基于权重包标记策略的IP跟踪技术研究

IP Traceback Based on Weight Marking Scheme

针对Internet中普遍存在的匿名服务拒绝攻击 (DistributedDenialofService ,DDoS) ,该文提出权重标记IP跟踪策略 (WeightMarkingScheme ,WMS) .现有的IP跟踪策略存在较高的误报率 ,WMS通过引入HASH函数 ,将 32× 2位的IP地址压缩到 11位 ,减少跟踪路径的误报率 .另一方面 ,已有的IP包跟踪技术构造的多个候选攻击路径间没有权重的差异 ,WMS将权重信息加入到各个候选攻击路径 ,通过和正常情况下的候选攻击路径权重进行比较 ,可更好地分析真正攻击源 .理论和实验结果表明该策略与FMS(FragmentMarkingScheme)、AMS(AdvancedMarkingScheme)相比较 ,在降低误报率、发现真正的攻击源和算法复杂度等方面有较大的提高 .

To Defend against DDoS on the Internet, this paper presents a Weight Marking Scheme (WMS) to trace the source of the attacks. To resolve the problem of high false position rate, WMS research the character of HASH. Using the combination of optimum HASH, WMS compresses the IP form 64 bits to 11 bits and reduces the false position rate. In pervious works, there are no differences between the attack paths. WMS imports the weight information to edges and paths, so the victim can find the attack paths more clearly by comparing weight of paths in the normal condition with weight of paths in the abnormal condition. Both the theory and the experiment result show the validity of WMS.