利用分治策略实现DDoS攻击路径标识题  

Implementation of DDoS Attack Path Labeling Using Divide-and-conquer Strategy

作　　者：翟继强[1] 唐远新[1] 叶飞[1] 谢怡宁[1] 

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《哈尔滨理工大学学报》2014年第5期76-82,共7页Journal of Harbin University of Science and Technology

基　　金：黑龙江省教育厅科学技术研究面上项目(12531121)

摘　　要：针对分布式拒绝服务(DDo S)攻击防御中的数据包标记溯源技术,基于分治策略提出用简单的递归关系分别表示攻击树构、攻击路径频率检测、数据包和路径关联这3个基本防御实现,使用单数据包带内路径标识符用于唯一的数据包和路径关联,而把攻击树构建及攻击路径频率作为独立的带外操作来处理.通过在真实网络拓扑环境下对网络流量和存储开销的测试,证明本方法可以高流量负荷下以很小的开销同时对大量受害主机的提供单一数据包回溯保证.Focusing on packet marking traceback technology in DDoS attack defense,a novel approach is proposed to represent three elementary defending implementations namely attack tree construction,attack path frequency detection and packet to path association as succinct recurrence relations based on divide-and-conquer strategy,which uses single packet in-band path identifiers for unique packet to path association while handles attack tree construction and attack path frequency detection as independent out-of-band processes.By testing and evaluating the network traffic and storage overhead on real-life Internet,the results show that this method realistically achieves single packet traceback guarantees with minimal overhead for a large number of victims under heavy traffic loads simultaneously.

关 键 词：DDOS 分治 IP溯源 包标记 攻击树 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]