DOS攻击的逆向路径追踪算法研究

在当前 IP源地址可欺骗的情况下 ,准确、快速追踪攻击源是防范网络攻击尤其是 DOS攻击的关键 .本文给出了逆向路径追踪 DOS攻击的模型和评价指标 ,分析了已有算法的性能 .在此基础上 ,提出一种新的基于消息鉴别码的随机数据包标记算法 MPPM.在该算法中路由器随机标记转发的数据包 ,标记信息包括路由器自身及其下游路由器组成的边标记的分片以及 MAC值 ,DOS攻击的受害者利用 MAC把不同攻击数据包中的边标记分片重组以得到边标记及攻击路径 ,并可鉴别标记的真伪 .分析和模拟结果表明 ,该算法具有线性的计算复杂度 ,追踪速度快 ,误差较小 ,高效可行

Study of IP Tracebck Against DOS Attack

Tracing attacks back to their sources is important in internet security area especially against DOS attacks because of IP spoofing. After modeling the problem of IP traceback, this paper analyzes and evaluate previous related work. A new traceback algorithm MAC-based Probabilistic Packet Marking is then presented. In MPPM, Routers mark packets with fragments of the edge mark composed of two adjacent routers and its MAC. The victim of DOS attack links the fragments in different attack packets into edges according to MAC. The victim also can authenticate the edge marks by MAC. Both Analysis and simulation result indicate MPPM is efficient with linear complexity, fast convergence and robustness.