SYN Flood 是一种常见的 DDoS 攻击方式，通过发送大量伪造的 TCP 连接请求耗尽服务器资源。本文将深入探讨其原理，并提供 Java 应用层面的防御方案。
SYN Flood 攻击原理
TCP 三次握手过程中，攻击者只发送 SYN 包但不完成后续握手，导致服务器维护大量半开连接，最终资源耗尽无法响应正常请求。
SYN Cookie 原理
SYN Cookie 是一种无状态的防御机制，服务器不保存半开连接信息，而是将信息编码在 SYN-ACK 的序列号中：
- 收到 SYN 时，计算一个特殊的序列号（cookie）
- 将连接信息编码到这个序列号中
- 收到 ACK 时，从序列号中解码出原始信息
- 验证通过后才建立连接
这样可以完全避免半开连接队列被耗尽的问题。
Java 应用防御策略
1. 系统优化器
import java.io.*;
import java.util.logging.*;
public class SystemOptimizer {
private static final Logger logger = Logger.getLogger(SystemOptimizer.class.getName());
public static void printOptimizationGuide() {
logger.info("=== Linux系统优化建议 ===");
logger.info("1. 增加半连接队列大小：");
logger.info(" echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog");
logger.info("2. 减少SYN-ACK重试次数：");
logger.info(" echo 2 > /proc/sys/net/ipv4/tcp_synack_retries");
logger.info("3. 启用SYN Cookie：");
logger.info(" echo 1 > /proc/sys/net/ipv4/tcp_syncookies");
logger.info("4. 减少TIME_WAIT状态时间：");
logger.info(" echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout");
logger.info("5. 增加最大文件描述符：");
logger.info(" ulimit -n 65535");
}
public static void checkSystemConfig() {
if (!System.getProperty("os.name").toLowerCase().contains("linux")) {
logger.info("当前系统非Linux，跳过系统配置检查");
return;
}
logger.info("=== 系统配置检查 ===");
checkSysctl("net.ipv4.tcp_syncookies", "1");
checkSysctl("net.ipv4.tcp_max_syn_backlog", "2048");
checkSysctl("net.core.somaxconn", "65535");
checkSysctl("net.ipv4.tcp_fin_timeout", "30");
checkSysctl("net.ipv4.tcp_synack_retries", "2");
checkUlimit();
}
private static void checkSysctl(String key, String expectedValue) {
try {
Process p = Runtime.getRuntime().exec(new String[]{"sysctl", key});
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(p.getInputStream()))) {
String line = reader.readLine();
if (line != null) {
String[] parts = line.split("=");
if (parts.length == 2) {
String actualValue = parts[1].trim();
String status = actualValue.equals(expectedValue) ? "✓" : "✗";
logger.info(String.format("%s %s = %s (建议值: %s)",
status, key, actualValue, expectedValue));
if (!actualValue.equals(expectedValue)) {
logger.warning(String.format(
"%s 当前值 %s 不符合建议值 %s",
key, actualValue, expectedValue
));
}
}
}
}
p.waitFor();
} catch (IOException | InterruptedException e) {
logger.fine("无法读取系统配置 " + key + ": " + e.getMessage());
}
}
private static void checkUlimit() {
try {
Process p = Runtime.getRuntime().exec(new String[]{"bash", "-c", "ulimit -n"});
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(p.getInputStream()))) {
String line = reader.readLine();
if (line != null) {
int limit = Integer.parseInt(line.trim());
String status = limit >= 65535 ? "✓" : "✗";
logger.info(String.format("%s 文件描述符限制: %d (建议值: ≥65535)",
status, limit));
if (limit < 65535) {
logger.warning("文件描述符限制过低: " + limit);
}
}
}
p.waitFor();
} catch (Exception e) {
logger.fine("无法检查文件描述符限制: " + e.getMessage());
}
}
}
2. 配置管理中心
import java.util.*;
import java.io.*;
import java.util.logging.*;
public class DefenseConfig {
private static final Logger logger = Logger.getLogger(DefenseConfig.class.getName());
private static final Properties config = new Properties();
private static final String CONFIG_FILE = "/defense.properties";
static {
loadConfig();
}
public static void loadConfig() {
config.clear();
loadConfigFromFile();
loadConfigFromEnv();
}
private static void loadConfigFromFile() {
try (InputStream is = DefenseConfig.class.getResourceAsStream(CONFIG_FILE)) {
if (is != null) {
config.load(is);
logger.info("配置文件加载成功");
}
} catch (IOException e) {
logger.warning("配置文件加载失败，使用默认值: " + e.getMessage());
}
}
private static void loadConfigFromEnv() {
Map<String, String> env = System.getenv();
env.forEach((key, value) -> {
if (key.startsWith("DEFENSE_")) {
String propKey = key.substring(8).toLowerCase().replace('_', '.');
config.setProperty(propKey, value);
}
});
}
public static int getMaxConnections() {
return Integer.parseInt(config.getProperty("max.connections", "1000"));
}
public static int getMaxConnectionsPerIp() {
return Integer.parseInt(config.getProperty("max.connections.per.ip", "10"));
}
public static int getRateLimitCapacity() {
return Integer.parseInt(config.getProperty("rate.limit.capacity", "100"));
}
public static double getRateLimitRefillRate() {
return Double.parseDouble(config.getProperty("rate.limit.refill.rate", "50"));
}
public static int getSuspiciousThreshold() {
return Integer.parseInt(config.getProperty("suspicious.threshold", "5"));
}
public static int getServerPort() {
return Integer.parseInt(config.getProperty("server.port", "8080"));
}
public static int getAdminPort() {
return Integer.parseInt(config.getProperty("admin.port", "8081"));
}
public static int getSocketTimeout() {
return Integer.parseInt(config.getProperty("socket.timeout", "30000"));
}
// 配置验证
public static void validate() {
int serverPort = getServerPort();
if (serverPort < 1024 || serverPort > 65535) {
throw new IllegalArgumentException("服务端口必须在1024-65535之间");
}
int maxConnections = getMaxConnections();
int maxPerIp = getMaxConnectionsPerIp();
if (maxPerIp > maxConnections) {
throw new IllegalArgumentException("单IP最大连接数不能超过总连接数");
}
double refillRate = getRateLimitRefillRate();
if (refillRate <= 0) {
throw new IllegalArgumentException("令牌补充速率必须大于0");
}
}
}
3. 连接数限制器
import java.util.concurrent.*;
import java.net.*;
import java.io.*;
import java.util.logging.*;
public class ConnectionLimiter {
private static final Logger logger = Logger.getLogger(ConnectionLimiter.class.getName());
private final Semaphore connectionSemaphore;
private final int maxConnections;
private final ConcurrentHashMap<String, AtomicInteger> ipConnectionCount;
private final int maxConnectionsPerIp;
private final ScheduledExecutorService cleanupExecutor;
public ConnectionLimiter(int maxConnections, int maxConnectionsPerIp) {
this.maxConnections = maxConnections;
this.maxConnectionsPerIp = maxConnectionsPerIp;
this.connectionSemaphore = new Semaphore(maxConnections);
this.ipConnectionCount = new ConcurrentHashMap<>();
this.cleanupExecutor = Executors.newScheduledThreadPool(1);
// 定期清理无连接的IP记录
cleanupExecutor.scheduleAtFixedRate(this::cleanup, 1, 1, TimeUnit.MINUTES);
}
public boolean acceptConnection(Socket socket) throws IOException {
String clientIp = socket.getInetAddress().getHostAddress();
// 检查单个IP的连接数
AtomicInteger count = ipConnectionCount.computeIfAbsent(
clientIp, k -> new AtomicInteger(0)
);
