实时IP反向追踪的研究方法  

Research Methods of Real-Time IP Traceback

作　　者：李强[1] 朱弘恣[1] 鞠九滨[1] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012

出　　处：《计算机科学》2004年第12期47-51,共5页Computer Science

基　　金：国家自然科学基金项目(No.90204014)

摘　　要：实时性对于在DoS或DDoS网络攻击中发送假源地址包的主机进行IP反向追踪非常重要。实时的IP反向追踪可在洪水源头处阻止攻击.是建立对网络攻击的网络范围的有效、快速、自动响应的基础。本文分析了IP反向追踪的模型和分类,在比较当前关于提高IP反向追踪实时性研究的基础上,针对其计算复杂性、路由器开销、误报率等,提出实时IP反向追踪需解决的关键问题。为了说明IP反向追踪实时性的重要性和可行性,建立了一个随机包标记算法测试环境。Real-time is very important to IP tracebacking hosts that send spoofed source address packets in DoS or DDoS attacks. The real-time IP traceback can be used to prevent attack near attacking sources and is the netwok-wide fundation of effective, rapid and automatic responding to network attacks. This paper analyzes the model and classification of IP traceback and presents several key problems concerning computing complexity, router overhead and false positive rate, based on the current research on improving real-time in IP traceback. To illustrate importance and feasibility of real-time IP traceback, we establish a PPM algorithm test environment.

关 键 词：实时性 网络攻击 IP 追踪 标记算法 发送 误报率 开销 路由器 测试环境 

分 类 号：TP393[自动化与计算机技术—计算机应用技术] TP309[自动化与计算机技术—计算机科学与技术]