摘要
为防御互联网拒绝服务攻击，路径标识（Pi）技术为快速区分和过滤攻击包提供了有效手段，基于此提出优化路径标识方案OPi，与已有方案中各路由器插入1或2位标记不同，路由器根据包的当前TTL值，推算已经过的距离，分别插入1～16位可变长标记，最大程度利用标记域空间。相比以往方案，尤其当攻击路径和合法路径严重混杂时，OPi区分程度更高。考虑到攻击包会随机产生TTL初值来扰乱OPi标识，进一步提出了OPi＋TTL的过滤方案。理论分析和基于大规模真实互联网拓扑的仿真实验表明，OPi的防御效果较理想。
A novel packet marking scheme, optimal path identification （OPi）, was proposed to defend against DDoS attacks. Instead of using fixed 1 or 2 bit in previous schemes, in OPi a router deduces the traveling distance of an arrived packet by its TTL value and inserts a variable-length marking of 1-16 bit into the packet. The marking field is filled completely even the path is very short and the distinguishability is improved. OPi outperforms previous schemes, especially when attacker paths adjoin user paths seriously. To obtain better performance, an OPi＋TTL filtering strategy was proposed to frustrate attackers＇ tries with spoofed initial TrL values. Theoretical analyses and simulations with actual Internet topologies show OPi performs excellently.
出处
《通信学报》
EI
CSCD
北大核心
2008年第9期46-53,共8页
Journal on Communications
基金
浙江省自然科学基金资助项目(Y106023)
宁波市自然科学基金资助项目(2006A610014)~~
