Single-packet tracing method based on label switching

Abstract

The invention discloses a single-packet tracing method based on label switching. The method comprises the following steps that S1, when an IP packet is performing transmission in a network, a tracing router establishes a tracing track of the IP data packet according to the a label switching path establishment principle in an MPLS network; and S2, after a network attack occurs, a victim emits a tracing request, and a tracing manager reconstructs an attack path according to the tracing track. According to the method, the reverse-routing-oriented tracking track is established by using the label switching path establishment principle in the MPLS network, thus the memory expense of the tracing router is no longer dependent of the forwarding amount of the IP packet (namely, the memory expense of the tracing router is no longer in direct proportion to the forwarding amount of the IP packet of the tracing router, and as the operation time goes on, the memory expense of the router is no longer linearly increased), but only related to the number of routing paths passing through the tracing router, and thereby greatly reducing the memory expense of the tracing router.

Description

technical field [0001] The present invention relates to an anonymous packet tracking technology of an IP network, in particular to a label switching based single-packeTTraceback (S3T for short) method for a Mixed Denial-of-Service attack (MDos for short). Background technique [0002] Denial-of-Service (DoS for short) attacks have occurred at the beginning of the rise of the Internet, and in just a few years it has rapidly become the most important security threat hindering the development of the Internet. In recent years, with the continuous upgrading of hacking techniques, DoS attacks are undergoing a revolution. In 2013, Radware, the world's top provider of network security and management solutions, pointed out in a report that DoS attacks are gradually evolving into an advanced persistent penetration attack, and the most fundamental reason for this change is "hybrid denial of service attacks (i.e. MDos)" appears. Different from traditional DoS attacks, MDoS is an intel...

AI Technical Summary

Problems solved by technology

Although researchers have used some compression tools with high space usage (such as Bloom filter) or packet marking technology to store trace traces, thereby reducing the storage overhead of traceability, these technologies only reduce the unit storage of trace traces. The capacity does not change the proportional relationship between storage and packet forwarding, so the problem of traceable storage is still severe

[0006] 2) They usually use a centralized method to manage traces, so that the traceability router can only serially process the arriving data packets

For example, a router usually only needs to perform IP packet decapsulation and encapsulation operations, but the traceability router also needs to perform operations such as packet recording and packet marking in addition to the two operations. In the NE5000E router, the average processing time of IP packets is about 0.06ns. When After it is upgraded to a traceable router, the IP packet processing time will definitely exceed 0.06ns, resulting in a decrease in network transmission performance

Images