基于矩阵边采样的IP追踪  

IP traceback with matrix edge sampling

作　　者：闫巧[1] 宁土文[2] 

机构地区：[1]深圳大学计算机与软件学院,深圳518060 [2]深圳大学信息工程学院,深圳518060

出　　处：《深圳大学学报（理工版）》2012年第5期399-404,共6页Journal of Shenzhen University(Science and Engineering)

基　　金：国家自然科学基金资助项目(60972011)~~

摘　　要：针对Savage概率包标记压缩边分片采样算法存在的不足,提出改进的压缩分片采样方法,即基于矩阵边采样的IP追踪方法 (IP traceback with matrix edge sampling,MES).通过1个二维单位矩阵对相邻路由进行边采样,降低重构算法复杂度;引入8 bit的多路径检验,降低重构路径误报率;采用自适应概率对数据包标记,使重构路径所需数据包数量减少.理论分析和在NS2环境下的实验仿真表明,MES方法的性能在上述3方面都有较大改善.The Internet protocol（IP） traceback with matrix edge sampling （MES） was proposed based on compressed edge fragment sampling algorithm of probabilistic packet marking （PPM）. The MES algorithm reduced the complexity of reconstruction algorithm by applying a two-dimensional matrix to the edge sampling between adjacent routes. Moreover, eight bits hash was employed to check the attack paths in order to reduce false alarm rate of reconstruction paths. The MES reduced the arnount of packets to reconstruct the path by using adaptive proba- bility for packet marking. Theoretical analysis and experimental simulation in NS2 environment have shown that the performance of new algorithm is improved on the amount of packets to reconstruct the path. The computational complexity of reconstruction and false alarm rate are also reduced efficiently.

关 键 词：数据安全 计算机安全 IP追踪 概率包标记 网络安全 拒绝服务攻击 分布式拒绝服务攻击 压缩边分片采样算法 自适应概率分片标记算法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术] TP393.08[自动化与计算机技术—计算机科学与技术]