关键词: 拒绝服务攻击, 分布式拒绝服务攻击, IP追踪, 分片包标记

Abstract: Distributed denial-of-service(DDoS) attacks pose a grave threat to the security of Internet today. Since TCP/IP is a stateless protocol and it also has defect in design, it is quite difficult to determine the actual source of the attack. Based on the research of Fragment Marking Scheme, an improved scheme was presented, which extended the marking field. By adding a new group-ID field, a packet can be distinguished from different router groups. Fewer fragment combinations were required to verify if an edge was in the true attack graph; therefore, the convergence time reduces and the amount of false positive decreases.

Key words: DoS, DDoS, IP traceback, Fragment Marking Scheme (FMS)