基于IPv6拒绝服务攻击和改进确定包算法研究  

Study of denial of service attack & improved deterministic packet marking scheme based on IPv6

作　　者：赵树枫[1] 

机构地区：[1]上海理工大学信息化办公室,上海200093

出　　处：《计算机应用研究》2012年第5期1914-1917,共4页Application Research of Computers

基　　金：国家自然科学基金资助项目(61170277);上海市教委科研创新重点资助项目(12zz137);上海市重点学科建设资助项目(S30504)

摘　　要：对IPv6下拒绝服务攻击进行了研究,并根据IPv6协议的特点,提出一种基于IPv6的MAC认证改进确定包标记(ADPM-v6)算法。ADPM-v6利用IPv6新特性,即逐跳选项和改进的MAC认证方法,有效解决了受控路由器修改标记的问题,能直接快速地追踪攻击源。同时分析验证了IPv6真实攻击环境的数据包大小分布,使得算法有效且更具有较强的实用性。理论分析和仿真实验结果表明,该算法在IPv6下大大缩短了重构时间,减少了重构计算量和误报率。This paper studied the DoS attacks under IPv6,and according to the new features of IPv6 protocol,proposed the ADPM-v6 scheme based on improved MAC-authentication.By using a new IPv6 feature hop-by-hop options and the improved MAC authentication method,the scheme could quickly locate the source of attacker.The scheme could prevent compromised router which could forge the marking effectively.Simultaneous,analysis of a real attack environment verifying IPv6 packet size distribution,made the algorithm have a strong practicality and more effective.The implementation and evaluation shows that the ADPM-v6 scheme can greatly reduce the reconstruction time and reduce the amount of reconstruction computing and false positive.

关 键 词：IPV6协议 IP追踪 分布式拒绝服务 确定包标记 MAC认证 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]