if (count.get() >= maxConnectionsPerIp) {
logger.warning("IP " + clientIp + " 超过最大连接数限制");
socket.close();
return false;
}
// 检查总连接数
if (!connectionSemaphore.tryAcquire()) {
logger.warning("全局连接数已达上限");
socket.close();
return false;
}
count.incrementAndGet();
return true;
}
public void releaseConnection(Socket socket) {
String clientIp = socket.getInetAddress().getHostAddress();
connectionSemaphore.release();
ipConnectionCount.computeIfPresent(clientIp, (k, v) -> {
int newCount = v.decrementAndGet();
return newCount > 0 ? v : null;
});
}
public int getCurrentConnections() {
return maxConnections - connectionSemaphore.availablePermits();
}
private void cleanup() {
ipConnectionCount.entrySet().removeIf(entry ->
entry.getValue().get() == 0
);
}
public void shutdown() {
cleanupExecutor.shutdown();
}
}
4. 分布式限流器
import redis.clients.jedis.*;
import java.util.concurrent.*;
import java.util.logging.*;
public class DistributedRateLimiter {
private static final Logger logger = Logger.getLogger(DistributedRateLimiter.class.getName());
private final JedisPool jedisPool;
private final int maxRequestsPerSecond;
private final int maxRequestsPerIpPerSecond;
public DistributedRateLimiter(String redisHost, int redisPort,
int maxRequestsPerSecond,
int maxRequestsPerIpPerSecond) {
JedisPoolConfig config = new JedisPoolConfig();
config.setMaxTotal(100);
config.setMaxIdle(50);
config.setMinIdle(10);
config.setTestOnBorrow(true);
config.setTestWhileIdle(true);
config.setTimeBetweenEvictionRunsMillis(30000);
config.setMinEvictableIdleTimeMillis(60000);
this.jedisPool = new JedisPool(config, redisHost, redisPort, 2000, 2000);
this.maxRequestsPerSecond = maxRequestsPerSecond;
this.maxRequestsPerIpPerSecond = maxRequestsPerIpPerSecond;
}
public boolean tryAcquire(String clientIp) {
try (Jedis jedis = jedisPool.getResource()) {
// 检查全局限流
String globalKey = "rate_limit:global";
if (!checkRateLimit(jedis, globalKey, maxRequestsPerSecond)) {
return false;
}
// 检查IP级别限流
String ipKey = "rate_limit:ip:" + clientIp;
return checkRateLimit(jedis, ipKey, maxRequestsPerIpPerSecond);
}
}
private boolean checkRateLimit(Jedis jedis, String key, int maxRequests) {
long currentTime = System.currentTimeMillis();
long windowStart = currentTime - 1000;
Transaction tx = jedis.multi();
// 清理过期记录
tx.zremrangeByScore(key, 0, windowStart);
// 添加当前请求
tx.zadd(key, currentTime, String.valueOf(currentTime));
// 设置过期时间
tx.expire(key, 2);
// 获取窗口内的请求数
Response<Long> count = tx.zcard(key);
tx.exec();
return count.get() <= maxRequests;
}
public void shutdown() {
jedisPool.close();
}
}
// 混合限流器：Redis挂了自动降级到本地
public class HybridRateLimiter {
private static final Logger logger = Logger.getLogger(HybridRateLimiter.class.getName());
private final DistributedRateLimiter distributedLimiter;
private final RateLimiter localLimiter;
private volatile boolean useDistributed = true;
public HybridRateLimiter(DistributedRateLimiter distributedLimiter,
RateLimiter localLimiter) {
this.distributedLimiter = distributedLimiter;
this.localLimiter = localLimiter;
}
public boolean tryAcquire(String clientIp) {
if (useDistributed) {
try {
return distributedLimiter.tryAcquire(clientIp);
} catch (Exception e) {
logger.warning("Redis不可用，降级到本地限流: " + e.getMessage());
useDistributed = false;
scheduleRedisCheck();
}
}
return localLimiter.tryAcquire(clientIp);
}
private void scheduleRedisCheck() {
CompletableFuture.delayedExecutor(30, TimeUnit.SECONDS)
.execute(() -> {
useDistributed = true;
logger.info("尝试恢复Redis限流");
});
}
}
5. 本地限流器
import java.util.concurrent.*;
import java.util.concurrent.atomic.*;
import java.util.logging.*;
public class RateLimiter {
private static final Logger logger = Logger.getLogger(RateLimiter.class.getName());
private final long capacity;
private final double refillRate;
private final AtomicLong tokens;
private final AtomicLong lastRefillTime;
private final ConcurrentHashMap<String, ClientRateLimit> clientLimits;
public RateLimiter(long capacity, double refillRatePerSecond) {
this.capacity = capacity;
this.refillRate = refillRatePerSecond;
this.tokens = new AtomicLong(capacity);
this.lastRefillTime = new AtomicLong(System.nanoTime());
this.clientLimits = new ConcurrentHashMap<>();
}
public boolean tryAcquire(String clientIp) {
// 每个IP单独限流
ClientRateLimit clientLimit = clientLimits.computeIfAbsent(
clientIp, k -> new ClientRateLimit(10, 2)
);
if (!clientLimit.tryAcquire()) {
return false;
}
// 全局限流
refillTokens();
return tokens.getAndUpdate(current ->
current > 0 ? current - 1 : current
) > 0;
}
private void refillTokens() {
long now = System.nanoTime();
long lastRefill = lastRefillTime.get();
long elapsedNanos = now - lastRefill;
if (elapsedNanos > TimeUnit.MILLISECONDS.toNanos(100) &&
lastRefillTime.compareAndSet(lastRefill, now)) {
double elapsedSeconds = elapsedNanos / 1_000_000_000.0;
long tokensToAdd = (long)(elapsedSeconds * refillRate);
if (tokensToAdd > 0) {
tokens.getAndUpdate(current ->
Math.min(capacity, current + tokensToAdd)
);
}
}
}
static class ClientRateLimit {
private final long capacity;
private final double refillRate;
private final AtomicLong tokens;
private final AtomicLong lastRefillTime;
ClientRateLimit(long capacity, double refillRatePerSecond) {
this.capacity = capacity;
this.refillRate = refillRatePerSecond;
this.tokens = new AtomicLong(capacity);
this.lastRefillTime = new AtomicLong(System.nanoTime());
}
boolean tryAcquire() {
refillTokens();
return tokens.getAndUpdate(current ->
current > 0 ? current - 1 : current
) > 0;
}
private void refillTokens() {
long now = System.nanoTime();
long lastRefill = lastRefillTime.get();
long elapsedNanos = now - lastRefill;
if (elapsedNanos > TimeUnit.MILLISECONDS.toNanos(100) &&
lastRefillTime.compareAndSet(lastRefill, now)) {
double elapsedSeconds = elapsedNanos / 1_000_000_000.0;
long tokensToAdd = (long)(elapsedSeconds * refillRate);
if (tokensToAdd > 0) {
tokens.getAndUpdate(current ->
Math.min(capacity, current + tokensToAdd)
);
}
}
}
}
}
6. IP 黑名单管理
import java.util.*;
import java.util.concurrent.*;
import java.time.*;
import java.util.logging.*;
public class IPBlacklist {
private static final Logger logger = Logger.getLogger(IPBlacklist.class.getName());
private final Set<String> permanentBlacklist = ConcurrentHashMap.newKeySet();
private final ConcurrentHashMap<String, Long> temporaryBlacklist = new ConcurrentHashMap<>();
private final ScheduledExecutorService cleanupExecutor;
