A practical and robust inter-domain marking scheme for IP traceback
A practical and robust inter-domain marking scheme for IP traceback
复制标题
一种实用且鲁棒的IP回溯域间标记方案
DOI：
10.1016/j.comnet.2006.06.003
复制
发表时间：
2007
期刊：
影响因子：
--
通讯作者：
N. Ansari
中科院分区：
文献类型：
--
作者：
Zhiqiang Gao;N. Ansari
提出了一种实用的、鲁棒的域间标记IP追踪方案。我们首先确定六个缺点的概率包标记（PPM），然后设计一个协同方案来解决所有这些问题。为了减轻受害者令人畏惧的计算开销，我们推导出相对于路径重建所需数据包数量的最佳标记概率，并探索两种不同的方法来增强PPM。这样做，计算负担和欺骗标记的攻击者被挫败。接下来，我们研究了由被破坏的路由器引起的伪标记问题。通过耦合标记和路由信息，下游路由器可以检查上游路由器提供的标记的正确性，从而消除被破坏的路由器嵌入的虚假标记。我们的粗粒度标记策略（标记在AS级别，而不是逐跳）带来了两个额外的好处：我们的计划可以有效地抑制误报，我们的计划的部分部署可能会达到类似的效果，全球部署在幂律互联网。最后，我们评估和分析我们的建议的经验互联网测量数据的性能。结果表明，多达90.67%的标记数据包需要路径重建可以减少平均，而误报大大抑制和鲁棒性显着增强。
A practical and robust inter-domain marking scheme for IP traceback is proposed. We first identify six drawbacks of Probabilistic Packet Marking (PPM), and then contrive a synergic scheme to address all of them. To relieve the victim from the daunting computational overhead, we derive the optimal marking probability with respect to the number of packets required for path reconstruction, and explore two different approaches to enhance PPM. In so doing, computational burden and spoofed marking inscribed by the attacker are thwarted. Next, we study the issue of bogus marking incurred by subverted routers. By coupling the marking and routing information, a downstream router can examine the correctness of the marking provided by upstream routers, thus eliminating the spurious marking embedded by subverted routers. Our coarse-grained marking tactic (marking at the AS level rather than hop-by-hop) brings two additional benefits: our scheme can effectively suppress false positives, and partial deployment of our scheme may achieve the similar effect as global deployment in the power-law Internet. Finally, we evaluate and analyze the performance of our proposal on empirical Internet measurement data. Results show that as many as 90.67% of marked packets required for path reconstruction may be reduced on average while false positives are greatly suppressed and robustness is significantly enhanced.