一种无日志的快速DDoS攻击路径追踪算法  

A Logless Fast IP Traceback Scheme Against DDoS Attacks

作　　者：荆一楠[1] 王雪平[1] 肖晓春[1] 张根度[1] 

机构地区：[1]复旦大学计算机与信息技术系,上海200433

出　　处：《小型微型计算机系统》2007年第9期1537-1542,共6页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(60373021)资助

摘　　要：分布式拒绝服务攻击是目前Internet面临的主要威胁之一.攻击路径追踪技术能够在源地址欺骗的情况下追踪攻击来源,在DDoS攻击的防御中起到非常关键的作用.在各种追踪技术中随机包标记法具有较明显的优势,然而由于较低的标记信息利用率,追踪速度仍然不够快.为了提高追踪速度提出一种无日志的快速攻击路径追踪算法.该算法利用少量路由器存储空间和带内信息传输方式提高标记信息利用率,不仅大大提高了追踪速度,而且避免占用额外的网络带宽.Distributed denial-of-service attack is one of the major threats to Internet currently. IP traceback is a technique to trace back the attack sources in presence of IP spoofing,and plays a key role in defense for DDoS attacks. Compared with other IP traceback techniques,the probabiListie packet marking （PPM） scheme has more advantages. However,because of low marking information utilization,its traceback speed is still too slow. In order to traceback attackers as quickly as possible,a logless fast IP traceback （LFIT） scheme is proposed,which uses a few router storage space and in-band channel to improve the marking information utilization. Simulation results show that it has two distinct advantages,namely faster traceback speed and little router and network overhead.

关 键 词：分布式拒绝服务攻击 攻击路径追踪 随机包标记 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]