一种部署于源-目的端供应商的包标记方案研究  

Research of the Packet Marking Scheme Based on Source and Destination-End ISP

作　　者：吕爱丽[1] 叶小涛[1] LV Ai-li, YE Xiao-tao （Modem Education Technology Center, Henan Polytechnic University, Jiaozuo 454010, China）

机构地区：[1]河南理工大学现代教育技术中心,河南焦作454010

出　　处：《电脑知识与技术》2009年第6期4132-4133,4144,共3页Computer Knowledge and Technology

摘　　要：提出了一个新的包标记方案，分别部署于源端和目的端供应商，主要用来描绘DDoS攻击流特征。这些特征对于受害者过滤攻击非常有效。在过滤方面，提出了一个比率控制方案，通过限制攻击流并保持合法数据流不受影响来有效保护受害者。在经济方面，提供更好的安全措施可以作为ISP对客户的增值服务，因此也就更有积极性来部署。In this paper, we propose new packet marking models. It based on source and destination-end ISP and used for characterizing DDoS attack streams. Such common characterization can be used to make filtering by the victim more effective. In terms of filtering, we propose a rate control scheme that protects destination domains by limiting the amount of traffic during an attack, while leaving a large percentage of legitimate traffic unaffected. On economic front, it offer enhanced security protection against such attacks as a value-added service to providers＇ customers, and hence offer positive incentives for them to deploy the proposed models.

关 键 词：分布式拒绝服务攻击 供应商 包标记 比率控制 

分 类 号：TP309[自动化与计算机技术—计算机系统结构;自动化与计算机技术—计算机科学与技术]