臺灣博碩士論文加值系統

針對惡意攻擊者於無線網路發動癱瘓服務式攻擊，由於其IP 位置極可能假造，因此遏止攻擊的第一步是追蹤到惡意攻擊者的位置。先前的研究者已發展出許多的追蹤方法，然而其對於無線網路的動態拓撲的特性尚有缺陷。如packet marking等方法需重新收集標記；packet logging等方法反向溯源時，舊路徑已然中斷。因此，我們提出WatchNode方法。利用部建另外一層可信任的監護網路來收集路徑資訊，並以移除環路的技巧來動態修正路徑，找出攻擊來源。隨後更利用追蹤目標常使用的kalman filter來預測攻擊者未來的動向。

For the Denial of Service(DoS) in wireless network lauched by malicious attacker, because of the IP address may be forged, the first step of stopping the attack is trace the location of malicious attacker. Although the previous reaseacher has developed many traceback method, but it is still weak for dynamic network. For instance, the method of packet marking need to re-collect the mark; the method of packet logging will loss the path, when traceback to the source of attacker. For this reason, we propose the method of WatchNode. Using another trusty monitoring network to collect the data of path, and using the technique of remove circle to correct the path dynamically and find out the location of attacker. After the traceback, we using the kalman filter to predict the movement of the attacker.

目錄
摘要......I
Abstract......II
目錄......III
圖目錄......IV
表目錄......V
1 前言......1
2 WatchNode無線追蹤方法......3
2.1 追蹤方法......3
2.1.1 系統模型......3
2.1.2 回傳路徑資訊......4
2.1.3 追蹤攻擊者......6
2.2 預測方法......10
2.2.1 kalman filter......10
2.2.2 預測攻擊者移動......11
3 實驗......13
3.1 模擬環境......13
3.2 成功率......13
3.3 準確度......14
3.4 資源需求量......14
4 結論......16
5 參考文獻......17

圖目錄
圖1.WATCHNODE系統模型......4
圖2.MANET中某一封包MU的傳播路徑P......5
圖3. 802.11 MAC LAYER表頭，灰色表示感測器會抓取的部份......5
圖4.路徑的變動形式......7
圖5.重建路徑的虛擬碼......8
圖6.追蹤範例......9
圖7.KALMAN FILTER反饋循環機制......10
圖8.校正複數KALMAN FILTER的虛擬碼......12
圖9.移動速度對於追蹤方法的影響......13
圖10.移動速度對於追蹤方法之誤差距離的影響......14
圖11.不同的封包傳送速度間，資源需求量的變化......15

表目錄
表格1.感測器回傳資料的封包格式......5
表格2.追蹤請求的資料格式......6
表格3.追蹤記錄......9
表格4.路徑連結的變化......10

