可动态扩展的高效单包溯源方法

由于能够隐藏攻击位置、避开攻击过滤、窃取用户隐私和增强攻击危害,IP匿名已被各类网络攻击广泛使用并造成极大的危害.为此,研究者们提出了IP溯源——一种能够在匿名攻击发生后揭露攻击主机身份的追踪技术.鉴于已有的IP溯源研究在面对大规模网络时存在扩展性差、处理开销大、拓扑隐私泄露等问题,提出了一种可动态扩展的高效单包溯源方法,简称SEE.该方法采用域间和域内相分离的层次化系统架构模型来弱化自治域之间的溯源联系、避免拓扑隐私泄露,并通过域内溯源网络构建、域内溯源地址分配、域内路径指纹建立和提取、域间反匿名联盟构建和域内到域间的平稳过渡等策略来改善系统的扩展性和处理开销.通过理论分析和基于大规模真实和人工互联网拓扑的仿真实验,结果表明,相对于以往方案,SEE在高效性和扩展性方面确实有了很大的改善.     

网络入侵追踪研究综述

Traceback system is a system for finding the hacker's real location on the network autonomously. It can be divided into two kinds: IP Packet Traceback system, and Connection Traceback system. The goal of IP Packet Traceback system is to traceback the Real Source that send the IP Address Spoofed packet,focused in the method that uses the intermediate routers. The Connection Traceback system traceback the Real Source of Detoured Intrusion,the detoured attack is an attack that is done via several systems. Because of more and more attackers emerging in recent years, the model that can apply to the current Internet should be developed,and Real-time traceback system is needed to actively defense the hacking.     

面向网络取证的网络攻击追踪溯源技术分析

首先定位网络攻击事件的源头,然后进行有效的电子数据证据的收集,是网络取证的任务之一.定位网络攻击事件源头需要使用网络攻击追踪溯源技术.然而,现有的网络攻击追踪溯源技术研究工作主要从防御的角度来展开,以通过定位攻击源及时阻断攻击为主要目标,较少会考虑到网络取证的要求,从而导致会在网络攻击追踪溯源过程中产生的大量有价值的数...     

基于合作过滤机制的ICMP回溯DDoS攻击源方法

提出一种改进的ICMP回溯方法。此方法是基于合作过滤机制的,采用合作过滤机制能够使产生的ICMP回溯包更有效并在尽可能靠近DDoS攻击源的地方过滤攻击包和保护合法包,改进后的ICMP方法对引发ITrace包的IP包从靠近攻击源的地方同步跟踪到受害者,提高了重构攻击路径的速度和准确性。     

Ant-based IP traceback

The denial-of-service (DoS) attacks with the source IP address spoofing techniques has become a major threat to the Internet. An intrusion detection system is often used to detect DoS attacks and to coordinate with the firewall to block them. However, DoS attack packets consume and may exhaust all the resources, causing degrading network performance or, even worse, network breakdown. A proactive approach to DoS attacks is allocating the original attack host(s) issuing the attacks and stopping the malicious traffic, instead of wasting resources on the attack traffic.

In this paper, an ant-based traceback approach is proposed to identify the DoS attack origin. Instead of creating a new type or function or processing a high volume of fine-grained data used by previous research, the proposed traceback approach uses flow level information to identify the origin of a DoS attack.

Two characteristics of ant algorithm, quick convergence and heuristic, are adopted in the proposed approach on finding the DoS attack path. Quick convergence efficiently finds out the origin of a DoS attack; heuristic gives the solution even though partial flow information is provided by the network.

The proposed method is evaluated through simulation on various network environments and two simulated real networks, NSFNET and DFN. The simulation results show that the proposed method can successfully and efficiently find the DoS attack path in various simulated network environments, with full and partial flow information provided by the networks.     

