Systems and methods for point of ingress traceback of a network attack

摘要

An apparatus (520) for archiving signatures associated with packets received at a node in a network includes a first memory (620), a second memory (625), a signature tap (610), a multiplexer (615), and a controller (630). The signature tap (610) receives packets at the node and computes one or more signatures for each of the received packets. The multiplexer (615) aggregates the computed one or more signatures in the first memory (620) to produce one or more signature vectors. The controller (630) archives the one or more signature vectors in the second memory (625).