Journal of Information Security Reserach ›› 2024, Vol. 10 ›› Issue (4): 302-.

Previous Articles     Next Articles

 A Survey of Forensic Network Attack Source Traceback

Wang Zichen, Tang Yanjun, and Pan Yiyang#br#


  1. (Criminal Investigation Police University of China, Shenyang 110031)

  • Online:2024-04-20 Published:2024-04-21




  1. (中国刑事警察学院公安信息技术与情报学院沈阳110031)
  • 通讯作者: 汤艳君 教授,硕士生导师.主要研究方向为电子数据取证.
  • 作者简介:王子晨 硕士研究生.主要研究方向为网络安全执法技术. 汤艳君 教授,硕士生导师.主要研究方向为电子数据取证. 潘奕扬 硕士研究生.主要研究方向为网络安全执法技术.

Abstract: The concealment and anonymity of cyber attackers pose significant challenges to the field of network attack traceback. This study provides a comprehensive overview of the current state of research on network attack traceback analysis techniques, focusing on three aspects: traffic, scenarios, and samples. Firstly, with respect to traffic traceback, the paper outlines methods and applications based on log records, packet marking, ICMP tracing, and link testing. Secondly, it categorizes traceback techniques for different scenarios, encompassinganonymous networks, zombie networks, springboards, local area networks, and advanced persistent threat attacks, as well as their applications and limitations in realworld environments. Finally, concerning sample analysis, the paper discusses the progress and application scenarios of static and dynamic traceback analysis in the context of malicious code analysis and attack tracing.

Key words: cybersecurity, attribution, network deception, malicious sample traceability, anonymous network traceability

摘要: 网络攻击者的隐藏性和匿名性使得网络攻击溯源技术充满挑战.研究综述了基于流量、场景和样本3个方面的网络攻击溯源分析技术的研究现状.首先,针对流量溯源,总结出基于日志记录、流量包标记、ICMP回溯和链路测试等方法和应用;其次,根据不同场景归纳出匿名网络攻击、僵尸网络攻击、跳板攻击、局域网攻击和高级可持续威胁攻击的溯源技术以及在实际环境中的应用和限制;最后,对于样本分析探讨了静态和动态溯源分析在恶意代码分析及攻击溯源方面的研究进展和应用场景.

关键词: 网络安全, 追踪溯源, 网络欺骗, 恶意样本溯源, 匿名网络溯源

CLC Number: