Attack data packet traceability method and system based on dynamic probabilistic dual-domain packet marking

Abstract

An attack packet source tracing method and system based on dynamic probabilistic dual-domain packet marking, the source tracing method includes the following steps: setting the marking space of the dual-domain marking domain; marking the two marking domains with opposite marking strategies; After the attack, the victim host counts all attack packets, and reconstructs the attack path in two steps: (1) all the tag information that appears in the tag field is the router that constitutes the attack path; (2) count the number of occurrences of the tag information; m 1 、m 2 Denote the two label domains in the above label space respectively; m 1 The router with more appearance times is closer to the victim host, and the number of times decreases along the attack path to the attack host; m 2 The router with more occurrences in , the closer to the attacking host, and the number of times decreases along the attack path to the victim host. The invention also provides a system for realizing the above method, which satisfies the requirement of high security in the autonomous local area network.

Description

technical field [0001] The invention belongs to the field of network attack traceability, and in particular relates to a method and system for traceability of attack data packets based on dynamic probability double-domain packet marking. Background technique [0002] In recent years, with the rapid development of the Internet, people store a lot of high-value data in the network. However, the increasingly frequent network attacks make these high-value data or network facilities unable to be effectively secured, which puts forward various requirements for the construction of new networks, including high requirements for security. Institutions such as banks, securities, education, medical care, and government are frequently attacked by cyber attacks, causing huge economic losses. Although these institutions often have a mature internal network system, due to the development of network attack technology, relatively closed internal networks are still difficult to resist high-te...

AI Technical Summary

Problems solved by technology

The marking scheme requires a certain amount of statistics on the attack packets, and it is difficult to accurately reconstruct the attack path when there are few attack packets

The "logging type" scheme has additional requirements for the storage of the router. When the amount of data is large, the log information recorded by the router will be too large and redundant to be stored

Images