【摘要】 防御分布式拒绝服务(DDoS)攻击是目前最难处理的网络安全问题之一。在众多解决方法中,包标记方法受到了广泛的重视。在这类标记方案中,路径中的路由器根据一定策略标记过往的数据包,从而受害者可以在短时间内对攻击路径进行重构,实现对攻击者的IP回溯。论文提出了一种新的包标记方法,非强制性包标记算法。可以有效地降低重构时间和误报率,减少了网络和路由器标记数据包的负担。更多还原

【Abstract】 Distributed Denial of Service(DDoS) attack is among the hardest network problems.Among several countermeasures,packet making scheme is promising.In these marking schemes,every router marks a passing packet with a probability,so that the convergence time for an attacking path can be achieved in little time,and the attack can be found in attack path reconstruction using IP traceback.In this paper,a new packet making scheme,a non-preemptive packet marking scheme is given,which reduces the convergence time and false positive rate,and takes lower network and router overhead.更多还原