public IPBlacklist() {
this.cleanupExecutor = Executors.newScheduledThreadPool(1);
cleanupExecutor.scheduleAtFixedRate(this::cleanupExpired, 1, 1, TimeUnit.MINUTES);
}
public void addToBlacklist(String ip, Duration duration) {
if (duration == null) {
permanentBlacklist.add(ip);
logger.warning("IP永久加入黑名单: " + ip);
} else {
temporaryBlacklist.put(ip, System.currentTimeMillis() + duration.toMillis());
logger.warning("IP临时加入黑名单: " + ip + ", 时长: " + duration);
}
}
public boolean isBlacklisted(String ip) {
if (permanentBlacklist.contains(ip)) {
return true;
}
Long expiry = temporaryBlacklist.get(ip);
if (expiry != null) {
if (System.currentTimeMillis() < expiry) {
return true;
} else {
temporaryBlacklist.remove(ip);
}
}
return false;
}
private void cleanupExpired() {
long now = System.currentTimeMillis();
temporaryBlacklist.entrySet().removeIf(entry -> entry.getValue() < now);
}
public void removeFromBlacklist(String ip) {
permanentBlacklist.remove(ip);
temporaryBlacklist.remove(ip);
logger.info("IP从黑名单移除: " + ip);
}
public Set<String> getBlacklistedIPs() {
Set<String> result = new HashSet<>(permanentBlacklist);
result.addAll(temporaryBlacklist.keySet());
return result;
}
public void shutdown() {
cleanupExecutor.shutdown();
}
}
7. 异常行为检测器
import java.util.concurrent.*;
import java.util.concurrent.atomic.*;
import java.time.*;
import java.util.logging.*;
public class AnomalyDetector {
private static final Logger logger = Logger.getLogger(AnomalyDetector.class.getName());
private final ConcurrentHashMap<String, ConnectionMetrics> metricsMap;
private final ScheduledExecutorService scheduler;
private final int suspiciousThreshold;
private final IPBlacklist blacklist;
public AnomalyDetector(int suspiciousThreshold, IPBlacklist blacklist) {
this.metricsMap = new ConcurrentHashMap<>();
this.suspiciousThreshold = suspiciousThreshold;
this.blacklist = blacklist;
this.scheduler = Executors.newScheduledThreadPool(1);
scheduler.scheduleAtFixedRate(this::cleanup, 1, 1, TimeUnit.MINUTES);
}
public boolean isSuspicious(String clientIp) {
if (blacklist.isBlacklisted(clientIp)) {
return true;
}
ConnectionMetrics metrics = metricsMap.computeIfAbsent(
clientIp, k -> new ConnectionMetrics()
);
metrics.recordConnection();
// 判断是否可疑
boolean suspicious = metrics.getIncompleteConnections() > suspiciousThreshold ||
metrics.getConnectionRate() > 10 ||
metrics.getIOExceptionRate() > 0.5;
if (suspicious) {
logger.warning(String.format("检测到可疑IP: %s, 未完成连接: %d, 连接速率: %.2f/s",
clientIp, metrics.getIncompleteConnections(), metrics.getConnectionRate()));
// 自动拉黑30分钟
blacklist.addToBlacklist(clientIp, Duration.ofMinutes(30));
}
return suspicious;
}
public void recordHandshakeComplete(String clientIp) {
ConnectionMetrics metrics = metricsMap.get(clientIp);
if (metrics != null) {
metrics.recordHandshakeComplete();
}
}
public void recordIOException(String clientIp) {
ConnectionMetrics metrics = metricsMap.get(clientIp);
if (metrics != null) {
metrics.recordIOException();
}
}
private void cleanup() {
Instant cutoff = Instant.now().minus(Duration.ofMinutes(5));
metricsMap.entrySet().removeIf(entry ->
entry.getValue().getLastActivity().isBefore(cutoff)
);
}
static class ConnectionMetrics {
private final AtomicInteger totalConnections = new AtomicInteger(0);
private final AtomicInteger completedHandshakes = new AtomicInteger(0);
private final AtomicInteger ioExceptions = new AtomicInteger(0);
private final AtomicLong lastActivityTime = new AtomicLong(System.currentTimeMillis());
private final AtomicLong firstConnectionTime = new AtomicLong(0);
void recordConnection() {
totalConnections.incrementAndGet();
lastActivityTime.set(System.currentTimeMillis());
firstConnectionTime.compareAndSet(0, System.currentTimeMillis());
}
void recordHandshakeComplete() {
completedHandshakes.incrementAndGet();
}
void recordIOException() {
ioExceptions.incrementAndGet();
}
int getIncompleteConnections() {
return totalConnections.get() - completedHandshakes.get();
}
double getConnectionRate() {
long duration = System.currentTimeMillis() - firstConnectionTime.get();
if (duration == 0) return 0;
return (double) totalConnections.get() / (duration / 1000.0);
}
double getIOExceptionRate() {
int total = totalConnections.get();
if (total == 0) return 0;
return (double) ioExceptions.get() / total;
}
Instant getLastActivity() {
return Instant.ofEpochMilli(lastActivityTime.get());
}
}
public void shutdown() {
scheduler.shutdown();
}
}
8. 高性能 NIO 服务器
import java.nio.*;
import java.nio.channels.*;
import java.net.*;
import java.io.IOException;
import java.util.*;
import java.util.concurrent.*;
import java.util.logging.*;
import java.time.Duration;
public class NIOSecureServer {
private static final Logger logger = Logger.getLogger(NIOSecureServer.class.getName());
private final int port;
private final Selector selector;
private final ServerSocketChannel serverChannel;
private final ConnectionLimiter connectionLimiter;
private final HybridRateLimiter rateLimiter;
private final IPBlacklist blacklist;
private final AnomalyDetector anomalyDetector;
private final ExecutorService workerPool;
private final MetricsCollector metricsCollector;
private volatile boolean running = true;
public NIOSecureServer(int port, MetricsCollector metricsCollector) throws IOException {
this.port = port;
this.metricsCollector = metricsCollector;
this.selector = Selector.open();
this.serverChannel = ServerSocketChannel.open();
this.serverChannel.bind(new InetSocketAddress(port));
this.serverChannel.configureBlocking(false);
this.serverChannel.register(selector, SelectionKey.OP_ACCEPT);
this.connectionLimiter = new ConnectionLimiter(
DefenseConfig.getMaxConnections(),
DefenseConfig.getMaxConnectionsPerIp()
);
// 初始化混合限流器
DistributedRateLimiter distributedLimiter = new DistributedRateLimiter(
"localhost", 6379,
DefenseConfig.getRateLimitCapacity(),
DefenseConfig.getMaxConnectionsPerIp()
);
RateLimiter localLimiter = new RateLimiter(
DefenseConfig.getRateLimitCapacity(),
DefenseConfig.getRateLimitRefillRate()
);
this.rateLimiter = new HybridRateLimiter(distributedLimiter, localLimiter);
this.blacklist = new IPBlacklist();
this.anomalyDetector = new AnomalyDetector(
DefenseConfig.getSuspiciousThreshold(), blacklist);
this.workerPool = Executors.newFixedThreadPool(
Runtime.getRuntime().availableProcessors() * 2
);
}
public void start() throws IOException {
logger.info("NIO服务器启动，端口：" + port);
while (running) {
