Packet track and traceback mechanism against denial of service attacks  

作　　者：LI Li SHEN Su-bin 

机构地区：[1]Institute of Information Network Technology, Nanjing University of Posts and Telecommunications, Nanjing 210003, China

出　　处：《The Journal of China Universities of Posts and Telecommunications》2008年第3期51-58,共8页中国邮电高校学报（英文版）

基　　金：the National Natural Science Foundation of China (60273091);Blue Project in Nanjing University of Posts and Telecommunications (NY207118)

摘　　要：The denial of service attack is a main type of threat on the Internet today. On the basis of path identification （Pi） and Internet control message protocol （ICMP） traceback （iTrace） methods, a packet track and traceback mechanism is proposed, which features rapid response and high accuracy. In this scheme, routers apply packet marking scheme and send traceback messages, which enables the victim to design the path tree in peace time. During attack times the victim can trace attackers back within the path tree and perform rapid packet filtering using the marking in each packet. Traceback messages overcome Pi＇s limitation, wherein too much path information is lost in path identifiers; whereas path identifiers can be used to expedite the design of the path-tree, which reduces the high overhead in iTrace. Therefore, our scheme not only synthesizes the advantages but also compromises the disadvantages of the above two methods. Simulation results with NS-2 show the validity of our scheme.The denial of service attack is a main type of threat on the Internet today. On the basis of path identification （Pi） and Internet control message protocol （ICMP） traceback （iTrace） methods, a packet track and traceback mechanism is proposed, which features rapid response and high accuracy. In this scheme, routers apply packet marking scheme and send traceback messages, which enables the victim to design the path tree in peace time. During attack times the victim can trace attackers back within the path tree and perform rapid packet filtering using the marking in each packet. Traceback messages overcome Pi＇s limitation, wherein too much path information is lost in path identifiers; whereas path identifiers can be used to expedite the design of the path-tree, which reduces the high overhead in iTrace. Therefore, our scheme not only synthesizes the advantages but also compromises the disadvantages of the above two methods. Simulation results with NS-2 show the validity of our scheme.

关 键 词：denial of service （DoS） attack TRACEBACK packet marking Pi 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]