A Study on Efficient IP Traceback and its Theoretical Analysis

近年来，拒绝服务攻击（DoS）已成为网络安全的严重威胁。针对DoS攻击的对策，目前在IP溯源和包过滤方面做了大量的研究。IP回溯是一种识别从攻击者到目标的路径的技术。遗憾的是，以前的IP回溯方案存在一些缺点，目前还没有找到最终的方案。特别是，以往的方案大多侧重于实施方面，因此很少注意理论评价。包过滤是根据路由器在报文上标记的信息，将攻击者发送的报文丢弃。本文提出了一种高效的IP回溯协议，并对其进行了理论分析。此外，我们还提出了一种有效的数据包过滤方案来对抗DoS攻击。它们如下所示。我们提出的IP回溯方案是概率分组标记（PPM）的一种变体，它是最有前途的IP回溯方案之一。我们方案最显著的特征之一是路由器标记数据包的概率是可变的。因此，通过灵活地改变概率，我们可以减少恢复攻击路径所需的数据包数量。此外，我们还提出了一种比Yaar提出的Pi标记方案更有效的数据包过滤方案，该方案对数据包伪造具有鲁棒性。

In recent years Denial of Service (DoS) attacks have become a serious threat on Internet security. For the countermeasures against DoS attacks, much research has so far been done on IP traceback and packet filtering. IP traceback is a technique to identify the path from the attacker to the target. Unfortunately, previous IP traceback schemes suffer from several disadvantages and the ultimate schemes have not been found yet. In particular, most of the previous schemes focused on implementation aspects and hence little attention has been paid to theoretical evaluation. On the other hand, packet filtering is to drop the packets sent by the attacker based on the information marked on packets by routers.In this work, we propose an efficient IP traceback protocol and conduct theoretical analysis on it. Furthermore, we also propose an efficient packet filtering scheme for countermeasures against DoS attacks. They are given as follows. Our proposed IP traceback scheme is a variation of Probabilistic Packet Marking (PPM), which is one of the most promising IP traceback schemes. One of the most notable features of our scheme is that probabilities with which routers marks packets is variable. Therefore by changing the probabilities flexibly we can reduce the number of the packets required to recover the attack path. Furthermore we have proposed a packet filtering scheme which is robust against the forgeries of packets and more efficient than Pi marking scheme proposed by Yaar.