A Research On Cooperative Packet Traceback

Nowadays,such as Distributed Denial of Service attacks,various types of network attacks have caused serious challenges to the security of cyberspace,brought great losses to the economy and society,and even caused threats to national security.Tracing the origin of network attack packets has been a hot topic in the field of network security.Traceback is a technology to locate the attacker through the network,and locate the media of the attack and restore the attack path.Due to various reasons,it is almost impossible to detect network-wide deployment message deployments,and existing distributed deployment solutions cannot obtain good traceability accuracy.This thesis presents an IP traceability algorithm based on partially deployed detection nodes and verifies its feasibility through simulation.This thesis also proposes a Cooperative traceaback system based on this algorithm and verifies its feasibility.This thesis has effectively solved the partial deployment method in the network node,and still obtained high accuracy of traceability,and effectively reduced the space occupied by the acquisition of information in the network.The main contributions of this thesis are as follows:(1)This thesis analyzes the main implementation of the existing traceback system by deploying in the whole network,and different from its difficult deployment and inefficient storage space utilization,this thesis proposes a part-deployment traceability algorithm and two kinds of partial deployment acquisition node selection algorithms,which effectively solves the 100% traceability accuracy achieved by selecting only some node deployments in the network.Based on the Mininet+Floodlight platform,the simulation can verify the accuracy of traceability.(2)Based on the proposed partial deployment traceability algorithm,this thesis proposes a practically deployable Cooperative packet traceback system.The structure and principle is discussed in detail,and the specific design considerations and implementation methods are discussed in modules.Finally,by opening several virtual machines on the servers and using them for networking,it is verified that the system can accurately locate the attack source and verify its feasibility.