A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking

Yu, S; Zhou, W; Guo, S; Guo, M

A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking

Yu, S

Zhou, W

Guo, S Guo, M

Permalink

Publisher:: IEEE COMPUTER SOC
Publication Type:: Journal Article
Citation:: IEEE Transactions on Computers, 2016, 65, (5), pp. 1418-1427
Issue Date:: 2016-05-01

Closed Access

	Filename	Description	Size
	A_Feasible_IP_Traceback_Framework_through_Dynamic_Deterministic_Packet_Marking.pdf	Published version	584.81 kB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	Yu, S https://orcid.org/0000-0003-4485-6743
dc.contributor.author	Zhou, W https://orcid.org/0000-0002-1680-2521
dc.contributor.author	Guo, S
dc.contributor.author	Guo, M
dc.date.accessioned	2022-01-30T22:14:26Z
dc.date.available	2022-01-30T22:14:26Z
dc.date.issued	2016-05-01
dc.identifier.citation	IEEE Transactions on Computers, 2016, 65, (5), pp. 1418-1427
dc.identifier.issn	0018-9340
dc.identifier.issn	1557-9956
dc.identifier.uri	http://hdl.handle.net/10453/153881
dc.description.abstract	DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.
dc.language	English
dc.publisher	IEEE COMPUTER SOC
dc.relation.ispartof	IEEE Transactions on Computers
dc.relation.isbasedon	10.1109/TC.2015.2439287
dc.rights	info:eu-repo/semantics/closedAccess
dc.subject	0803 Computer Software, 0805 Distributed Computing, 1006 Computer Hardware
dc.subject.classification	Computer Hardware & Architecture
dc.title	A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking
dc.type	Journal Article
utslib.citation.volume	65
utslib.for	0803 Computer Software
utslib.for	0805 Distributed Computing
utslib.for	1006 Computer Hardware
pubs.organisational-group	/University of Technology Sydney
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	/University of Technology Sydney/Faculty of Engineering and Information Technology/School of Computer Science
utslib.copyright.status	closed_access	*
dc.date.updated	2022-01-30T22:14:25Z
pubs.issue	5
pubs.publication-status	Published
pubs.volume	65
utslib.citation.issue	5

Abstract:

DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/153881