基于Backscatter技术的假冒源地址攻击研究

A Backscatter Technology Based Study on Source Address Spoofing

假冒源地址攻击具有容易实施不易被追溯的特点,这种攻击行为在互联网上日益猖獗。网络安全正面临着前所未有的挑战,对假冒源地址攻击的研究是一项重要课题。文中概述假冒源地址攻击的主要特征;阐释Backscatter技术和ICMP协议的工作原理;从宏观和微观2个视角,研究CAIDA网络Telescopes工程所捕获PCAP流量的最新数据。借助于数据挖掘和统计分析技术,从PCAP流量数据中得到ICMP报文,并对所得报文跟踪分析了假冒源地址攻击信息。经过统计汇总,得出假冒源地址攻击所对应主要类型,并对集中度高的几种做了深入研究,通过对这些攻击类型的详细分析,探索了最新DoS/DDoS中假冒源地址攻击方式及其危害。最后总结全文并展望下一步研究工作。

Source address spoofing has become a widely used mechanism to achieve attack because it is easy to launch and difficult to detect and trace.Source address spoofing attacks pose a significant threat to the Internet today.Network security is facing a severe challenge we have never met before.It is an important task to research source address spoofing attacks.This paper surveys the definition of source address spoofing attacks,explains the principles of Backscatter and ICMP techniques,and analyzes the newest B...