[1] R. Akbani, T. Korkmaz and G. Raju, "HEAP: A packet authentication scheme for mobile ad hoc networks," Ad Hoc Networks,vol. 6, pp. 1134-1150, 2008.
[2] B. Al-Duwairi and G. Manimaran, "A novel packet marking scheme for IP traceback," in Parallel and Distributed Systems, 2004. ICPADS 2004. Proceedings. Tenth International Conference on, 2004, pp. 195-202.
[3] P. Bahl and V. N. Padmanabhan, "RADAR: An in-building RF-based user location and tracking system," in INFOCOM 2000. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE, 2000, pp. 775-784 vol. 2.
[4] L. Butti and J. Tinnes, "Discovering and exploiting 802.11 wireless driver vulnerabilities," Journal in Computer Virology, vol. 4, pp. 25-37, 2008.
[5] E. Cayirci and C. Rong, Security in Wireless Ad Hoc and Sensor Networks. John Wiley & Sons Inc, 2009.
[6] B. C. Cheng, H. Chen and G. T. Liao, "FBT: an efficient traceback scheme in hierarchical wireless sensor network," Security and Communication Networks, vol. 2, pp. 133-144, 2009.
[7] B. C. Cheng, H. Chen, Y. J. Li and R. Y. Tseng, "A packet marking with fair probability distribution function for minimizing the convergence time in wireless sensor networks," Comput. Commun., vol. 31, pp. 4352-4359, 2008.
[8] A. Das, S. Agrawal and S. Vishwanath, "On algebraic traceback in dynamic networks," in Information Theory Proceedings (ISIT), 2010 IEEE International Symposium on, 2010, pp. 1903-1907.
[9] D. Dean, M. Franklin and A. Stubblefield, "An algebraic approach to IP traceback," ACM Transactions on Information and System Security (TISSEC), vol. 5, pp. 119-137, 2002.
[10] C. Hanus and M. Hanus, "802.11 Wireless And Wireless Security," Review of Business Information Systems (RBIS), vol. 8, pp. 35-49, 2011.
[11] A. Helmy, "Small worlds in wireless networks," Communications Letters, IEEE, vol. 7, pp. 490-492, 2003.
[12] P. Hoh and B. Yoon, "IP traceback methodology using markov chain and bloom filter in 802.16e," in Convergence and Hybrid Information Technology, 2008. ICCIT'08. Third International Conference on, 2008, pp. 454-459.
[13] J. Hornsberger and G. C. Shoja, "Geographic grid routing for wireless sensor networks," in Networking, Sensing and Control, 2005. Proceedings. 2005 IEEE, pp. 484-489.
[14] Y. Huang and W. Lee, "Hotspot-based traceback for mobile ad hoc networks," in Proceedings of the 4th ACM Workshop on Wireless Security, 2005, pp. 43-54.
[15] X. Jin, Y. Zhang, Y. Pan and Y. Zhou, "ZSBT: a novel algorithm for tracing DoS attackers in MANETs," EURASIP Journal on Wireless Communications and Networking, vol. 2006, pp. 82, 2006.
[16] Y. Jing, X. Wang, X. Xiao and G. Zhang, "A logless fast IP traceback scheme against DDoS attacks in wireless ad-hoc network," in Wireless, Mobile and Multimedia Networks, 2006 IET International Conference on, 2009, pp. 1-4.
[17] R. E. Kalman, "A new approach to linear filtering and prediction problems," Journal of Basic Engineering, vol. 82, pp. 35-45, 1960.
[18] I. Y. Kim and K. C. Kim, "A resource-efficient IP traceback technique for mobile ad-hoc networks based on time-tagged bloom filter," in Third 2008 International Conference on Convergence and Hybrid Information Technology,2008, pp. 549-554.
[19] Y. Kim and A. Helmy, "SWAT: Small world-based attacker traceback in ad-hoc networks," in Mobile and Ubiquitous Systems: Networking and Services, 2005. MobiQuitous 2005. the Second Annual International Conference on,2005, pp. 85-96.
[20] S. Kumar, T. H. Lai and J. Balogh, "On k-coverage in a mostly sleeping sensor network," in Proceedings of the 10th Annual International Conference on Mobile Computing and Networking, 2004, pp. 144-158.
[21] H. Lee, V. Thing, Y. Xu and M. Ma, "ICMP traceback with cumulative path, an efficient solution for IP traceback," Information and Communications Security, pp. 124-135, 2003.
[22] Q. Li and D. Rus, "Global clock synchronization in sensor networks," IEEE Trans. Comput., pp. 214-226, 2006.
[23] H. Luo, F. Ye, J. Cheng, S. Lu and L. Zhang, "TTDD: two-tier data dissemination in large-scale wireless sensor networks,"Wireless Networks, vol. 11, pp. 161-175, 2005.
[24] K. Park and H. Lee, "On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack," in INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE, 2002, pp. 338-347.
[25] P. Rong and M. L. Sichitiu, "Angle of arrival localization for wireless sensor networks," in Sensor and Ad Hoc Communications and Networks, 2006. SECON'06. 2006 3rd Annual IEEE Communications Society on, 2006, pp. 374-382.
[26] S. Savage, D. Wetherall, A. Karlin and T. Anderson, "Practical network support for IP traceback," in Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2000, pp. 295-306.
[27] A. C. Snoeren, "Hash-based IP traceback," in Proceedings of the 2001 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, 2001, pp. 3-14.
[28] D. X. Song and A. Perrig, "Advanced and authenticated marking schemes for IP traceback," in INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE, 2002, pp. 878-886.
[29] D. Sy and L. Bao, "CAPTRA: Coordinated packet traceback," in Proceedings of the 5th International Conference on Information Processing in Sensor Networks, 2006, pp. 152-159.
[30] V. L. L. Thing, H. C. J. Lee, M. Sloman and J. Zhou, "Enhanced ICMP traceback with cumulative path," in Vehicular Technology Conference, 2005. VTC 2005-Spring. 2005 IEEE 61st, 2005, pp. 2415-2419.
[31] M. Waldvogel, "GOSSIB vs. IP traceback rumors," in Computer Security Applications Conference, 2002. Proceedings. 18th Annual, 2003, pp. 5-13.
[32] J. Xu, X. Zhou and F. Yang, "Edge-based traceback in sensor networks," in Wireless Communications Networking and Mobile Computing (WiCOM), 2010 6th International Conference on, pp. 1-4.
[33] F. Yang, X. Zhou and S. Zhang, "Hierarchical traceback in wireless sensor networks," in Wireless Communications, Networking and Mobile Computing, 2008. WiCOM'08. 4th International Conference on, 2008, pp. 1-4.
[34] F. Yang, X. Zhou, Q. Zhang and J. Xie, "On the performance of probabilistic packet marking for traceback in sensor networks," in Consumer Communications and Networking Conference, 2008. CCNC 2008. 5th IEEE, 2008, pp. 682-686.
[35] Ming Hour Yang, Chien-Si Chiu and S. Shieh, "Tracing mobile attackers in wireless ad-hoc network," in Internet and Web Applications and Services, 2008. ICIW '08. Third International Conference on, 2008, pp. 7-12.
[36] T. Yatagai, I. Sasase and M. Ishii, "Hierarchical traceback method using clustering for mobile ad hoc networks," in Personal, Indoor and Mobile Radio Communications, 2009 IEEE 20th International Symposium on, 2010, pp. 2623-2627.
[37] F. Ye, H. Yang and Z. Liu, "Catching Moles in Sensor Networks," Distributed Computing Systems, International Conference on, pp. 69, 2007.
[38] F. Zarai, S. Rekhis, N. Boudriga and K. Zidane, "SDPPM: An IP traceback scheme for MANET," in Electronics, Circuits and Systems, 2005. ICECS 2005. 12th IEEE International Conference on, 2008, pp. 1-4.
[39] Q. Zhang, X. Zhou, F. Yang and X. Li, "Contact-based traceback in wireless sensor networks," in Wireless Communications, Networking and Mobile Computing, 2007. WiCom 2007. International Conference on, 2007, pp. 2487-2490.
[40] The Network Simulator(ns-3), http://www.nsnam.org/