基于多维伪随机序列的高级包标记策略算法

高级包标记策略（AMS）是对分布式拒绝服务（DDoS）攻击进行IP追踪的有效算法，但是，由于使用哈希函数实现边地址的压缩，AMS算法存在复杂度高、保密性差、误报率高等缺陷。为了提高追踪效率，设计了一种基于多维伪随机序列的AMS算法：一方面，在路由器上，以全硬件实现的边采样矩阵代替原有的哈希函数，完成IP地址的压缩编码；另一方面，在受害者端，结合边地址压缩码和边的权重计算过程，实现攻击路径图的输出。仿真实验中，基于多维伪随机序列的AMS算法与原始算法性能基本一致，但能有效减少误判的发生和快速判断伪造路径。实验结果表明，所提算法保密性能高，计算速度快，抗攻击能力强。

Advanced marking scheme algorithm based on multidimensional pseudo-random sequences

The current Advanced Marking Scheme (AMS) algorithm is a relatively efficient algorithm for tracing IP addresses of Distributed Denial of Service (DDoS) attackers. However, as using hash functions to achieve compression of edge address, the AMS algorithm has many defects such as high complexity, poor confidentiality and a high ratio of false positives. In order to improve the efficiency of AMS, the AMS algorithm based on multidimensional pseudo-random sequences was designed. On one hand, replacing original hash functions, an edge sampling matrix was constructed with a full hardware device in a router to achieve the compression coding of IP address. On the other hand, combined with the compressed code of edge address and the calculation process of edge weight in the victim's side, the output of DDoS attack path graph was realized. In the simulation experiments, the performance of the AMS algorithm based on multidimensional pseudo-random sequences is basically the same as the original algorithm, which can effectively reduce misjudgment and quickly judge forged paths. The experimental results show that the proposed algorithm has high security, fast computation and strong anti-attack ability.