selector.select(1000);
Set<SelectionKey> selectedKeys = selector.selectedKeys();
Iterator<SelectionKey> iter = selectedKeys.iterator();
while (iter.hasNext()) {
SelectionKey key = iter.next();
iter.remove();
try {
if (key.isAcceptable()) {
handleAccept(key);
} else if (key.isReadable()) {
handleRead(key);
}
} catch (Exception e) {
logger.severe("处理连接异常: " + e.getMessage());
key.cancel();
closeChannel(key.channel());
}
}
}
}
private void handleAccept(SelectionKey key) throws IOException {
ServerSocketChannel serverChannel = (ServerSocketChannel) key.channel();
SocketChannel clientChannel = serverChannel.accept();
if (clientChannel == null) return;
String clientIp = ((InetSocketAddress) clientChannel.getRemoteAddress())
.getAddress().getHostAddress();
metricsCollector.recordConnectionAttempt(clientIp);
if (!performDefenseChecks(clientIp, clientChannel)) {
return;
}
clientChannel.configureBlocking(false);
clientChannel.register(selector, SelectionKey.OP_READ,
new ClientContext(clientIp));
}
private boolean performDefenseChecks(String clientIp, SocketChannel channel)
throws IOException {
// 黑名单检查
if (blacklist.isBlacklisted(clientIp)) {
metricsCollector.recordConnectionRejection("blacklist", clientIp);
closeChannel(channel);
return false;
}
// 异常检测
if (anomalyDetector.isSuspicious(clientIp)) {
metricsCollector.recordConnectionRejection("suspicious", clientIp);
metricsCollector.recordAttackDetection("syn_flood", clientIp);
closeChannel(channel);
return false;
}
// 速率限制
if (!rateLimiter.tryAcquire(clientIp)) {
metricsCollector.recordConnectionRejection("rate_limit", clientIp);
closeChannel(channel);
return false;
}
// 连接数限制
Socket socket = channel.socket();
if (!connectionLimiter.acceptConnection(socket)) {
metricsCollector.recordConnectionRejection("connection_limit", clientIp);
return false;
}
return true;
}
private void handleRead(SelectionKey key) {
SocketChannel channel = (SocketChannel) key.channel();
ClientContext context = (ClientContext) key.attachment();
workerPool.submit(() -> {
long startTime = System.nanoTime();
try {
ByteBuffer buffer = ByteBuffer.allocate(1024);
int bytesRead = channel.read(buffer);
if (bytesRead > 0) {
buffer.flip();
processRequest(channel, buffer, context);
metricsCollector.recordRequestDuration(startTime, "process");
} else if (bytesRead < 0) {
closeConnection(key, channel);
}
} catch (IOException e) {
anomalyDetector.recordIOException(context.clientIp);
closeConnection(key, channel);
}
});
}
private void processRequest(SocketChannel channel, ByteBuffer buffer,
ClientContext context) throws IOException {
byte[] data = new byte[buffer.remaining()];
buffer.get(data);
String request = new String(data);
// 验证请求合法性
SecurityEnhancements.InputValidator.ValidationResult validation =
SecurityEnhancements.InputValidator.validate(request);
if (!validation.valid) {
logger.warning("检测到恶意请求，IP: " + context.clientIp + ", 原因: " + validation.reason);
blacklist.addToBlacklist(context.clientIp, Duration.ofHours(1));
closeChannel(channel);
return;
}
// 记录握手完成
anomalyDetector.recordHandshakeComplete(context.clientIp);
// 简单回显
String response = "Echo: " + request;
ByteBuffer responseBuffer = ByteBuffer.wrap(response.getBytes());
channel.write(responseBuffer);
}
private void closeConnection(SelectionKey key, SocketChannel channel) {
key.cancel();
ClientContext context = (ClientContext) key.attachment();
if (context != null && channel.socket() != null) {
connectionLimiter.releaseConnection(channel.socket());
}
closeChannel(channel);
}
private void closeChannel(Channel channel) {
try {
if (channel != null && channel.isOpen()) {
channel.close();
}
} catch (IOException e) {
// 忽略关闭异常
}
}
public ConnectionLimiter getConnectionLimiter() {
return connectionLimiter;
}
public void stop() {
running = false;
workerPool.shutdown();
connectionLimiter.shutdown();
blacklist.shutdown();
anomalyDetector.shutdown();
try {
selector.close();
serverChannel.close();
} catch (IOException e) {
logger.severe("关闭服务器异常: " + e.getMessage());
}
}
static class ClientContext {
final String clientIp;
final long connectTime;
ClientContext(String clientIp) {
this.clientIp = clientIp;
this.connectTime = System.currentTimeMillis();
}
}
}
9. 安全增强模块
import javax.net.ssl.*;
import java.security.*;
import java.security.cert.*;
import javax.crypto.*;
import javax.crypto.spec.*;
import java.util.Base64;
import java.util.regex.Pattern;
import java.io.FileInputStream;
import java.util.logging.*;
public class SecurityEnhancements {
private static final Logger logger = Logger.getLogger(SecurityEnhancements.class.getName());
private static final String HMAC_ALGORITHM = "HmacSHA256";
private final SecretKey hmacKey;
public SecurityEnhancements(String secretKey) {
this.hmacKey = new SecretKeySpec(secretKey.getBytes(), HMAC_ALGORITHM);
}
// 验证请求签名，防止伪造
public boolean verifyRequestSignature(String request, String signature,
String timestamp) {
try {
// 检查时间戳，5分钟内有效
long requestTime = Long.parseLong(timestamp);
long currentTime = System.currentTimeMillis();
if (Math.abs(currentTime - requestTime) > 300000) {
return false;
}
// 计算签名
Mac mac = Mac.getInstance(HMAC_ALGORITHM);
mac.init(hmacKey);
String data = request + timestamp;
byte[] hmacBytes = mac.doFinal(data.getBytes());
String calculatedSignature = Base64.getEncoder().encodeToString(hmacBytes);
return calculatedSignature.equals(signature);
} catch (Exception e) {
logger.warning("签名验证失败: " + e.getMessage());
return false;
}
}
// 创建SSL服务器
public static SSLServerSocket createSSLServerSocket(int port,
String keystorePath,
String keystorePassword)
throws Exception {
KeyStore keyStore = KeyStore.getInstance("JKS");
try (FileInputStream fis = new FileInputStream(keystorePath)) {
keyStore.load(fis, keystorePassword.toCharArray());
}
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(keyStore, keystorePassword.toCharArray());
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
tmf.init(keyStore);
SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(),
new SecureRandom());
SSLServerSocketFactory factory = sslContext.getServerSocketFactory();
SSLServerSocket serverSocket = (SSLServerSocket) factory.createServerSocket(port);
// 只允许安全的协议和加密套件
serverSocket.setEnabledProtocols(new String[]{"TLSv1.2", "TLSv1.3"});
serverSocket.setEnabledCipherSuites(new String[]{
"TLS_AES_128_GCM_SHA256",
"TLS_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
});
return serverSocket;
}
// 输入验证器