一种基于协同机制的攻击源追踪方法

为了在分布式网络追踪系统中协调监控代理,及时共享多点采集的追踪数据合作定位网络攻击源,提出一种基于协同机制的攻击源追踪方法。该方法设计了自适应协同聚生追踪协议,通过在各监控代理间交互查询消息来实现监控代理间的协同追踪和攻击路径重构。实验分析表明,该方法提高了追踪信息的有效聚生和攻击源定位的准确性。     

网络攻击追踪溯源层次分析

近年来, 为了有效防御网络攻击, 人们提出了网络攻击追踪溯源技术, 用于追踪定位攻击源头。网络安全系统能在确定攻击源的基础上采取隔离或者其他手段限制网络攻击, 将网络攻击的危害降到最低。由于攻击追踪溯源技术能够为网络防御提供更加准确攻击源、路径等信息, 使得防御方能够实施针对性的防护策略, 其相关技术及研究得到了越来越多的关注与发展。介绍了追踪溯源四层次划分, 重点分析追踪溯源各层次问题, 并就相应技术及追踪过程进行了深入讨论, 以期对追踪溯源有一个全面的描述, 提高对网络攻击追踪溯源的认识。     

移动IPv6中的攻击源追踪问题研究*

着重于移动IPv6架构下的攻击源追踪问题研究,给出了IPv6中新的包标记算法和包采样算法,并针对移动环境中不同的攻击模式提出了有针对性的攻击源追踪策略.该方法的结合使用可以有效降低移动IPv6中的攻击源追踪难度.     

移动IP环境下IP追踪的研究

针对DoS和DDoS攻击对移动IP环境下的IP追踪进行了详细的分析,给出了其各个功能实体受攻击时进行IP追踪的方法,并且在此基础上提出了一种新的ICMP消息来完善移动IP环境下IP追踪机制的方法。     

基于扩展头随机标记的IPv6攻击源追踪方案

针对IPv4网络环境下的随机包标记法不能直接应用于IPv6的问题,依据IPv6自身的特点提出了一种基于扩展报头随机标记的IPv6攻击源追踪方案。对IPv6报头进行分析研究,选取了合适的标记区域及编码格式,对PMTU算法进行了修改以更好地满足追踪的需要,采用攻击树生成算法重构攻击路径。理论分析与仿真实验结果表明,该方案能够有效地重构攻击路径,实现对IPv6攻击源的追踪。     

应对虚假数据注入结合途中过滤与溯源追踪方法

对无线传感器网络中的虚假数据注入攻击问题进行了深入研究,并提出了切实可行的解决方案。本方案结合了途中过滤与溯源追踪的优点,它的核心思想是在数据报告中添加部分标记信息,汇聚节点将没有通过验证的数据报告加入溯源追踪集合中,收集到足够多数据报告后,便可以进行溯源追踪操作。同时,我们提出了一种更加均衡的分组方法及概率标记方法,实现了更好的性能。     

Fast autonomous system traceback

Service-oriented computing (SOC) due to their distributed and lose coupled nature are very vulnerable to distributed denial of service (DDoS) attacks. IP spoofing makes it difficult for the victim to determine the packet's origin. There is a need for a mechanism that could enable real-time traceback of the origins of the attacks. In this paper, we propose a novel protocol, fast autonomous system traceback (FAST) to traceback to the attack originating autonomous systems (AS). The multifold advantages of FAST include reconstruction requires just around 5–10 packets and reconstruction takes just a few seconds. We validate the performance through extensive simulations over the datasets obtained from traceroute.     

Honeypot back-propagation for mitigating spoofing distributed Denial-of-Service attacks

The Denial-of-Service (DoS) attack is a challenging problem in the current Internet. Many schemes have been proposed to trace spoofed (forged) attack packets back to their sources. Among them, hop-by-hop schemes are less vulnerable to router compromise than packet marking schemes, but they require accurate attack signatures, high storage or bandwidth overhead, and cooperation of many ISPs.In this paper, we propose honeypot back-propagation, an efficient hop-by-hop traceback mechanism, in which accurate attack signatures are obtained by a novel leverage of the roaming honeypots scheme. The reception of attack packets by a roaming honeypot (a decoy machine camouflaged within a server pool) triggers the activation of a tree of honeypot sessions rooted at the honeypot under attack toward attack sources. The tree is formed hierarchically, first at Autonomous system (AS) level and then at router level. Honeypot back-propagation supports incremental deployment by providing incentives for ISPs even with partial deployment.Against low-rate attackers, most traceback schemes would take a long time to collect the needed number of packets. To address this problem, we also propose progressive back-propagation to handle low-rate attacks, such as on-off attacks with short bursts. Analytical and simulation results demonstrate the effectiveness of the proposed schemes under a variety of DDoS attack scenarios.     

