基于GBF的追踪溯源系统设计

摘要

With the rapid development of Internet, network security technology recently excites much inter-est in academia and industry. By tracing and locating the source of network intrusion, IP traceback tech-nology helps defender take targeted defensive measures, and enable to carry out the countermeasures to the attacker, collect information for cyber forensics. This paper firstly introduces the basic method of IP trace-back, then describes GBF(Generalized Bloom Filter) and its application in packet marking. After that, IP traceback system based on GBF is designed and implemented. Experimental results indicate that the system could successfully reconstruct attack path. Finally, this paper summarizes the work that has been done and proposes the research direction in future.%互联网的快速发展引发了学术界和工业界对于网络安全技术的研究热潮，网络攻击追踪溯源技术能够定位网络攻击的源头，为防御方采取有针对性的防御措施和对攻击者进行反制提供必要信息，对于网络取证也有重要意义。首先介绍网络追踪溯源的基本方法；然后，介绍了广义布隆过滤器( Generalized Bloom Filter)及其在包标记追踪溯源中的应用；接着，设计并实现基于GBF的追踪溯源系统，实验表明本系统可以成功重构攻击路径；最后，进行总结并大致描述了今后的研究方向。