Topology-assisted deterministic packet marking for IP traceback  

作　　者：WANG Xiao-jing WANG Xiao-yin 

机构地区：[1]Laboratory of Computer Network Defense Technology, Beijing Institute of Technology, Beijing 100081, China [2]Xi'an Politics Institute, Xi'an 710068, China

出　　处：《The Journal of China Universities of Posts and Telecommunications》2010年第2期116-121,共6页中国邮电高校学报（英文版）

基　　金：supported by the Hi-Tech Research and Development Program of China (2009AA01Z433)

摘　　要：A novel deterministic packet marking （DPM） for IP traceback against denial of service （DOS） and distributed denial of service （DDoS） attacks is presented, which features good scalability and high accuracy. In this scheme, an ingress router pre-calculates a Hash of its IP address and splits the Hash into several fragments. When marking a packet, the router randomly selects a fragment to mark into the packet. In the traceback stage the victim identifies the marked router with the help of the map of its upstream routers. Based on the map, the victim can identify a candidate ingress router after receiving only several marked packets. The scheme overcomes defects in previous deterministic packet marking schemes, where too much packets are required to recover a router and high false positive rate occurs in case of large-scale DDoS. Theoretical analysis, the pseudo code and experimental results are provided. The scheme is proved to be accurate and efficient and can handle large-scale DDoS attacks.A novel deterministic packet marking （DPM） for IP traceback against denial of service （DOS） and distributed denial of service （DDoS） attacks is presented, which features good scalability and high accuracy. In this scheme, an ingress router pre-calculates a Hash of its IP address and splits the Hash into several fragments. When marking a packet, the router randomly selects a fragment to mark into the packet. In the traceback stage the victim identifies the marked router with the help of the map of its upstream routers. Based on the map, the victim can identify a candidate ingress router after receiving only several marked packets. The scheme overcomes defects in previous deterministic packet marking schemes, where too much packets are required to recover a router and high false positive rate occurs in case of large-scale DDoS. Theoretical analysis, the pseudo code and experimental results are provided. The scheme is proved to be accurate and efficient and can handle large-scale DDoS attacks.

关 键 词：network security DDOS 1P traceback deterministic packet marking （DPM） 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP309[自动化与计算机技术—计算机科学与技术]