CoMM:基于协作标记与缓解的实时IP反向追踪模型  

CoMM: Real-Time IP Traceback Model Based on Cooperative Marking and Mitigation

作　　者：李强[1] 朱弘恣[1] 张猛[1] 鞠九滨[1] 

机构地区：[1]吉林大学计算机科学与技术学院,吉林长春130012

出　　处：《小型微型计算机系统》2006年第5期769-773,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(90204014)资助

摘　　要：实时性对于在DoS或DDoS网络攻击中发送假源地址包的主机进行IP反向追踪非常重要.提出一个IP实时反向追踪的模型CoMM(CooperativeMarkingandMitigation),在受害者主动参与和自治网络协调员的帮助下推测攻击路径,局部推测的攻击路径可以帮助受害者推测的攻击路径进行验证,上游路由器采取限速方式减小攻击程度的同时保证合法用户流量的传输和受害者正常推测攻击路径的流量需要,并有效的降低路由器参加追踪的开销.Real-time is very important to IP tracebacking hosts that send spoofed source address packets in DoS or DDoS attacks. We propose a real-time IP traceback model based on cooperative marking and mitigation. In this model, with the cooperation of autonomous network coordinator, the victim constructs attacking paths actively. Local results sent to the victim by coordinators can valid attacking paths. By rate limiting, routers can mitigate attack degree, which ensures legitimate traffic transmission and the traffic amount for the victim to construct attacking paths. This model can decrease router＇s overhead for tracebacking effectively.

关 键 词：IP反向追踪 包标记 实时性 DDOS 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]