摘要
对IPv6下拒绝服务攻击进行了研究,并根据IPv6协议的特点,提出一种基于IPv6的MAC认证改进确定包标记(ADPM-v6)算法。ADPM-v6利用IPv6新特性,即逐跳选项和改进的MAC认证方法,有效解决了受控路由器修改标记的问题,能直接快速地追踪攻击源。同时分析验证了IPv6真实攻击环境的数据包大小分布,使得算法有效且更具有较强的实用性。理论分析和仿真实验结果表明,该算法在IPv6下大大缩短了重构时间,减少了重构计算量和误报率。
This paper studied the DoS attacks under IPv6,and according to the new features of IPv6 protocol,proposed the ADPM-v6 scheme based on improved MAC-authentication.By using a new IPv6 feature hop-by-hop options and the improved MAC authentication method,the scheme could quickly locate the source of attacker.The scheme could prevent compromised router which could forge the marking effectively.Simultaneous,analysis of a real attack environment verifying IPv6 packet size distribution,made the algorithm have a strong practicality and more effective.The implementation and evaluation shows that the ADPM-v6 scheme can greatly reduce the reconstruction time and reduce the amount of reconstruction computing and false positive.
出处
《计算机应用研究》
CSCD
北大核心
2012年第5期1914-1917,共4页
Application Research of Computers
基金
国家自然科学基金资助项目(61170277)
上海市教委科研创新重点资助项目(12zz137)
上海市重点学科建设资助项目(S30504)
关键词
IPV6协议
IP追踪
分布式拒绝服务
确定包标记
MAC认证
IPv6 protocol
IP traceback
distributed denial of service（DDoS）
deterministic packet marking（DPM）
MAC authentication
