大流量优先的实时IP随机包标记反向追踪  

Larger-traffic-first packet marking for real-time IP traceback

作　　者：李强[1] 朱弘恣[1] 鞠九滨[1] 

机构地区：[1]吉林大学计算机科学与技术学院,吉林长春130012

出　　处：《计算机应用》2005年第7期1498-1501,共4页journal of Computer Applications

基　　金：国家自然科学基金重大研究计划项目(90204014)

摘　　要：在现有IP随机包标记反向追踪算法实时性的研究基础上,分析了标记概率、推测路径需要的数据包数量和攻击路径距离的关系,提出一个大流量优先的实时IP随机包标记反向追踪方法LTFMS,利用路由器节点当前流量统计,受害者可在最短时间内推测出主要攻击路径。通过建立模拟测试环境实验分析,对于大规模DDoS攻击,该方法在相同时间内可比现有方法推测出更多的攻击路径。Based on the current research on improving real-time PPM algorithms in IP traceback, the relations among marking probability, traffic volume for constructing an attack path and the distance of the attacking path were analysed. And an approach of real-time IP tracebacking which deploys larger traffic first probabilistic packet marking scheme (LTFMS) was proposed. According to the statistics on the present traffic of routers, a victim could construct a major attacking path in minimum time. For large-scale DDoS attacks, by establishing a simulated test environment and experiment analysis, LTFMS can construct more attacking paths than the existing schemes within the same time.

关 键 词：IP反向追踪 包标记 实时性 DDOS 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]