
  中文：防止单点故障：参见上文。
• Caching: The concept that data is stored so future requests for that data can be served faster. The more data is served via caching, to more resilient the application becomes to bandwidth exhaustion.
  中文：缓存：数据被存储以便于未来对该数据的请求可以更快地被服务。通过缓存提供的数据越多，应用程序对带宽耗尽就越具有弹性。
• Static resources hosting on a different domain will reduce the number of http requests on the web application. Images and JavaScript are typical files that are loaded from a different domain.  
  中文：在单独的域名上托管静态资源将减少Web应用程序上的HTTP请求次数。图片和JavaScript是典型的从不同域名加载的文件。

Rate limiting / 速率限制

Rate limiting is the process of controlling traffic rate from and to a server or component. It can be implemented on infrastructure as well as on an application level. Rate limiting can be based on (offending) IPs, on IP block lists, on geolocation, etc.

速率限制是控制服务器或组件的进出流量速率的过程。它可以在基础设施层面以及应用层面实现。速率限制可以基于（违规的）IP地址、IP地址黑名单、地理位置等。

• Define a minimum ingress data rate with request-read timeouts to mitigate slow HTTP attacks; see Apache's minimum-rate and timeout controls for an example. A minimum rate set too high can reject legitimate slow clients; setting it too low weakens protection against slow senders. Inspect the logs to establish a baseline of genuine traffic rates.
  中文：定义最小入站数据速率，使用请求读取超时来减轻慢速HTTP攻击；参见Apache的最小速率和超时控制以获取示例。设置得太高的最小速率可能会拒绝合法的慢速客户端；设置得太低会削弱对慢速发送者的保护。检查日志以建立真实流量速率的基线。
• Define an absolute connection timeout
  中文：定义绝对连接超时**
• Define a maximum ingress data rate limit then drop all connections above that rate.
  中文：定义最大入站数据速率限制然后丢弃超过该速率的所有连接。
• Define a total bandwidth size limit to prevent bandwidth exhaustion
  中文：定义总带宽大小限制以防止带宽耗尽
• Define a load limit, which specifies the number of users allowed to access any given resource at any given time.
  中文：定义负载限制，指定在任何给定时间允许访问任何给定资源的用户数量。

ISP-Level remediations / ISP级修复措施

• Filter invalid sender addresses using edge routers, in accordance with RFC 2267, to filter out IP-spoofing attacks done with the goal of bypassing block lists.
  中文：使用边缘路由器过滤无效的发送者地址，根据RFC 2267进行过滤，以过滤掉旨在绕过阻止列表的IP欺骗攻击。
• Check your ISP services in terms of DDOS beforehand (support for multiple internet access points, enough bandwidth (xx-xxx Gbit/s) and special hardware for traffic analysis and defense on application level
  中文：在DDoS之前检查你的ISP服务（支持多个互联网接入点、足够的带宽（xx-xxx Gbit/s）以及用于应用层流量分析和防御的特殊硬件）

Global-Level remediations: Commercial cloud filter services / 全球级修复措施：商业云过滤服务

• Consider a DDoS filtering service for larger attacks. Assess the provider's mitigation capacity and coverage against your availability requirements; do not assume a fixed attack-size ceiling.
  中文：考虑为更大规模的攻击提供DDoS过滤服务。评估提供商的缓解能力和覆盖范围，以满足你的可用性要求；不要假设有固定的攻击规模上限。
• Filter services support different mechanics to filter out malicious or non compliant traffic
  中文：过滤服务支持不同的机制来过滤掉恶意或不合规的流量
• Comply with relevant data protection/privacy laws - a lot of providers route traffic through USA/UK
  中文：遵守相关的数据保护/隐私法律 - 许多提供商将流量路由通过美国/英国

References / 参考

• CERT-EU: DDoS Overview and Incident Response Guide) （CERT-EU：DDoS概述和事件响应指南）
• Juniper: Network DoS Attacks) （Juniper: 网络拒绝服务攻击）