第五章 一种基于ICMP信息追溯方法.pdfVIP

Software Engineering and Applications 软件工程与应用, 2017, 6(1), 1‐7  Published Online February 2017 in Hans. /journal/sea  /10.12677/sea.2017.61001    A Method of Information Tracing Based on ICMP Ming Zhou, Sudan Li Department of Computer, National University of Defense Technology, Changsha Hunan      rd st th Received: Feb. 3 , 2017; accepted: Feb. 21 , 2017; published: Feb. 27 , 2017  Abstract In order to trace the DOS/DDOS attack source, people study and put forward some practical and feasible traceability methods; one of the most effective is the reverse retrospective program based on ICMP. However, when the attacker and the average user encounter the same path, in the choice of message to generate traceability information is not so accurate. In this paper, we will propose an improved ICMP information tracing method, which aims to improve the accuracy of retrospec‐ tive attack path, and provide important basis for locating attack source, finding attacker and de‐ fending DOS/DDOS attack. The method is mainly to determine the module in the purpose of se‐ lecting the high frequency attack flow to enter the interface to generate traceback packets, so that the probability of selecting the attack message more tends to 1. Through the experimental analy‐ sis and demonstration, it is nearly 10% higher than the previous method in the generation of ef‐ fective retrospective information, indicating that the retroactive method is more accurate and ef‐ fective than before. Keywords ICMP, DOS/DDOS, Network Security, Information Traceability 一种基于ICMP信息追溯方法 周 明，郦苏丹 国防科学技术大学计算机学院，湖南 长沙