基于自治系统与动态概率包标记的DDoS攻击溯源优化方法

doi:10.11772/j.issn.1001-9081.2015.06.1705

计算机应用 ›› 2015, Vol. 35 ›› Issue (6): 1705-1709.DOI: 10.11772/j.issn.1001-9081.2015.06.1705

基于自治系统与动态概率包标记的DDoS攻击溯源优化方法

沈学利, 申杰

辽宁工程技术大学电子与信息工程学院, 辽宁葫芦岛 125105

收稿日期:2014-12-19 修回日期:2015-02-14 发布日期:2015-06-12
通讯作者: 申杰(1990-),男,江苏泰州人,硕士研究生,主要研究方向:计算机网络安全。shenjie_johnson@163.com
作者简介:沈学利(1969-),男,江苏连云港人,教授,硕士,主要研究方向:计算机网络安全.

Optimization method of tracing distributed denial of service attacks based on autonomous system and dynamic probabilistic packet-marking

SHEN Xueli, SHEN Jie

School of Electronics and Information Engineering, Liaoning Technical University, Huludao Liaoning 125105, China

Received:2014-12-19 Revised:2015-02-14 Published:2015-06-12

摘要/Abstract

摘要：

针对分布式拒绝服务(DDoS)攻击对于网络的严重威胁问题,提出基于自治系统(AS)与动态概率包标记(DPPM)的DDoS攻击溯源优化方法。在该方法中,设计了一种新的包标记方案,该方案设置两套标记,分别作为域标记和路由标记,用作域间溯源和域内溯源。域标记和路由标记过程同时进行,标记过程采用动态包标记的方法。最后,通过域间和域内的路径重构实现对攻击节点的快速溯源。实验结果表明该算法是高效、可行的,能为DDoS攻击的防范提供重要依据。

关键词: 分布式拒绝服务攻击, 自治系统, 动态概率包标记, 域间溯源, 域内溯源

Abstract:

Distributed Denial of Service (DDoS) attack is a serious threat to network security. In order to solve this problem, an effective method of tracing DDoS attack was proposed based on Autonomous System (AS) and Dynamic Probabilistic Packet-Marking (DPPM). In the proposed method, a new scheme of packet marking was designed with setting up two markers as the domain marks and routing tags for inter-domain tracing and in-domain tracing. Domain marks and routing tags were set at the same time using dynamic packet marking methods. Finally, through the path reconstruction on in-domain and inter-domain, the attack node was traced back rapidly. The experimental results show that the proposed algorithm is efficient and feasible, which provides an important basis for the DDoS attack prevention.

Key words: Distributed Denial of Service (DDoS) attack, Autonomous System (AS), Dynamic Probabilistic Packet-Marking (DPPM), inter-domain tracing, in-domain tracing

中图分类号:

TP393.08

沈学利, 申杰. 基于自治系统与动态概率包标记的DDoS攻击溯源优化方法[J]. 计算机应用, 2015, 35(6): 1705-1709.

SHEN Xueli, SHEN Jie. Optimization method of tracing distributed denial of service attacks based on autonomous system and dynamic probabilistic packet-marking[J]. Journal of Computer Applications, 2015, 35(6): 1705-1709.

