一种部署于源-目的端供应商的包标记方案研究

提出了一个新的包标记方案，分别部署于源端和目的端供应商，主要用来描绘DDoS攻击流特征。这些特征对于受害者过滤攻击非常有效。在过滤方面，提出了一个比率控制方案，通过限制攻击流并保持合法数据流不受影响来有效保护受害者。在经济方面，提供更好的安全措施可以作为ISP对客户的增值服务，因此也就更有积极性来部署。

Research of the Packet Marking Scheme Based on Source and Destination-End ISP

In this paper, we propose new packet marking models. It based on source and destination-end ISP and used for characterizing DDoS attack streams. Such common characterization can be used to make filtering by the victim more effective. In terms of filtering, we propose a rate control scheme that protects destination domains by limiting the amount of traffic during an attack, while leaving a large percentage of legitimate traffic unaffected. On economic front, it offer enhanced security protection against such attacks as a value-added service to providers＇ customers, and hence offer positive incentives for them to deploy the proposed models.