Advanced and authenticated marking schemes for IP traceback
Advanced and authenticated marking schemes for IP traceback
复制标题
DOI：
10.1109/infcom.2001.916279
复制
发表时间：
2001-04
期刊：
影响因子：
--
通讯作者：
D. Song;A. Perrig
中科院分区：
文献类型：
--
作者：
D. Song;A. Perrig
防御分布式拒绝服务攻击是当今互联网上最严重的安全问题之一。挫败这些攻击的一种困难是追踪攻击的来源，因为它们经常使用不正确或欺骗的IP源地址来掩盖真正的原点。在本文中，我们提出了两个新方案，即高级标记方案和身份验证的标记方案，这些方案使受害者可以追踪欺骗的IP数据包的大致起源。我们的技术具有低网络和路由器开销，并支持增量部署。与以前的工作相反，我们的技术具有明显更高的精度（较低的误报率），而受害者在大规模分布式拒绝服务攻击下重建攻击路径的计算开销较少。此外，身份验证的标记方案还提供了路由器标记的有效身份验证，即使被折衷的路由器也无法伪造或篡改标记。
Defending against distributed denial-of-service attacks is one of the hardest security problems on the Internet today. One difficulty to thwart these attacks is to trace the source of the attacks because they often use incorrect, or spoofed IP source addresses to disguise the true origin. In this paper, we present two new schemes, the advanced marking scheme and the authenticated marking scheme, which allow the victim to trace-back the approximate origin of spoofed IP packets. Our techniques feature low network and router overhead, and support incremental deployment. In contrast to previous work, our techniques have significantly higher precision (lower false positive rate) and fewer computation overhead for the victim to reconstruct the attack paths under large scale distributed denial-of-service attacks. Furthermore the authenticated marking scheme provides efficient authentication of routers' markings such that even a compromised router cannot forge or tamper markings from other uncompromised routers.