基于路由器流量分析的DDoS反向追踪  

DDoS traceback based on router traffic analysis

作　　者：张登银[1] 刘宇[1] 骆涛[1] 王汝传[1] 

机构地区：[1]南京邮电大学计算机学院,江苏南京210003

出　　处：《江苏大学学报（自然科学版）》2007年第6期516-519,共4页Journal of Jiangsu University：Natural Science Edition

基　　金：国家自然科学基金资助项目(60573141);国家863计划项目(2005AA775050);江苏省高技术研究发展计划项目(BG2005037)

摘　　要：提出了一种能够基于路由器流量分析的DDoS反向追踪方法.在DDoS攻击发生时,通过输入调试回溯到所有发往受害者流量的入口路由器,然后分析每个入口路由器流量中是否存在攻击流量,从而确定所有攻击流量入口路由器.文中给出了基于流量自相似的攻击流量检测算法,设计了基于蜜罐群的路由器攻击流量检测与追踪平台,并对该追踪方法进行了性能分析.结果表明,提出的反向追踪方法可以精确追踪到全部DDoS攻击流量的入口路由器.DDoS traceback approach based on router traffic analysis was proposed according to DDoS attack＇s traffic characteristic. After every access router sending traffic to victim was found out by input debugging process, access routers sending DDoS attack traffic are ascertained by traffic analysis. The DDoS attack traffic detection algorithm based on self-similarity was introduced, and a honeypots group platform was designed for traffic analysis and traceback. At last the capability of this traceback approach was analyzed. The result shows that the approach can trace back all the access routers sending DDoS attack traffic accurately.

关 键 词：拒绝服务攻击 反向追踪 蜜罐 自相似性 路由器 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]