DDoS攻击是当今Internet面临的主要威胁之一,也是一个最严重的安全问题。首先将DDoS防御机制进行分类。一种方法根据响应位置的不同来分类,另一种方法是根据不同的阶段来分类。然后提出了一种适合局域网的防御框架,它可以保护内网的服务器。此框架基于IP地址分布的统计特征,通过计算相邻时刻的相似度来检测DDoS攻击。目的是为研究者提供清晰的DDoS防御机制分类,并期望该框架能有助于网络管理者诊断网络。 DDoS attacks are one of the major threats to the Internet today and one of the most serious security issues. First DDoS defense mechanism for classification. One method is classified according to the location of the response, the other method is based on different stages to classify. Then put forward a suitable local area network defense framework, which can protect the internal network server. Based on the statistical characteristics of IP address distribution, this framework detects DDoS attacks by calculating the similarity between adjacent moments. The goal is to provide researchers with a clear classification of DDoS defense mechanisms and expect the framework to help network managers diagnose the network.