大流量优先的实时IP随机包标记反向追踪

在现有IP随机包标记反向追踪算法实时性的研究基础上，分析了标记概率、推测路径需要的数据包数量和攻击路径距离的关系，提出一个大流量优先的实时IP随机包标记反向追踪方法LTFMS，利用路由器节点当前流量统计，受害者可在最短时间内推测出主要攻击路径。通过建立模拟测试环境实验分析，对于大规模DDoS攻击，该方法在相同时间内可比现有方法推测出更多的攻击路径。

Larger-traffic-first packet marking for real-time IP traceback

Based on the current research on improving real-time PPM algorithms in IP traceback, the relations among marking probability, traffic volume for constructing an attack path and the distance of the attacking path were analysed. And an approach of real-time IP tracebacking which deploys larger traffic first probabilistic packet marking scheme (LTFMS) was proposed. According to the statistics on the present traffic of routers, a victim could construct a major attacking path in minimum time. For large-scale DDoS attacks, by establishing a simulated test environment and experiment analysis, LTFMS can construct more attacking paths than the existing schemes within the same time.