Method for cross-domain tracing based on stream fingerprint

Abstract

The present invention provides a method for cross-domain tracing based on a stream fingerprint. The method comprises the steps of: based on the stream fingerprint technology, employing a multilayer synergetic thought to perform reconstruction of an attack path and location of a suspicious attack source from an inter-domain layer and an intra-domain routing layer, comprising: in the inter-domain layer, constructing a global network topology relation, and employing the stream fingerprint information of the suspicious attack source to achieve association for different data streams so as to construct an inter-domain suspicious attack path, and in the intra-domain routing layer, reconstructing an intra-domain suspicious attack path through association of the stream table information; and fusingthe inter-domain suspicious attack path and the intra-domain suspicious attack path to obtain a global suspicious attack path so as to reduce the damaging of a target host. The method for cross-domain tracing based on a stream fingerprint employs the stream table association degree to perform construction of the intra-domain suspicious path and employ the SDN integration control and the stream fingerprint technology to ensure the efficient and accurate construction of the path.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for cross-domain source tracing based on flow fingerprints. Background technique [0002] With the continuous deepening of informatization in people's daily life, economic development and other fields, the information network has become an important infrastructure of the country. However, risks and benefits always go hand in hand, and cyber threats against data center servers are increasing day by day. The analysis shows that no matter what the principle and means of the attack are, most of them combine the springboard and anonymous communication technology to hide the source and path of the attack. The root cause of this kind of problem is that the identity of the data source is unknown during the data exchange process, which leads to the untraceable malicious attack path. Therefore, the efficient extraction of suspicious attack paths and the accurate locatio...

AI Technical Summary

Problems solved by technology

However, these two methods are vulnerable to loop spoofing, which misleads suspicious path extraction

At the same time, due to the limited capacity of the carrier, the traceability technology based on packet marking has limited marking content, and is vulnerable to false data packets and IP header replacement attacks.

Images