利用分治策略实现DDoS攻击路径标识题

针对分布式拒绝服务(DDo S)攻击防御中的数据包标记溯源技术,基于分治策略提出用简单的递归关系分别表示攻击树构、攻击路径频率检测、数据包和路径关联这3个基本防御实现,使用单数据包带内路径标识符用于唯一的数据包和路径关联,而把攻击树构建及攻击路径频率作为独立的带外操作来处理.通过在真实网络拓扑环境下对网络流量和存储开销的测试,证明本方法可以高流量负荷下以很小的开销同时对大量受害主机的提供单一数据包回溯保证.

Implementation of DDoS Attack Path Labeling Using Divide-and-conquer Strategy

Focusing on packet marking traceback technology in DDoS attack defense,a novel approach is proposed to represent three elementary defending implementations namely attack tree construction,attack path frequency detection and packet to path association as succinct recurrence relations based on divide-and-conquer strategy,which uses single packet in-band path identifiers for unique packet to path association while handles attack tree construction and attack path frequency detection as independent out-of-band processes.By testing and evaluating the network traffic and storage overhead on real-life Internet,the results show that this method realistically achieves single packet traceback guarantees with minimal overhead for a large number of victims under heavy traffic loads simultaneously.