A single-packet traceability method based on the importance assessment of trace traces

Abstract

The invention discloses a single-package traceability method based on the evaluation of the importance of trace traces, which includes the following steps: S1, dividing the storage space of trace routers into two types: GHOST and REAL, wherein the storage time of trace traces in REAL is longer than that of GHOST; S2. When the IP packet propagates in the network, the traceability router establishes the tracking trace of the IP packet, and at the same time calculates the moving average prediction value S of the importance of the trace trace corresponding to the IP packet; if S is greater than the threshold value, the tracking trace of the IP packet The trace is raised from GHOST to REAL; if S is less than the threshold, the trace of the IP packet will be lowered from REAL to GHOST; when the memory of the traceability router is insufficient, select the trace corresponding to the minimum value of S in GHOST to delete; S3, a network After the attack, the victim sends a trace request, and the trace manager reconstructs the attack path based on the trace trace. The invention adopts two ways of delay and time to manage the attack traces and normal traces, which improves the storage utilization rate and reduces the problem of traceability accuracy caused by insufficient resources.

Description

technical field [0001] The invention relates to a single packet traceability method based on the importance evaluation of trace traces, and belongs to the technical field of anonymous packet traceability in IP networks. Background technique [0002] Denial-of-Service (DoS for short) attacks have occurred at the beginning of the rise of the Internet, and in just a few years it has rapidly become the most important security threat hindering the development of the Internet. In recent years, with the continuous upgrading of hacking techniques, DoS attacks are undergoing a revolution. In 2013, Radware, the world's top provider of network security and management solutions, pointed out in a report that DoS attacks are gradually evolving into an advanced persistent penetration attack, and the most fundamental reason for this change is "hybrid denial of service attacks (i.e. MDos)" appears. Different from traditional DoS attacks, MDoS is an intelligent attack. Its "intelligence" is...

AI Technical Summary

Problems solved by technology

Although researchers have used some compression tools with high space usage (such as Bloom filter) or packet marking technology to store trace traces, thereby reducing the storage overhead of traceability, these technologies only reduce the unit storage of trace traces. The capacity does not change the proportional relationship between storage and packet forwarding, so the problem of traceable storage is still severe

[0006] 2) They usually use a centralized method to manage traces, so that the traceability router can only serially process the arriving data packets

For example, a router usually only needs to perform IP packet decapsulation and encapsulation operations, but the traceability router also needs to perform operations such as packet recording and packet marking in addition to the two operations. In the NE5000E router, the average processing time of IP packets is about 0.06ns. When After it is upgraded to a traceable router, the IP packet processing time will definitely exceed 0.06ns, resulting in a decrease in network transmission performance

[0007] 3) They did not distinguish the importance of different traces on the same traceability router, and tried to treat all traces through indiscriminate management, resulting in a limited number of storage resources on the router, most of which may be allocated to users. To establish the traces of the normal path, but the traces of the attack path can only overlap each other due to insufficient resources, which destroys the unique identification of the traces and reduces the traceability accuracy

For example, before recording attack traces, traceability routers are often busy with establishing normal traces for a long period of time, which consumes a lot of storage resources and results in inefficient resource utilization

Images