低儲存量單一封包回溯機制

隨著網際網路已經廣泛地應用在各種領域之中，越來越多的網路安全性議題開始浮現並受到人們所重視。但是攻擊者可以藉由IP位址偽裝來隱藏自己的來源位置並發動攻擊。由於這個原因，已經有許多的研究提出多種的回溯機制來追蹤攻擊者的來源位置。其中部份的封包轉存機制只需要一個封包就可以追蹤攻擊者來源。另外有結合封包標記與封包轉存的複合IP回溯機制所需的儲存量較上述機制低但是需要更長的搜尋時間。在本篇論文中，在複合IP回溯機制中我們提出一個有效率的封包轉存機制以降低其儲存量、更快速的重建路徑與避免誤判的發生。除此之外，我們可以利用封包的標記欄位來判斷攻擊流量。最後，我們模擬與分析我們的機制，並在儲存量、計算量與準確度的觀點上與其他相關的研究做比較。

關鍵字

封包標記機制；封包轉存機制；複合IP回溯機制； IP位址偽裝；分散式阻斷服務攻擊

並列摘要

Because the Internet has been widely applied in various fields, more and more network security issues emerge and catch people’s attention. However, adversaries often hide themselves by spoofing their own IP address and then launch attacks. For this reason, researches have proposed a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring longer search. In this paper, we propose a new scheme for efficient packet logging in hybrid IP traceback aiming to fix our storage requirement (under 320K bytes, according to CAIDA’s skitter dataset) in packet logging without the need to refresh the logged tracking information; and to achieve zero false positive and false negative in attack-path reconstruction. Besides, we use a packet’s marking field to censor attack traffic on its upstream routers. Last, we simulate and analyze our scheme, in comparison with other related researches, in the following aspects, storage requirement, computation, and accuracy.

並列關鍵字

Hybrid IP traceback ； DoS/DDoS attack ； IP spoofing ； packet logging ； packet marking

參考文獻

[2] A.Belenky and N. Ansari, “IP traceback with deterministic packet marking,” IEEE Communications Letters, vol. 7, no. 4, pp. 162–164, April 2003.

[3] A.Belenky and N. Ansari, “Tracing multiple attackers with deterministic packet marking (DPM),” in Proc. IEEE PACRIM’03, Victoria, BC, Canada, Aug. 2003, pp. 49–52.

[5] A. Hussain, J. Heidemann, and C. Papadopoulos, “A Framework for Classifying Denial of Service Attacks,” in Proc. ACM SIGCOMM ’03, Karlsruhe, Germany, Aug. 2003, pp. 99-110.

[7] B. Al-Duwari and M. Govindarasu, “Novel hybrid schemes employing packet marking and logging for IP traceback,” IEEE Transactions on Parallel and Distributed Systems, vol. 17, no. 5, pp. 403-418, May 2006.

[9] C. Gong and K. Sarac, “A More Practical Approach for Single-Packet IP Traceback Using Packet Logging and Marking,” IEEE Transactions on Parallel and Distributed Systems, vol. 19, no. 10, pp.1310-1324, Oct. 2008.

國際替代計量

低儲存量單一封包回溯機制

全文下載

主題瀏覽