基于路由器流量分析的DDoS反向追踪

DDoS traceback based on router traffic analysis

提出了一种能够基于路由器流量分析的DDoS反向追踪方法.在DDoS攻击发生时,通过输入调试回溯到所有发往受害者流量的入口路由器,然后分析每个入口路由器流量中是否存在攻击流量,从而确定所有攻击流量入口路由器.文中给出了基于流量自相似的攻击流量检测算法,设计了基于蜜罐群的路由器攻击流量检测与追踪平台,并对该追踪方法进行了性能分析.结果表明,提出的反向追踪方法可以精确追踪到全部DDoS攻击流量的入口路由器.

DDoS traceback approach based on router traffic analysis was proposed according to DDoS attack＇s traffic characteristic. After every access router sending traffic to victim was found out by input debugging process, access routers sending DDoS attack traffic are ascertained by traffic analysis. The DDoS attack traffic detection algorithm based on self-similarity was introduced, and a honeypots group platform was designed for traffic analysis and traceback. At last the capability of this traceback approach was analyzed. The result shows that the approach can trace back all the access routers sending DDoS attack traffic accurately.