DDoS attack tracking

DDoS attack tracking

Distributed denial of service (DDoS) attacks are a serious threat on the internet. However, the memory-free functionality of the Internet routing mechanism makes it difficult to trace the source of these attacks. Therefore, there is no effective way to deal with this problem so far.

The common way to trace DDoS attacks is IP tracing, which is designed to identify the real IP address that generates the attacking packet host. Typically, you can do this by detecting the source IP address of an IP packet. However, due to the current wide

There are security vulnerabilities in the ubiquitous network protocol TCP/IP protocol, and IP addresses can be set by software, so the sender can easily falsify the address and conceal its identity. IP Tracking Technology (IP packet tracking via network routing),

can identify the real IP address of the attacking host, and can also obtain information about the organization that generated the attack, such as its name and the e-mail address of the network administrator.

IP packet in the process of transmission online, the IP protocol header some of the fields may be modified by the intermediary device, such as TTL, checksum, fragmentation and IP options, to the end, the victim host received packets and the attacker issued a

The attack data can be very different, so IP tracing must be able to track packet routing information so that IP tracking is not limited by the packets that are received. To implement IP tracing in a system

, the network administrator must update the firmware on the existing router to the tracking support version, or configure a special tracking device at a location on the network.

A large number of IP tracking methods have been used to identify attack sources, and there are two important IP tracking methods: Probabilistic Packet marking (PPM) and deterministic packet marking (DPM). Both of these policies require routers to mark each package.

Deterministic packet marking DPM requires that each package must have enough space to store the tag information of all the routers it passes through, which can have a very large space burden. Even if there is enough space, adding data to each packet is

Can cause a high burden on routers. The current DPM algorithms include node-increasing algorithm, node sampling algorithm and boundary sampling algorithm. Probabilistic packet marking PPM based on the probability of the packet tag, greatly reducing the

The amount of computing for the router. At present, the more mature the PPM algorithm includes the PPM algorithm based on fragmentation, the PPM algorithm based on hash coding, and the PPM algorithm based on algebraic coding. But the current PPM algorithm generally will be labeled

The information is stored in the label field of the IP header, and because IPV6 does not have this field, it inevitably causes backward compatibility issues.

A new method of using entropy parameter to trace DDoS attack was presented in 2011 by the IEEE. This method is through the change of entropy on the router to track DDoS attacks, using many hypotheses and mathematical modeling, through a lot of experimental simulation, learned that the use of entropy parameters to track the DDoS attack method superior to IP tracking method, detailed content want readers to download the paper "Traceback of DDoS Attackks Using Entropy Variations ".