public static class InputValidator {
private static final int MAX_REQUEST_SIZE = 4096;
private static final Pattern SQL_INJECTION_PATTERN = Pattern.compile(
"(?i).*(union|select|insert|update|delete|drop|create|alter|exec|script).*"
);
private static final Pattern XSS_PATTERN = Pattern.compile(
"(?i).*(<script|javascript:|onerror|onload|onclick).*"
);
public static ValidationResult validate(String input) {
if (input == null || input.isEmpty()) {
return ValidationResult.invalid("空请求");
}
if (input.length() > MAX_REQUEST_SIZE) {
return ValidationResult.invalid("请求过大");
}
if (SQL_INJECTION_PATTERN.matcher(input).matches()) {
return ValidationResult.invalid("检测到SQL注入");
}
if (XSS_PATTERN.matcher(input).matches()) {
return ValidationResult.invalid("检测到XSS攻击");
}
return ValidationResult.valid();
}
static class ValidationResult {
final boolean valid;
final String reason;
private ValidationResult(boolean valid, String reason) {
this.valid = valid;
this.reason = reason;
}
static ValidationResult valid() {
return new ValidationResult(true, null);
}
static ValidationResult invalid(String reason) {
return new ValidationResult(false, reason);
}
}
}
}
10. 监控指标收集器
实时监控系统状态，及时发现异常：
import io.micrometer.core.instrument.*;
import io.micrometer.core.instrument.binder.jvm.*;
import io.micrometer.core.instrument.binder.system.ProcessorMetrics;
import io.micrometer.prometheus.*;
import io.prometheus.client.exporter.HTTPServer;
import java.io.IOException;
import java.util.concurrent.TimeUnit;
import java.util.logging.*;
public class MetricsCollector {
private static final Logger logger = Logger.getLogger(MetricsCollector.class.getName());
private final MeterRegistry registry;
private final Counter connectionAttempts;
private final Counter connectionRejections;
private final Timer requestDuration;
private final Counter attackDetections;
private ConnectionLimiter connectionLimiter;
public MetricsCollector() {
this.registry = new PrometheusMeterRegistry(PrometheusConfig.DEFAULT);
// 注册JVM指标
new JvmGcMetrics().bindTo(registry);
new JvmMemoryMetrics().bindTo(registry);
new JvmThreadMetrics().bindTo(registry);
new ProcessorMetrics().bindTo(registry);
// 自定义指标
this.connectionAttempts = Counter.builder("connection.attempts")
.description("总连接尝试数")
.register(registry);
this.connectionRejections = Counter.builder("connection.rejections")
.description("拒绝的连接数")
.tag("reason", "unknown")
.register(registry);
this.requestDuration = Timer.builder("request.duration")
.description("请求处理时间")
.publishPercentiles(0.5, 0.95, 0.99)
.register(registry);
this.attackDetections = Counter.builder("attack.detections")
.description("检测到的攻击次数")
.tag("type", "syn_flood")
.register(registry);
}
public void setConnectionLimiter(ConnectionLimiter connectionLimiter) {
this.connectionLimiter = connectionLimiter;
// 注册活跃连接数指标
Gauge.builder("connections.active", connectionLimiter,
ConnectionLimiter::getCurrentConnections)
.description("当前活跃连接数")
.register(registry);
}
public void recordConnectionAttempt(String clientIp) {
connectionAttempts.increment();
Counter.builder("connection.attempts.by.ip")
.tag("ip", anonymizeIp(clientIp))
.register(registry)
.increment();
}
public void recordConnectionRejection(String reason, String clientIp) {
Counter.builder("connection.rejections")
.tag("reason", reason)
.tag("ip", anonymizeIp(clientIp))
.register(registry)
.increment();
}
public void recordRequestDuration(long startTime, String endpoint) {
requestDuration.record(System.nanoTime() - startTime, TimeUnit.NANOSECONDS);
}
public void recordAttackDetection(String attackType, String clientIp) {
Counter.builder("attack.detections")
.tag("type", attackType)
.tag("ip", anonymizeIp(clientIp))
.register(registry)
.increment();
}
private String anonymizeIp(String ip) {
// 保护隐私，只显示前两段
String[] parts = ip.split("\\.");
if (parts.length == 4) {
return parts[0] + "." + parts[1] + ".x.x";
}
return "unknown";
}
public void startHttpServer(int port) throws IOException {
HTTPServer server = new HTTPServer(port);
logger.info("Prometheus指标服务启动在端口: " + port);
}
public PrometheusMeterRegistry getRegistry() {
return (PrometheusMeterRegistry) registry;
}
}
11. 主程序入口
把所有组件组装起来，形成完整的防御系统：
import java.util.concurrent.*;
import java.util.logging.*;
import com.sun.net.httpserver.*;
import java.net.InetSocketAddress;
import java.io.IOException;
public class SynFloodDefenseApplication {
private static final Logger logger = Logger.getLogger(
SynFloodDefenseApplication.class.getName());
private final NIOSecureServer nioServer;
private final MetricsCollector metricsCollector;
private final ScheduledExecutorService scheduler;
private final HttpServer adminServer;
public SynFloodDefenseApplication() throws Exception {
// 加载并验证配置
DefenseConfig.loadConfig();
DefenseConfig.validate();
// 初始化监控
this.metricsCollector = new MetricsCollector();
// 初始化NIO服务器
this.nioServer = new NIOSecureServer(DefenseConfig.getServerPort(), metricsCollector);
// 设置连接限制器到监控系统
metricsCollector.setConnectionLimiter(nioServer.getConnectionLimiter());
// 初始化调度器
this.scheduler = Executors.newScheduledThreadPool(2);
// 初始化管理接口
this.adminServer = HttpServer.create(
new InetSocketAddress(DefenseConfig.getAdminPort()), 0);
setupAdminEndpoints();
}
private void setupAdminEndpoints() {
// 健康检查
adminServer.createContext("/health", exchange -> {
String response = "{\"status\":\"UP\",\"timestamp\":" +
System.currentTimeMillis() + "}";
exchange.getResponseHeaders().set("Content-Type", "application/json");
exchange.sendResponseHeaders(200, response.length());
try (var os = exchange.getResponseBody()) {
os.write(response.getBytes());
}
});
// 配置重载
adminServer.createContext("/admin/reload-config", exchange -> {
if (!"POST".equals(exchange.getRequestMethod())) {
exchange.sendResponseHeaders(405, -1);
return;
}
try {
DefenseConfig.loadConfig();
DefenseConfig.validate();
String response = "{\"status\":\"Config reloaded successfully\"}";
exchange.sendResponseHeaders(200, response.length());
try (var os = exchange.getResponseBody()) {
os.write(response.getBytes());
}
logger.info("配置重新加载成功");
} catch (Exception e) {
String error = "{\"error\":\"" + e.getMessage() + "\"}";
exchange.sendResponseHeaders(500, error.length());
try (var os = exchange.getResponseBody()) {
os.write(error.getBytes());
}
}
});
adminServer.setExecutor(Executors.newCachedThreadPool());
}
public void start() {
try {
printStartupInfo();
// 系统优化检查
