Abstract:

Packet marking is a commonly used IP traceback algorithm, which marks the path information into the IP header and is able to reconstruct the attack path according to the marked information so as to find the attack source. The marked information is not much due to the limited mark area, so several marked packets are required to reconstruct an attack path, resulting in high complexity, low efficiency and poor accuracy of path reconstruction algorithms. To address this problem, a path reconstruction algorithm based on Huffman code was proposed, which marks the link information into the mark area and does not need to store the marked information into intermediate nodes. The proposed algorithm is applicable to IPv6 networks and only requires a single marked packet to reconstruct the entire attack path. The experiment shows that the proposed algorithm is fast and has high efficiency and accuracy.

Key words: DDoS;IPv6;packet marking;Huffman