论文部分内容阅读
源地址欺骗是一种常见的网络路由攻击方式。传统解决方法是基于入侵检测技术，捕获网络数据包并提取出特征，通过模式匹配方法对特征进行分析，从而对源地址欺骗攻击行为进行报警和阻断。由于源地址欺骗攻击的隐蔽和多变的特点，入侵检测技术在识别源地址欺骗攻击时存在滞后性，对欺骗攻击应变能力差，并且影响正常报文路由。本文提出一种基于路由审计的源地址欺骗解决方案，主机之间通过路由审计判断是否存在源地址欺骗攻击。主机发送审计报文至可疑主机，可疑主机依据审计报文判断是否源地址被盗用，并采取路由加密措施阻断攻击。该解决方案可以准确判断源地址欺骗攻击的存在，并可以快速阻止继续攻击，同时不影响正常报文路由。仿真实验表明，相比传统入侵检测系统 Snort，该解决方案可以有效应对源地址欺骗攻击，并保证正常报文路由不受影响。“,”Source Spoofing is a common way of network routing attacks. Most of the traditional solutions is based on Intrusion Detection. It captures IP packets and extract the features. It analyzes the features by the way of pattern matching method, then alarms and blocks the attack. For the features of hidden and change at time of Source Spoofing, Intrusion Detection has hysteretic nature when it detects the attack. And it has poor adaptability with the attack. It also has a great influence on the normal packets routing. Based on routing accountability, This paper presents a solution of Source Spoofing. Hosts determine whether there is Source Spoofing attack by Rouring Accountability Mechanism. Host sends accountability packets to suspicious host, the suspicious host determine whether its source address is misused. And it encrypts the routing to prevent Source Spoofing attack. The solution could detect Souce Spoofing attack accurately, stops the attack quickly and does not affect the normal packets routing. Simulation results show that, compared to the traditional Intrusion Detection System Snort, the solution can deal with Source Spoofing attack effectively, and ensure that normal packets routing is not affected.