SystemOptimizer.checkSystemConfig();
// 启动Prometheus
metricsCollector.startHttpServer(9090);
// 启动管理服务器
adminServer.start();
logger.info("管理接口启动在端口: " + DefenseConfig.getAdminPort());
// 启动定期任务
startScheduledTasks();
// 启动NIO服务器
Thread serverThread = new Thread(() -> {
try {
nioServer.start();
} catch (Exception e) {
logger.severe("NIO服务器启动失败: " + e.getMessage());
e.printStackTrace();
}
});
serverThread.setName("NIOServer-Main");
serverThread.start();
logger.info("SYN Flood防御系统启动完成");
// 注册关闭钩子
Runtime.getRuntime().addShutdownHook(new Thread(this::shutdown));
// 保持主线程运行
serverThread.join();
} catch (Exception e) {
logger.severe("启动失败: " + e.getMessage());
e.printStackTrace();
System.exit(1);
}
}
private void printStartupInfo() {
String banner = "\n" +
"███████╗██╗ ██╗███╗ ██╗ ███████╗██╗ ██████╗ ██████╗ ██████╗ \n" +
"██╔════╝╚██╗ ██╔╝████╗ ██║ ██╔════╝██║ ██╔═══██╗██╔═══██╗██╔══██╗\n" +
"███████╗ ╚████╔╝ ██╔██╗ ██║ █████╗ ██║ ██║ ██║██║ ██║██║ ██║\n" +
"╚════██║ ╚██╔╝ ██║╚██╗██║ ██╔══╝ ██║ ██║ ██║██║ ██║██║ ██║\n" +
"███████║ ██║ ██║ ╚████║ ██║ ███████╗╚██████╔╝╚██████╔╝██████╔╝\n" +
"╚══════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═╝ ╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝ \n" +
" DEFENSE SYSTEM v1.0 \n";
logger.info(banner);
logger.info("=== 系统信息 ===");
logger.info("操作系统: " + System.getProperty("os.name"));
logger.info("Java版本: " + System.getProperty("java.version"));
logger.info("可用处理器: " + Runtime.getRuntime().availableProcessors());
logger.info("最大内存: " + Runtime.getRuntime().maxMemory() / 1024 / 1024 + "MB");
logger.info("服务端口: " + DefenseConfig.getServerPort());
logger.info("管理端口: " + DefenseConfig.getAdminPort());
logger.info("监控端口: 9090");
}
private void startScheduledTasks() {
// 定期打印统计信息
scheduler.scheduleAtFixedRate(() -> {
try {
printStatistics();
} catch (Exception e) {
logger.warning("打印统计信息失败: " + e.getMessage());
}
}, 1, 1, TimeUnit.MINUTES);
// 定期检查系统健康
scheduler.scheduleAtFixedRate(() -> {
try {
checkSystemHealth();
} catch (Exception e) {
logger.warning("系统健康检查失败: " + e.getMessage());
}
}, 30, 30, TimeUnit.SECONDS);
}
private void printStatistics() {
logger.info("=== 运行统计 ===");
logger.info("活跃连接数: " + nioServer.getConnectionLimiter().getCurrentConnections());
logger.info("系统运行正常");
}
private void checkSystemHealth() {
Runtime runtime = Runtime.getRuntime();
long usedMemory = runtime.totalMemory() - runtime.freeMemory();
double memoryUsage = (double) usedMemory / runtime.maxMemory();
if (memoryUsage > 0.9) {
logger.warning("内存使用率过高: " +
String.format("%.2f%%", memoryUsage * 100));
}
int threadCount = Thread.activeCount();
if (threadCount > 1000) {
logger.warning("线程数过多: " + threadCount);
}
}
private void shutdown() {
logger.info("正在关闭SYN Flood防御系统...");
try {
nioServer.stop();
scheduler.shutdown();
scheduler.awaitTermination(5, TimeUnit.SECONDS);
adminServer.stop(0);
logger.info("系统已安全关闭");
} catch (Exception e) {
logger.severe("关闭过程中发生错误: " + e.getMessage());
}
}
public static void main(String[] args) {
try {
// 配置日志
LogManager.getLogManager().readConfiguration(
SynFloodDefenseApplication.class
.getResourceAsStream("/logging.properties"));
// 启动应用
SynFloodDefenseApplication app = new SynFloodDefenseApplication();
app.start();
} catch (Exception e) {
System.err.println("启动失败: " + e.getMessage());
e.printStackTrace();
System.exit(1);
}
}
}
配置文件示例
defense.properties
# 连接限制配置
max.connections=1000
max.connections.per.ip=10
# 速率限制配置
rate.limit.capacity=100
rate.limit.refill.rate=50
# 异常检测配置
suspicious.threshold=5
# 服务器配置
server.port=8080
admin.port=8081
socket.timeout=30000
logging.properties
# 日志配置
handlers=java.util.logging.ConsoleHandler,java.util.logging.FileHandler
# 默认日志级别
.level=INFO
# 控制台处理器
java.util.logging.ConsoleHandler.level=INFO
java.util.logging.ConsoleHandler.formatter=java.util.logging.SimpleFormatter
java.util.logging.SimpleFormatter.format=%1$tY-%1$tm-%1$td %1$tH:%1$tM:%1$tS %4$s %2$s %5$s%6$s%n
# 文件处理器
java.util.logging.FileHandler.level=ALL
java.util.logging.FileHandler.pattern=logs/application.log
java.util.logging.FileHandler.limit=10485760
java.util.logging.FileHandler.count=10
java.util.logging.FileHandler.formatter=java.util.logging.SimpleFormatter
java.util.logging.FileHandler.append=true
# 特定包的日志级别
com.defense.level=FINE
pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.defense</groupId>
<artifactId>syn-flood-defense</artifactId>
<version>1.0.0</version>
<properties>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<dependencies>
<!-- Redis客户端 -->
<dependency>
<groupId>redis.clients</groupId>
<artifactId>jedis</artifactId>
<version>4.3.1</version>
</dependency>
<!-- Prometheus监控 -->
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-registry-prometheus</artifactId>
<version>1.10.5</version>
</dependency>
<!-- 测试框架 -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.2</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
<artifactId>mockito-core</artifactId>
<version>5.1.1</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.11.0</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<version>3.5.0</version>
<executions>
<execution>
<id>copy-dependencies</id>
<phase>package</phase>
<goals>
<goal>copy-dependencies</goal>
</goals>
<configuration>
<outputDirectory>${project.build.directory}/lib</outputDirectory>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
测试用例
import org.junit.*;
import org.mockito.*;
import static org.mockito.Mockito.*;
import static org.junit.Assert.*;
import java.net.*;
import java.util.concurrent.*;
import java.time.*;
public class DefenseSystemTest {
@Mock
private Socket mockSocket;
@Mock
private InetAddress mockAddress;
private ConnectionLimiter connectionLimiter;
private RateLimiter rateLimiter;
private IPBlacklist blacklist;
@Before
public void setUp() {
MockitoAnnotations.initMocks(this);
connectionLimiter = new ConnectionLimiter(100, 5);
rateLimiter = new RateLimiter(10, 5);
blacklist = new IPBlacklist();
// 配置mock
when(mockAddress.getHostAddress()).thenReturn("192.168.1.100");
when(mockSocket.getInetAddress()).thenReturn(mockAddress);
when(mockSocket.isClosed()).thenReturn(false);
}
@Test
public void testRateLimiterAccuracy() throws InterruptedException {
String testIp = "192.168.1.100";
int successCount = 0;
// 消耗初始令牌
for (int i = 0; i < 10; i++) {
assertTrue(rateLimiter.tryAcquire(testIp));
}
assertFalse(rateLimiter.tryAcquire(testIp));
// 等待补充
Thread.sleep(1100);
// 应该补充了约5个令牌
