A Study on Efficient IP Traceback and its Theoretical Analysis

近年来，拒绝服务（DoS）攻击已经成为互联网安全的一个严重威胁。针对拒绝服务攻击的对策，目前已经对IP回溯和包过滤技术进行了大量的研究。IP回溯是一种识别从攻击者到目标的路径的技术。不幸的是，以前的IP回溯方案遭受的几个缺点和最终的方案还没有被发现。特别是，大多数以前的计划侧重于实施方面，因此很少注意到理论评估。另一方面，包过滤是根据路由器标记在包上的信息来丢弃攻击者发送的包.在这项工作中，我们提出了一个有效的IP回溯协议，并对它进行了理论分析.此外，我们还提出了一个有效的包过滤方案，以应对拒绝服务攻击.它们如下。我们提出的IP回溯方案是概率包标记（PPM），这是最有前途的IP回溯方案之一的变化。我们的方案最显着的特点之一是，路由器标记数据包的概率是可变的。因此，通过灵活地改变概率，我们可以减少恢复攻击路径所需的数据包数量。此外，我们还提出了一种包过滤方案，该方案对数据包的伪造具有鲁棒性，并且比Yaar提出的Pi标记方案更有效。

In recent years Denial of Service (DoS) attacks have become a serious threat on Internet security. For the countermeasures against DoS attacks, much research has so far been done on IP traceback and packet filtering. IP traceback is a technique to identify the path from the attacker to the target. Unfortunately, previous IP traceback schemes suffer from several disadvantages and the ultimate schemes have not been found yet. In particular, most of the previous schemes focused on implementation aspects and hence little attention has been paid to theoretical evaluation. On the other hand, packet filtering is to drop the packets sent by the attacker based on the information marked on packets by routers.In this work, we propose an efficient IP traceback protocol and conduct theoretical analysis on it. Furthermore, we also propose an efficient packet filtering scheme for countermeasures against DoS attacks. They are given as follows. Our proposed IP traceback scheme is a variation of Probabilistic Packet Marking (PPM), which is one of the most promising IP traceback schemes. One of the most notable features of our scheme is that probabilities with which routers marks packets is variable. Therefore by changing the probabilities flexibly we can reduce the number of the packets required to recover the attack path. Furthermore we have proposed a packet filtering scheme which is robust against the forgeries of packets and more efficient than Pi marking scheme proposed by Yaar.