参考文献

[1] CONVERY S. Network security architectures [M]. TIAN G, LIU D, translated. Beijing: Posts and Telecom Press, 2013: 234-245.(CONVERY S.网络安全体系结构[M].田果, 刘丹宁, 译.北京:人民邮电出版社, 2013:234-245.)
[2] BASKAR M, GNANASEKARAN T, SARAVANAN S. Adaptive IP traceback mechanism for detecting low rate DDoS attacks [C]//ICE-CCN:Proceedings of the 2013 International Conference on Emerging Trends in Computing, Communication and Nanotechnology. Piscataway: IEEE, 2013: 373-377.
[3] FOROUSHANI V A, ZINCIR-HEYWOOD A N. TDFA: traceback-based defense against DDoS flooding attacks [C]//Proceedings of the 2014 IEEE 28th International Conference on Advanced Information Networking and Applications. Piscataway: IEEE, 2014: 597-604.
[4] KIREMIRE A R, BRUST M R, PHOHA V V. Topology-dependent performance of attack graph reconstruction in PPM-based IP traceback [C]//Proceedings of the 2014 IEEE 11th Consumer Communications and Networking Conference. Piscataway: IEEE, 2014: 363-370.
[5] SAVAGE S, WETHERALL D, KARLIN A, et al. Practical network support for IP traceback [J]. ACM SIGCOMM Computer Communication Review, 2000, 30(4):295-306.
[6] SONG D X, PERRIG A. Advanced and authenticated marking schemes for IP traceback [C]//INFOCOM 2001: Proceedings of the 20th Annual Joint Conference of the IEEE Computer and Communications Societies. Piscataway: IEEE, 2001, 2: 878-886.
[7] PENG T, LECKIE C, RAMAMOHANARAO K. Adjusted probabilistic packet marking for IP traceback [C]//NETWORKING 2002: Proceedings of the Second International IFIP-TC6 Networking Conference on Networking Technologies, Services, and Protocols; Performance of Computer and Communication Networks; Mobile and Wireless Communications, LNCS 2345. Berlin: Springer, 2002: 698-708.
[8] LIU J, LEE Z-J, CHUNG Y-C. Dynamic probabilistic packet marking for efficient IP traceback [J]. Computer Networks, 2007, 51(3): 866-882.
[9] ZHU X, LIU Y, LI X. IP traceback based on unrepeatable packet marking scheme [J]. Journal of Computer Applications, 2007, 27(11): 2694-2695, 2698.(朱晓建, 刘渊, 李秀珍.基于非重复包标记的 IP 追踪研究[J].计算机应用, 2007, 27(11):2694-2695, 2698.)
[10] ZHANG M, ZHAO H, XIONG A. New scheme for IP traceback [J].Computer Engineering and Applications, 2011, 47(30): 83-85, 97. (张敏, 赵红杰, 熊安萍.一种新的IP溯源追溯方案[J].计算机工程与应用, 2011, 47(30):83 -85, 97.)
[11] JIN N. Improved packet marking scheme under DDoS attacks [D]. Chengdu: University of Electronic Science and Technology of China, 2013. (靳娜.DDoS 攻击下的数据包标记优化方案的研究[D]. 成都:电子科技大学, 2013.)
[12] MCCLURE S, SCAMBRAY J, KURTZ G. Hacking exposed [M]. 7th ed. ZHAO J, ZHANG Y, CHEN H, et al., translated. Beijing:Tsinghua University Press, 2013: 692-695. (STUART M, JOEL S, GEORGE K. 黑客大曝光[M].7 版.赵军, 张云春, 陈红松, 等译.北京:清华大学出版社, 2013:692-695.)
[13] CHEN L, HE M, LIU Z, et al. A new active path identification and filtering method [C]//Proceedings of the 2013 27th International Conference on Advanced Information Networking and Applications Workshops. Piscataway: IEEE, 2013: 849-853.
[14] TANENBAUM A S, WETHERALL D J. Computer networks [M]. 5th ed. YAN W, PAN A, translated. Beijing: Tsinghua University Press, 2012: 261-266. (TANENBAUM A S, WETHERALL D J.计算机网络[M].5版.严伟, 潘爱民, 译.北京: 清华大学出版社, 2012:261-266.)
[15] HUANG Q, XIONG W, YANG X, et al. Hierarchical stateless single-packet IP traceback technique [J].Journal on Communications, 2011, 32(3): 150-157.(黄琼, 熊文柱, 杨晓龙, 等.分层次的无状态单分组IP溯源技术[J].通信学报, 2011, 32(3):150-157.)

基于自治系统与动态概率包标记的DDoS攻击溯源优化方法

Optimization method of tracing distributed denial of service attacks based on autonomous system and dynamic probabilistic packet-marking

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	王波, 任英琦, 黄冬艳. H-Algorand:基于多块输出的公有链共识机制[J]. 计算机应用, 2020, 40(7): 2150-2154.
[2]	刘向举, 刘鹏程, 徐辉, 朱晓娟. 基于软件定义物联网的分布式拒绝服务攻击检测方法[J]. 计算机应用, 2020, 40(3): 753-759.
[3]	吴若豪, 董平, 郑涛. 基于OpenDayLight的恶意扫描防护技术[J]. 计算机应用, 2018, 38(1): 188-193.
[4]	马林进, 万良, 马绍菊, 杨婷, 易辉凡. 基于词袋模型的分布式拒绝服务攻击检测[J]. 计算机应用, 2017, 37(6): 1644-1649.
[5]	韩德志, 陈旭光, 雷雨馨, 戴永涛, 张肖. 基于Spark Streaming的实时数据分析系统及其应用[J]. 计算机应用, 2017, 37(5): 1263-1269.
[6]	刘泽宇, 夏阳, 张义龙, 任远. 基于Web行为轨迹的应用层DDoS攻击防御模型[J]. 计算机应用, 2017, 37(1): 128-133.
[7]	程建张明清刘小虎范涛. 基于人工免疫的分布式入侵检测模型[J]. 计算机应用, 2014, 34(1): 86-89.
[8]	顾晓清王洪元倪彤光丁辉. 基于时间序列分析的应用层DDoS攻击检测[J]. 计算机应用, 2013, 33(08): 2228-2231.
[9]	闫巧宁土文. 基于确定线性网络编码的IPv6追踪[J]. 计算机应用, 2011, 31(09): 2352-2355.
[10]	高琰王台华郭帆余敏. 应用非迭代Apriori算法检测分布式拒绝服务攻击[J]. 计算机应用, 2011, 31(06): 1521-1524.
[11]	郭辉常晋义. 边界网关协议收敛问题研究综述[J]. 计算机应用, 2010, 30(10): 2628-2631.
[12]	李扬王景中杨义先. 综合安全管理平台中日志格式化系统的设计与实现[J]. 计算机应用, 2010, 30(06): 1708-1710.
[13]	袁志勇周肆清. 一种基于分片包标记的改进方案[J]. 计算机应用, 2009, 29(2): 357-359.
[14]	徐劲松黄汝成王元捷. 一种改进的数据包标记追踪方案--CDPM[J]. 计算机应用, 2009, 29(12): 3185-3187.
[15]	徐劲松. 一种改进的路由包标记追踪方案[J]. 计算机应用, 2009, 29(05): 1316-1320.