基于有序标记的IP包追踪方案  

An IP Traceback Scheme Based on Marking-in-Order

作　　者：曲海鹏[1] 冯登国[1] 苏璞睿[1] 

机构地区：[1]中国科学院软件研究所信息安全国家重点实验室

出　　处：《电子学报》2006年第1期173-176,共4页Acta Electronica Sinica

基　　金：国家自然科学基金(No.60273027);国家杰出青年基金(No.60025205);国家973重点基础研究发展规划项目(No.G1999035802)

摘　　要：包标记方案是一种针对DoS攻击提出的数据包追踪方案,由于其具有响应时间快、占用资源少的特点,近年来受到了研究者的广泛关注.但由于包标记方案标记过程的随机性,使得受害者进行路径重构时所需收到的数据包数目大大超过了进行重构所必需收到的最小数据包数目,从而导致重构误报率的提高和响应时间的增长.本文提出了一种基于有序标记的IP包追踪方案,该方案通过存储每个目标IP地址的标记状态,对包标记的分片进行有序发送,使得在DoS发生时,受害者重构路径所需收到的标记包的数目大大降低,从而提高了对DoS攻击的响应时间和追踪准确度.该算法的提出进一步提高了包标记方案在实际应用中的可行性.Packet Marking Scheme have been proposed for achieving traceback of DoS attacks, which has several advantages such as short responding time and small resource consuming. Since the randomicity of the packet marking procedure, the number of the packets needed by the victim in reconstructing is much more than the minimum number of packets required, therefore resulting in the increase of the rate of false positives and the responding time. In this paper, a marking-in-order scheme is proposed, which need less packets in reconstructing procedure because of marking the packets in order by storing every target IP＇s marking state in a hash table. The scheme is more practical for its high efficiency.

关 键 词：网络追踪 拒绝服务 DoS 分布式拒绝服务 DDOS 包标记 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]