基于自治系统与动态概率包标记的DDoS攻击溯源优化方法

针对分布式拒绝服务(DDoS)攻击对于网络的严重威胁问题,提出基于自治系统(AS)与动态概率包标记(DPPM)的DDoS攻击溯源优化方法。在该方法中,设计了一种新的包标记方案,该方案设置两套标记,分别作为域标记和路由标记,用作域间溯源和域内溯源。域标记和路由标记过程同时进行,标记过程采用动态包标记的方法。最后,通过域间和域内的路径重构实现对攻击节点的快速溯源。实验结果表明该算法是高效、可行的,能为DDoS攻击的防范提供重要依据。

Optimization method of tracing distributed denial of service attacks based on autonomous system and dynamic probabilistic packet-marking

Distributed Denial of Service (DDoS) attack is a serious threat to network security. In order to solve this problem, an effective method of tracing DDoS attack was proposed based on Autonomous System (AS) and Dynamic Probabilistic Packet-Marking (DPPM). In the proposed method, a new scheme of packet marking was designed with setting up two markers as the domain marks and routing tags for inter-domain tracing and in-domain tracing. Domain marks and routing tags were set at the same time using dynamic packet marking methods. Finally, through the path reconstruction on in-domain and inter-domain, the attack node was traced back rapidly. The experimental results show that the proposed algorithm is efficient and feasible, which provides an important basis for the DDoS attack prevention.