基于IPv6的概率包标记路径溯源方案

针对现有IPv6路由追踪技术匮乏,以及IPv4路由追踪技术不能直接移植到IPv6网络环境中的问题,根据IPv6的自身特点,提出了一种基于概率包标记的IPv6攻击源追踪方案。该方案在原有IPv4概率包标记方法的基础上进行了有效的改进,重新规划标记区域,分别在IPv6的基本报头和扩展报头上划分合适的标识域和信息域,既解决标记空间不足的问题,又能规范标记信息的存放秩序;采用动态标记概率,区分对待未标记数据包和已标记数据包,解决标记信息覆盖问题,同时,优化标记算法,实现IPv6网络环境下路径追踪的快速、准确。理论分析与实验结果表明,该方案能有效追踪攻击源,且效果优于原IPv4追踪技术。     

可控网络攻击源追踪技术研究

提出一种新的基于网络入侵检测的攻击源追踪方法．给出了系统模型，深入分析了攻击链路集合构造和攻击链路上下游关系的确定方法，在此基础上提出攻击路径构造算法．实验结果表明，该系统能够在可控网络环境下实时、准确地对攻击源进行追踪．和已有方法相比，新的方法在实用性、追踪的准确性、系统的可扩展性等方面有明显提高．     

一种无日志的快速DDoS攻击路径追踪算法

分布式拒绝服务攻击是目前Internet面临的主要威胁之一.攻击路径追踪技术能够在源地址欺骗的情况下追踪攻击来源,在DDoS攻击的防御中起到非常关键的作用.在各种追踪技术中随机包标记法具有较明显的优势,然而由于较低的标记信息利用率,追踪速度仍然不够快.为了提高追踪速度提出一种无日志的快速攻击路径追踪算法.该算法利用少量路由器存储空间和带内信息传输方式提高标记信息利用率,不仅大大提高了追踪速度,而且避免占用额外的网络带宽.     

层次分析法在IP返回跟踪DoS攻击方法中的应用研究

将运筹学中的层次分析法应用于IP返回跟踪DoS攻击的方法中,可以为网络安全决策提供支持。首先介绍了层次分析法和几种IP返回跟踪DoS攻击的方法,在此基础上建立了IP返回跟踪DoS攻击方法的层次分析模型,用层次分析法对六种IP返回跟踪DoS攻击方法做了实证地比较和分析。     

伪装IP追踪技术综述

1 引言网络协议和操作系统的缺陷导致了网络的安全问题。有关IP协议最重要的问题是IP地址的伪装。IP协议本身无法验证源地址段中的IP地址是发送者的IP地址。一台机器可以在一段时间内将自己伪装成另一台机器甚至路由器。对网络攻击各种各样的解决办法中IP追踪(traceback)是一种重在威慑的方法,一旦攻击者知道攻击能被追溯,进行攻击时会更慎重。在美国、日本等发达国家伪装IP追踪技术已成为学术界、企业界和政府部门普遍关心的重要问题之一。     

Extracting real IP address used to connect to P2P messenger using ARIT agent

Peer-to-Peer Networking and Applications - Current IP based tracking method include host based traceback method, using traceback module installed in all system to locate the hacker’s real...     

一种防御DDoS攻击的IP源回溯方法

提出了一种利用被动监听Overlay网络进行DDoS攻击源追踪的新方法。它能够跨越多个自治系统追踪一个大规模DDoS攻击的多个攻击源。基于该方案,设计和实现了一个IP源回溯系统：SnifferTrack。描述了它的体系结构和组成、追踪过程和算法。最后,提出了SnifferTrack系统中的几个局限以及进一步的工作。