Packet marking probability selecting method and device for inter-domain retrospect

Abstract

The invention discloses a packet marking probability selecting method and a packet marking probability selecting device for inter-domain retrospect. A corresponding indicating bit of a data packet entering or leaving the current AS is checked at an interface of a BGP router of the current autonomous system AS, which is externally connected with an adjacent AS; when the indicating bit of the data packet shows that the data packet has not been marked by the upstream AS, a BGP routing table is checked in the BGP router according to a prefix longest matching principle, and an AS_PATH attribute value of a corresponding routing table entry is obtained, so the corresponding AS hop count is obtained; a marking probability is set according to the AS hop count to mark the corresponding data packet; and when the marking is determined to be carried out, the indicating bit of the corresponding data packet is set to be marked. The method and the device have the advantages of high speed of reconstructing attack paths, accuracy of reconstructing the attack paths and low router marking overhead.

Description

technical field [0001] The invention belongs to the technical field of the Internet, and in particular relates to a method for selecting packet mark probability for inter-domain traceability. Background technique [0002] Due to the defect in the initial design of TCP / IP (Transmission Control Protocol / Internet Protocol), the network does not verify the source address of the data packet, but only routes according to the destination address, and forwards the data packet to the destination. Attackers use this vulnerability to forge source addresses to attack remote hosts or networks, but victims often cannot effectively block attacks in real time, trace the source, accurately locate the attacker, and hold them accountable. [0003] IP traceability technology can determine the location of the network node that sent the attack packet and the transmission path of the attack packet. The trace process is carried out with the assistance of a series of routers. This type of technolog...

AI Technical Summary

Problems solved by technology

However, the selection of marking probability and the marking mechanism in the current various probabilistic packet marking technologies are not optimized enough

[0009] First, the victim needs to receive more data packets to reconstruct the attack path, which slows down the reconstruction speed of the attack path; second, it cannot prevent the attacker from forging the mark, causing the victim to reconstruct the attack path inaccurately; Third, the downstream router will overwrite the mark of the upstream router, resulting in repeated marks and increasing the router mark overhead

Images