Modulo operation based denial of service attack trace back method

Abstract

The present invention provides a modulo operation based denial of service attack trace back method. The method includes a first step of establishing a modulo operation packet marking method by using an identification domain of an IP header, namely an ID domain; a second step of forwarding node information of a router by using a node sampling method, and writing a routing position and a routing address in a marking space of a data packet; a third step of performing modulo operation by using a value of the ID domain in the IP header, so as to realize routing marking, namely determine that which router on an attack path performs marking operation on a certain data packet; and a fourth step of detecting, by a victim end, marking information in the data packet, so as to reconstruct the path. Through introduction of the modulo operation, it is calculated that which router on the attack path needs to perform marking operation on an existing data packet, so that the burden of each router on a forwarding path is reduced, the quantity of the data packets for path reconstruction is greatly reduced, and a start source of denial of service attack is effectively identified.

Description

technical field [0001] The invention relates to the technical field of network attack prevention, and in particular, to a method for returning and tracing a denial of service attack based on modulo operation. Background technique [0002] The denial of service (DoS) attack initiated by hackers by exploiting network protocol flaws is the most common type of network attack, aiming to make the target system unable to provide normal service or resource access. DoS attacks cause business losses of up to tens of millions of dollars every year, and are the second type of network attacks that cause the most damage to Internet property. Moreover, attackers can use a large number of compromised hosts on the network to form botnets and control them to a certain A specific target launches an intensive denial of service attack, that is, a distributed denial of service attack (DistributedDoS, DDoS). DoS attacks seriously threaten the security of the Internet and its infrastructure due to...

AI Technical Summary

Problems solved by technology

The problem with this method is that the marking space is limited, and the marking information may be completely lost and the attack path cannot be reconstructed. How to choose the marking probability is a difficult point

However, DPPM fails to solve the problem of limited label space and has shortcomings such as heavy burden on routers.

Images