中国邮电高校学报(英文) ›› 2010, Vol. 17 ›› Issue (2): 116-121.doi: 10.1016/S1005-8885(09)60456-8

• Artificial Intelligence • 上一篇    下一篇

Topology-assisted deterministic packet marking for IP traceback

王小静,王潇茵,姚淑萍   

  1. 北京理工大学
  • 收稿日期:2009-03-25 修回日期:2010-01-22 出版日期:2010-04-30 发布日期:2010-06-01
  • 通讯作者: 王小静 E-mail:sunny4119@126.com
  • 基金资助:

    国家863高技术研究发展计划(2009AA01Z433);其他

IP追踪中基于拓扑辅助的确定性包标记

  • Received:2009-03-25 Revised:2010-01-22 Online:2010-04-30 Published:2010-06-01

摘要:

针对防御(分布式)拒绝服务攻击,提出一种新的用于IP追踪的确定包标记方案。该方案具有很好的可扩展性和高准确性。每个入口路由器预先计算它IP地址的哈希值,并将之拆成若干段,路由器随机选择其中一个段标记包。在追踪阶段,受害者接收到仅仅若干个标记包后,借助于上游路由器的拓扑图,受害者就可以识别可疑的入口路由器。在大规模分布式拒绝服务攻击下,还原一个路由器时,已有确定包标记方法需要几十个包且误报率高,而该方案克服了这些缺点。给出了理论分析,伪代码和实验结果,证明TDPM在应对大规模DDoS攻击是准确有效的

关键词:

确定包标记

Abstract:

A novel deterministic packet marking for IP traceback against Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks is presented, which features good scalability and high accuracy. In this scheme, an ingress router pre-calculates a hash of its IP address and splits the hash into several fragments. When marking a packet, the router randomly selects a fragment to mark into the packet. In the traceback stage the victim identifies the marked router with the help of the map of its upstream routers. Based on the map, the victim can identify a candidate ingress router after receiving only several marked packets. The scheme overcomes defects in previous deterministic packet marking schemes, wherein too much packets are required to recover a router and high false positive rate occurs in case of large-scale DDoS. Theoretical analysis, the pseudo code and experimental results are provided. The scheme is proved to be accurate and efficient and can handle large-scale DDoS attacks.

Key words:

deterministic packet marking (DPM)