基于数据包标记的伪造IP DDoS攻击防御  

Packet Marking Scheme to Defend Against Spoofed IP DDoS Attack

作　　者：冯庆云[1] 曲海鹏[1] 周英[1] 郭忠文[1] 

机构地区：[1]中国海洋大学计算机系,青岛266100

出　　处：《计算机工程》2008年第19期141-143,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2006AA09Z113)

摘　　要：提出一种基于数据包标记的伪造IP DDoS攻击防御方案,该方案在IP数据包中嵌入一个路径相关的16位标识,通过检测标识计数器临界值判断是否发生了DDoS攻击,对伪造地址的IP数据包进行过滤,达到对DDoS攻击进行有效防御的目的。仿真实验表明,该方案对于伪造的IP数据包具有较高的识别率。A new packet marking scheme is proposed, in which a path identification that represents the route an IP packet has traversed is embedded in each IP packet. And a counter is set for each identification. It represents the number of different IP addresses that have the same identification. The onset of a spoofed DDoS attack can be detected by comparing the sum of the counters with a marginal value that has been set. Spoofed packet can be filtered so as to sustain the quality of protected Internet services. Experimental results show that the proposed scheme is efficient on identifying the spoofed DDoS attack packets.

关 键 词：分布式拒绝服务攻击 数据包标记 伪造IP 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]