適合封包重組的低儲存量複合封包溯源機制

Accommodating Fragmentation in Hybrid IP Traceback with Efficient Packet Logging

謝學和(Xue-He Xie)

指導教授 ： 楊明豪

中原大學/工學院/資訊工程研究所/碩士(2012年)

https://doi.org/10.6840/cycu201200988

摘要

近年來網際網路的發展相當迅速，各種與網路相關的應用相當廣泛，但同時也產生了許多網路安全的問題。由於攻擊者可以偽造來源IP隱藏自己的位置並發動攻擊，因此要找出攻擊者相當困難。目前已經有許多研究提出各種封包溯源機制，其中封包轉存機制只需單一封包就能追踨到攻擊者，但它需要大量的儲存空間；封包標記機制雖然不需要在路由器上儲存封包資訊，但它需要收集大量的攻擊封包；複合封包溯源機制結合了封包轉存機制及封包標記機制，它可以做到單一封包追蹤，且減少路由器轉存所需的儲存量。在本篇論文中，我們將提出一個16位元標記的複合封包溯源機制的方法，可作到單一封包追蹤。我們比較現有的複合封包溯源機制MRT、RIHT及MORE。MRT與MORE不論在儲存量、搜尋速度、誤判率與漏判率都會受到封包量的影響而增加。我們的儲存量與搜尋速度會略高於RIHT，但我們仍然不會受到封包量的影響。但是RIHT使用32位元的封包標記機制會對封包重組造成影響，而且封包的標記會受到封包切割的影響而造成誤判，因此RIHT的誤判次數會與封包量有關。我們的方法是目前唯一不會受到封包量影響的方法。經過實驗，結果証明我們的方法具有低儲存量、快速轉存表搜尋及零誤判率等優點。

關鍵字

複合封包溯源機制 ； 封包轉存機制 ； 分散式阻斷服務攻擊 ； 封包標記機制 ； IP位址偽裝

並列摘要

Because the Internet has been widely applied in various fields, more and more network security issues emerge and catch people’s attention. However, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks. For this reason, researches have proposed a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. But packet logging inevitably requires much storage on routers. Some use packet marking for traceback. It does not need much storage on routers, but it collects large amount of attack packets. Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring longer search. In this paper, we propose a new hybrid IP traceback scheme that uses 16-bit marking fields and requires only 1 packet for IP tracking. Our performance analysis shows both MORE’s and MRT’s storage requirements, computation loads, false positives and false negatives all grow with the packet numbers. Although our scheme’s storage requirements and computation loads are slightly higher than RIHT’s, we do not have fragment issues and drop issues in our packet re-assembly. Because RIHT uses 32-bit marking fields, it inevitably suffers from the two issues and its false positive rates increase with the packet numbers. Our traceback scheme is the only one that is not affected by packet numbers. Our simulations prove that our scheme not only requires low storage and low computation but also achieves 0 false positives and 0 false negatives.

並列關鍵字

IP spoofing ； DoS/DDos attacks ； packet marking ； packet logging ； hybrid IP traceback

參考文獻

[1] A. Belenky and N. Ansari, “Accommodating Fragmentation in Deterministic Packet Marking for IP Traceback,” IEEE Global Telecommunications Conference, vol. 3, pp. 1374–1378, Dec. 2003.

[2] A. Belenky and N. Ansari, “IP traceback with deterministic packet marking,” IEEE Communications Letters, vol. 7, no. 4, pp. 162–164, April 2003.

[3] A. Belenky and N. Ansari, “Tracing multiple attackers with deterministic packet marking (DPM),” IEEE Pacific Rim, vol.1, pp.49–52, Aug. 2003.

[5] A. Hussain, J. Heidemann, and C. Papadopoulos, “A Framework for Classifying Denial of Service Attacks,” in Proc. ACM SIGCOMM ’03, Karlsruhe, Germany, pp.99-110, Aug. 2003.

[7] Burton H. Bloom, “Space/Time Trade-offs in Hash Coding with Allowable Errors,” Communications of the ACM, vol. 13, no. 7, pp. 422-426, July 1970.