JIN Guang1, YANG Jian-gang1, LI Yuan2, et al. Optimal path identification to defend against DDoS attacks[J]. 2008, (9): 46-53.DOI：
防御分布式拒绝服务攻击的优化路径标识模型
摘要
为防御互联网拒绝服务攻击
路径标识（Pi）技术为快速区分和过滤攻击包提供了有效手段
基于此提出优化路径标识方案OPi
与已有方案中各路由器插入1或2位标记不同
路由器根据包的当前TTL值
推算已经过的距离
分别插入1
1
6位可变长标记
最大程度利用标记域空间。相比以往方案
尤其当攻击路径和合法路径严重混杂时
OPi区分程度更高。考虑到攻击包会随机产生TTL初值来扰乱OPi标识
进一步提出了OPi+TTL的过滤方案。理论分析和基于大规模真实互联网拓扑的仿真实验表明
OPi的防御效果较理想。
Abstract
A novel packet marking scheme
optimal path identification（OPi）
was proposed to defend against DDoS at-tacks.Instead of using fixed 1 or 2 bit in previous schemes
in OPi a router deduces the traveling distance of an arrived packet by its TTL value and inserts a variable-length marking of 1~16 bit into the packet.The marking field is filled completely even the path is very short and the distinguishability is improved.OPi outperforms previous schemes
espe-cially when attacker paths adjoin user paths seriously.To obtain better performance
an OPi+TTL filtering strategy was proposed to frustrate attackers’ tries with spoofed initial TTL values.Theoretical analyses and simulations with actual Internet topologies show OPi performs excellently.
京公网安备11010802024621