for (int i = 0; i < 10; i++) {
if (rateLimiter.tryAcquire(testIp)) {
successCount++;
}
}
assertTrue(successCount >= 4 && successCount <= 6);
}
@Test
public void testBlacklistExpiration() throws InterruptedException {
String testIp = "192.168.1.100";
// 添加临时黑名单
blacklist.addToBlacklist(testIp, Duration.ofMillis(500));
assertTrue(blacklist.isBlacklisted(testIp));
// 等待过期
Thread.sleep(600);
assertFalse(blacklist.isBlacklisted(testIp));
}
@Test
public void testConnectionLimiterPerIP() throws Exception {
String testIp = "192.168.1.100";
// 测试单IP连接限制
for (int i = 0; i < 5; i++) {
Socket socket = mock(Socket.class);
InetAddress address = mock(InetAddress.class);
when(address.getHostAddress()).thenReturn(testIp);
when(socket.getInetAddress()).thenReturn(address);
when(socket.isClosed()).thenReturn(false);
assertTrue("第" + (i+1) + "个连接应该成功",
connectionLimiter.acceptConnection(socket));
}
// 第6个连接应该失败
Socket socket = mock(Socket.class);
InetAddress address = mock(InetAddress.class);
when(address.getHostAddress()).thenReturn(testIp);
when(socket.getInetAddress()).thenReturn(address);
when(socket.isClosed()).thenReturn(false);
assertFalse("第6个连接应该失败",
connectionLimiter.acceptConnection(socket));
// 验证socket被关闭
verify(socket).close();
}
@After
public void tearDown() {
connectionLimiter.shutdown();
blacklist.shutdown();
}
}
性能测试工具
import java.net.*;
import java.io.*;
import java.util.concurrent.*;
import java.util.concurrent.atomic.*;
import java.util.logging.*;
public class PerformanceTest {
private static final Logger logger = Logger.getLogger(PerformanceTest.class.getName());
public static void main(String[] args) throws Exception {
int threads = 100;
int requestsPerThread = 1000;
String targetHost = "localhost";
int targetPort = 8080;
ExecutorService executor = Executors.newFixedThreadPool(threads);
CountDownLatch startLatch = new CountDownLatch(1);
CountDownLatch endLatch = new CountDownLatch(threads);
AtomicInteger successCount = new AtomicInteger();
AtomicInteger failCount = new AtomicInteger();
AtomicLong totalLatency = new AtomicLong();
for (int i = 0; i < threads; i++) {
executor.submit(() -> {
try {
startLatch.await();
for (int j = 0; j < requestsPerThread; j++) {
long start = System.nanoTime();
try (Socket socket = new Socket(targetHost, targetPort)) {
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
BufferedReader in = new BufferedReader(
new InputStreamReader(socket.getInputStream()));
out.println("TEST");
String response = in.readLine();
if (response != null) {
successCount.incrementAndGet();
totalLatency.addAndGet(System.nanoTime() - start);
} else {
failCount.incrementAndGet();
}
} catch (Exception e) {
failCount.incrementAndGet();
}
}
} catch (Exception e) {
e.printStackTrace();
} finally {
endLatch.countDown();
}
});
}
logger.info("开始性能测试...");
long testStart = System.currentTimeMillis();
startLatch.countDown();
endLatch.await();
long testDuration = System.currentTimeMillis() - testStart;
logger.info("=== 测试结果 ===");
logger.info(String.format("总请求数: %d", threads * requestsPerThread));
logger.info(String.format("成功: %d", successCount.get()));
logger.info(String.format("失败: %d", failCount.get()));
logger.info(String.format("总耗时: %.2f秒", testDuration / 1000.0));
logger.info(String.format("吞吐量: %.2f req/s",
successCount.get() / (testDuration / 1000.0)));
logger.info(String.format("平均延迟: %.2f ms",
totalLatency.get() / successCount.get() / 1_000_000.0));
executor.shutdown();
}
}
容器化部署
Dockerfile
# 构建阶段
FROM maven:3.8-openjdk-11 AS builder
WORKDIR /app
COPY pom.xml .
COPY src ./src
RUN mvn clean package -DskipTests
# 运行阶段
FROM openjdk:11-jre-slim
WORKDIR /app
# 安装必要工具
RUN apt-get update && apt-get install -y \
curl \
netcat \
&& rm -rf /var/lib/apt/lists/*
# 复制打包好的文件
COPY --from=builder /app/target/syn-flood-defense.jar .
COPY --from=builder /app/target/lib ./lib
# 复制配置文件
COPY config/defense.properties ./config/
# 创建非root用户
RUN groupadd -r appuser && useradd -r -g appuser appuser
RUN chown -R appuser:appuser /app
USER appuser
# JVM优化参数
ENV JAVA_OPTS="-XX:+UseG1GC \
-XX:MaxGCPauseMillis=100 \
-XX:+UseStringDeduplication \
-XX:+ParallelRefProcEnabled \
-XX:MaxRAMPercentage=75.0 \
-XX:+ExitOnOutOfMemoryError \
-XX:+HeapDumpOnOutOfMemoryError \
-XX:HeapDumpPath=/tmp/heapdump.hprof"
# 暴露端口
EXPOSE 8080 8081 9090
# 健康检查
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
CMD curl -f http://localhost:8081/health || exit 1
# 启动命令
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar syn-flood-defense.jar"]
Kubernetes 部署配置
apiVersion: apps/v1
kind: Deployment
metadata:
name: syn-flood-defense
spec:
replicas: 3
selector:
matchLabels:
app: syn-flood-defense
template:
metadata:
labels:
app: syn-flood-defense
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "9090"
prometheus.io/path: "/metrics"
spec:
containers:
- name: app
image: syn-flood-defense:latest
ports:
- containerPort: 8080
name: service
- containerPort: 8081
name: admin
- containerPort: 9090
name: metrics
env:
- name: DEFENSE_MAX_CONNECTIONS
value: "2000"
- name: REDIS_HOST
value: redis-service
resources:
requests:
memory: "1Gi"
cpu: "500m"
limits:
memory: "2Gi"
cpu: "1000m"
livenessProbe:
httpGet:
path: /health
port: 8081
initialDelaySeconds: 30
periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
name: syn-flood-defense-service
spec:
selector:
app: syn-flood-defense
ports:
- port: 8080
targetPort: 8080
name: service
type: LoadBalancer
---
apiVersion: v1
kind: ConfigMap
metadata:
name: defense-config
data:
defense.properties: |
max.connections=2000
max.connections.per.ip=20
rate.limit.capacity=200
rate.limit.refill.rate=100
suspicious.threshold=10
server.port=8080
socket.timeout=30000
部署运维
快速部署脚本
#!/bin/bash
# deploy.sh - 一键部署脚本
echo "开始部署SYN Flood防御系统..."
# 检查环境
check_environment() {
echo "检查部署环境..."
# 检查Java
if ! command -v java &> /dev/null; then
echo "错误: 未安装Java"
exit 1
fi
# 检查Docker
if ! command -v docker &> /dev/null; then
echo "警告: 未安装Docker，跳过容器化部署"
fi
echo "环境检查通过"
}
# 创建应用用户
create_app_user() {
if ! id "appuser" &>/dev/null; then
echo "创建应用用户..."
sudo useradd -r -s /bin/false appuser
fi
}
# 优化系统参数
optimize_system() {
echo "优化系统参数..."
# 备份原配置
sudo cp /etc/sysctl.conf /etc/sysctl.conf.backup
# 应用优化
cat << EOF | sudo tee -a /etc/sysctl.conf
# SYN Flood Defense
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2
net.core.somaxconn = 65535
EOF
sudo sysctl -p
echo "系统优化完成"
}
# 部署应用
deploy_application() {
echo "部署应用..."
