防御分布式拒绝服务攻击的优化路径标识模型  

Optimal path identification to defend against DDoS attacks

作　　者：金光[1] 杨建刚[1] 李渊[2] 张会展[2] 

机构地区：[1]浙江大学计算机科学与技术学院,浙江杭州310027 [2]宁波大学信息科学与工程学院,浙江宁波315211

出　　处：《通信学报》2008年第9期46-53,共8页Journal on Communications

基　　金：浙江省自然科学基金资助项目(Y106023);宁波市自然科学基金资助项目(2006A610014)~~

摘　　要：为防御互联网拒绝服务攻击，路径标识（Pi）技术为快速区分和过滤攻击包提供了有效手段，基于此提出优化路径标识方案OPi，与已有方案中各路由器插入1或2位标记不同，路由器根据包的当前TTL值，推算已经过的距离，分别插入1～16位可变长标记，最大程度利用标记域空间。相比以往方案，尤其当攻击路径和合法路径严重混杂时，OPi区分程度更高。考虑到攻击包会随机产生TTL初值来扰乱OPi标识，进一步提出了OPi＋TTL的过滤方案。理论分析和基于大规模真实互联网拓扑的仿真实验表明，OPi的防御效果较理想。A novel packet marking scheme, optimal path identification （OPi）, was proposed to defend against DDoS attacks. Instead of using fixed 1 or 2 bit in previous schemes, in OPi a router deduces the traveling distance of an arrived packet by its TTL value and inserts a variable-length marking of 1-16 bit into the packet. The marking field is filled completely even the path is very short and the distinguishability is improved. OPi outperforms previous schemes, especially when attacker paths adjoin user paths seriously. To obtain better performance, an OPi＋TTL filtering strategy was proposed to frustrate attackers＇ tries with spoofed initial TrL values. Theoretical analyses and simulations with actual Internet topologies show OPi performs excellently.

关 键 词：互联网安全 分布式拒绝服务攻击 数据包标记 路径标识 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]