臺灣博碩士論文加值系統

分散式阻斷服務攻擊在網際網路上越來越盛行。同時，隨著無線網路頻寬的擴大，無線網路也成為攻擊者一個可以發動攻擊的來源。然而，相較於有線網路，在無線網路中追踨攻擊者比在有線網路中困難，特別是在Ad-hoc模式下。無線網路的特性中，攻擊者可以隨意的改變他們的位置去躲避追踨；更甚，在Ad-hoc模式下，只要借助中繼點的移動，就可以隱藏他們的位置。目前，現有的有線網路下的追踨方法並不能直接套用在有移動能力和架構限制的無線網路環境。有些人試著以封包記錄的方式來解決這個問題，但在Ad-hoc網路中使用依靠中繼點的方式是不合理的。我們提出一個有彈性而且輕量的追踨方式，並以封包標記的方式來針對無線隨意網路下，任何節點都可能移動的情況下，追蹤任意偽造來源位址的攻擊者。

1 Introduction 1
2 Related work 4
3 Mobile Attacker Tracing Scheme 8
3.1 Symbol and Environment Definition 8
3.1.1 Trace attack hosts in Wired and Wireless network 8
3.1.2 Symbol definition 9
3.1.3 Wired Traceback 10
3.2 Traceback Marking 11
3.3 Mobility 13
3.3.1 Construct Route Graph History 14
3.4 Traceback 16
3.4.1 Tracking Attacker Movement 17
3.4.2 The movement of intermediate node 21
3.5 Normadic Support 25
3.6 Analysis 26
3.6.1 Un-successful Traceback Analysis 26
4 Simulation 29
4.1 Simulation on Intermediate Movement Elimination 29
4.2 Simulation on Spoofing Source Attacker 30
5 Conclusion 33
References 34

[1] Vern Paxson, "An analysis of using reflectors for distributed denial-of-service attacks," ACM Comp. Comm. Review, vol. 31, no. 3, 2001.
[2] David Moore, GeoRrey M. Voelker, and Stefan Savage, "Inferring internet Denial-of-Service activity," in In proceedings of the 2001 USENIX Security Symposium, 2001, pp. 9-22.
[3] M. Corporation, "Stop 0A in tcpip.sys when receiving out of band(OOB) data,"http://support.microsoft. com/support/kb/articles/Q143/4/78.asp.
[4] J. Postel, "Ineternet Protocol," RFC 791, IETF, Spe 1981.
[5] Paul Ferguson and Daniel Senie, "Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing," RFC 2827, IETF, May 2000.
[6] Steven M. Bellovin, "Icmp traceback messages," IETF Draft, 2000, http://www.research.att.com/smb/papers/draft-bellovin-itrace-00.txt.
[7] Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Beverly Schwartz, Stephen T. Kent, and W. Timothy Strayers, "Hash-Based IP Traceback," in ACM SIGCOMM '01, August 2001.
[8] Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Beverly Schwartz, Stephen T. Kent, and W. Timothy Strayers, "Single-Packet IP Traceback," IEEE/ACM Transactions on Networking, vol. 10, no. 6, pp. 721-734, December 2002.
[9] Stefan Savage, DavidWetherall, Anna Karlin, and Tom Anderson, "Network Support for IP Traceback," IEEE/ACM Transactions on Networking, vol. 9, no. 3, pp. 226-237, June 2001.
[10] Hal Burch and Bill Cheswick, "Tracing anonymous packets to their approximate source," In Proc. USENIX LISA '00, December 2000.
[11] D. X. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IP Traceback Messages," in Proc. IEEE Infocom '01, April 2001.
[12] C. Perkins, "Ad hoc on demand distance vector (aodv) routing," 1997.
[13] David B. Johnson, David A. Maltz, and Yih-Chun Hu, "The Dynamic Source Routing Protocol for Mobile Ad Hoc Networks (DSR)," IETF Draft, 2004, http://www.ietf.org/internet-drafts/draft-ietf-manet-dsr-10.txt.
[14] Yi an Huang and Wenke Lee, "Hotspot-based traceback for mobile ad hoc networks," in WiSe '05: Proceedings of the 4th ACM workshop on Wireless security, New York, NY, USA, 2005, pp. 43-54, ACM Press.
[15] Burton H. Bloom, "Space/Time Trade-ORs in Hash Coding with Allowable Errors," Communication of ACM, vol. 13, no. 7, pp. 422-426, July 1970.
[16] J. Reynolds J. Postel, "TELNET PROTOCOL SPECIFICATION," RFC 854, IETF, May 1983.
[17] Steven McCanne and Sally Floyd, "ns Network Simulator," http://www.isi.edu/nsnam/ns/.