# 创建目录
sudo mkdir -p /opt/syn-flood-defense/{config,logs}
# 复制文件
sudo cp target/syn-flood-defense.jar /opt/syn-flood-defense/
sudo cp config/* /opt/syn-flood-defense/config/
# 设置权限
sudo chown -R appuser:appuser /opt/syn-flood-defense
# 创建systemd服务
cat << EOF | sudo tee /etc/systemd/system/syn-flood-defense.service
[Unit]
Description=SYN Flood Defense System
After=network.target
[Service]
Type=simple
User=appuser
WorkingDirectory=/opt/syn-flood-defense
ExecStart=/usr/bin/java -jar syn-flood-defense.jar
Restart=on-failure
RestartSec=10
[Install]
WantedBy=multi-user.target
EOF
# 启动服务
sudo systemctl daemon-reload
sudo systemctl enable syn-flood-defense
sudo systemctl start syn-flood-defense
echo "应用部署完成"
}
# 执行部署
check_environment
create_app_user
optimize_system
deploy_application
echo "部署完成！"
echo "服务状态: sudo systemctl status syn-flood-defense"
echo "查看日志: sudo journalctl -u syn-flood-defense -f"
Prometheus 告警规则
# prometheus-alerts.yml
groups:
- name: syn_flood_alerts
rules:
- alert: HighConnectionRejectionRate
expr: rate(connection_rejections[1m]) > 100
for: 2m
labels:
severity: warning
annotations:
summary: "连接拒绝率过高"
description: "过去1分钟拒绝了 {{ $value }} 个连接"
- alert: PossibleSynFloodAttack
expr: rate(attack_detections{type="syn_flood"}[5m]) > 10
for: 1m
labels:
severity: critical
annotations:
summary: "检测到可能的SYN Flood攻击"
description: "5分钟内检测到 {{ $value }} 次攻击"
- alert: HighMemoryUsage
expr: jvm_memory_used_bytes{area="heap"} / jvm_memory_max_bytes{area="heap"} > 0.9
for: 5m
labels:
severity: warning
annotations:
summary: "JVM内存使用率过高"
description: "堆内存使用率超过90%"
总结
| 防御措施 | 实现方式 | 效果 | 适用场景 |
|---|---|---|---|
| 连接数限制 | Semaphore + ConcurrentHashMap | 防止资源耗尽 | 所有 TCP 服务 |
| 分布式限流 | Redis + 滑动窗口 | 支持集群部署 | 分布式系统 |
| 本地限流 | 令牌桶算法 | 平滑限流 | 单机应用 |
| IP 黑名单 | 永久/临时黑名单 | 快速阻断恶意 IP | 遭受持续攻击时 |
| 异常检测 | 行为模式分析 | 自动识别攻击 | 智能防御场景 |
| NIO 服务器 | Java NIO + 线程池 | 高并发处理 | 高性能要求 |
| SSL/TLS | TLSv1.3 加密 | 传输安全 | 敏感数据传输 |
| 输入验证 | 正则匹配 | 防止注入攻击 | Web 应用 |
| 监控告警 | Prometheus + Grafana | 实时监控 | 生产环境 |
| 系统优化 | 内核参数调整 | 提升抗压能力 | Linux 服务器 |
附录：API 文档
/**
* 管理接口API文档
*
* GET /health
* 健康检查接口
* 响应示例：
* {
* "status": "UP",
* "timestamp": 1234567890,
* "checks": {
* "redis": "UP",
* "memory": "OK",
* "connections": 150
* }
* }
*
* POST /admin/reload-config
* 重新加载配置文件
* 响应示例：
* {
* "status": "Config reloaded successfully"
* }
*
* GET /admin/blacklist
* 获取当前黑名单列表
* 响应示例：
* {
* "blacklist": [
* {"ip": "192.168.1.100", "type": "permanent"},
* {"ip": "192.168.1.101", "type": "temporary", "expiry": 1234567890}
* ]
* }
*
* POST /admin/blacklist
* 添加IP到黑名单
* 请求体：
* {
* "ip": "192.168.1.100",
* "duration": "30m" // 可选，不填则永久黑名单
* }
*
* DELETE /admin/blacklist/{ip}
* 从黑名单移除指定IP
*
* GET /metrics
* Prometheus监控指标
* 端口：9090
*/
故障排查
遇到问题时，按以下步骤排查：
1. 服务无法启动
# 检查端口占用
netstat -tlnp | grep -E '8080|8081|9090'
# 查看详细日志
tail -f /opt/syn-flood-defense/logs/application.log
# 检查配置文件
cat /opt/syn-flood-defense/config/defense.properties
2. 连接被大量拒绝
# 检查当前配置
curl http://localhost:8081/health
# 查看黑名单
curl http://localhost:8081/admin/blacklist
# 查看监控指标
curl http://localhost:9090/metrics | grep connection
3. 内存占用过高
# 生成堆转储
jmap -dump:format=b,file=heapdump.hprof $(pgrep -f syn-flood-defense)
# 查看线程状态
jstack $(pgrep -f syn-flood-defense) > threaddump.txt
# 查看GC日志
grep "Full GC" /opt/syn-flood-defense/logs/gc.log
4. Redis 连接失败
# 检查Redis状态
redis-cli ping
# 检查连接数
redis-cli info clients
# 测试连接
redis-cli -h localhost -p 6379
5. 性能问题排查
# CPU使用率
top -H -p $(pgrep -f syn-flood-defense)
# 网络连接数
ss -ant | grep :8080 | wc -l
# IO等待
iostat -x 1
性能调优建议
JVM 参数优化
# 生产环境推荐配置
JAVA_OPTS="-server \
-Xms4g \
-Xmx4g \
-XX:+UseG1GC \
-XX:MaxGCPauseMillis=100 \
-XX:+ParallelRefProcEnabled \
-XX:+UseStringDeduplication \
-XX:+DisableExplicitGC \
-XX:+AlwaysPreTouch \
-XX:+UnlockExperimentalVMOptions \
-XX:+UseNUMA \
-Djava.net.preferIPv4Stack=true \
-Dfile.encoding=UTF-8"
系统参数优化
# 网络优化
echo 'net.core.netdev_max_backlog = 5000' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_mem = 786432 1048576 26777216' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_rmem = 4096 87380 134217728' >> /etc/sysctl.conf
echo 'net.ipv4.tcp_wmem = 4096 65536 134217728' >> /etc/sysctl.conf
# 文件系统优化
echo 'fs.file-max = 2097152' >> /etc/sysctl.conf
echo 'fs.nr_open = 2097152' >> /etc/sysctl.conf
监控优化
# Grafana查询优化
- 使用recording rules减少查询压力
- 合理设置数据保留期
- 使用downsampling降低存储需求
常见问题解答
Q: 为什么选择 NIO 而不是 Netty？
A: NIO 已经能满足大部分场景需求，而且是 JDK 自带的，减少了外部依赖。如果需要更高性能，可以很容易地改造成 Netty 实现。
Q: Redis 挂了怎么办？
A: 系统会自动降级到本地限流，虽然在分布式环境下可能不够精确，但能保证服务可用。建议使用 Redis 集群提高可用性。
Q: 如何确定合适的限流阈值？
A: 先通过压测确定系统极限，然后设置为极限值的 70-80%。生产环境中根据实际情况动态调整。
Q: 黑名单会不会误伤正常用户？
A: 系统采用临时黑名单机制，默认 30 分钟后自动解除。同时提供了 API 可以手动移除误判的 IP。
Q: 能防御多大规模的攻击？
A: 单机能处理每秒数万个连接请求，具体取决于硬件配置。建议配合 CDN 和硬件防火墙使用。
