科研成果详情

Distributed Denial-of-service (DDoS) attack is a serious kind of threat to the Internet. IP traceback is a significance part of defending against DDoS attacks. For this reason, a variety of approaches for IP traceback have been proposed, of which some incur high overhead at routers, some need packet marking, and some could only trace connections, other than any single-packet, back to its origin. In this paper, we propose a blind detection approach to find the real source of each single-packet in mixed traffic, bringing low overhead to the Internet. In our approach, we firstly propose using the time-specified context and the dimension-specified context as the feature of a packet. Secondly, we propose using the matching window to improve the performance of our algorithm. Thirdly, we use Cao method and Multi-Laplace distribution model to determine the parameters of features' windows. There is no need of any prior knowledge for this blind detection. We test our algorithm in the Internet. The results show that the performance of our algorithm is better than that of the previous work.