一种改进的分片包标记IP追踪方案  

An improved scheme of IP traceback with fragment packet marking

作　　者：於时才[1] 黎扬[1] 邢雅琼[1] 

机构地区：[1]兰州理工大学计算机与通信学院,甘肃兰州730050

出　　处：《兰州理工大学学报》2011年第1期76-80,共5页Journal of Lanzhou University of Technology

基　　金：甘肃省自然科学基金(ZS031-A25-015-G)

摘　　要：针对Savage等人提出的分片包标记方案(fragment marking scheme,FMS)存在的不足,提出一种改进的分片包标记方案(IFMS).该方案通过扩大标记空间和采用动态标记概率的方法,减少了重构攻击路径所需的数据包数,降低了计算开销,同时采用40位Hash作为误差校验,显著降低了路径重构的误差率.理论分析与实验结果表明改进方案的性能更优,在应对分布式拒绝服务攻击(distributed denial of service,DDoS)时更加有效.Aimed at the inadequaey resident in the fragment marking scheme proposed by Savage et al.an improved fragment packet marking scheme（IFMS） was presented.By enlarging marking space and using dynamic probability of packet marking,the number of data packets required by the victim to reconstruct the attack path and the computational complexity were reduced.Meanwhile,40 parity-check bits generated by 2 different Hash functions were employed to reduce greatly the rate of false alarm during the process of path reconstruction.Theoretical analysis and experiments showed that it exhibited even better performance and its efficiency in dealing with DDos attack.

关 键 词：分片包标记 路径重构 分布式拒绝服务攻击 IP追踪 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]