Although cybercrime and cyber threats are increasing significantly, yet prevention and security of the critical infrastructure are still far from perfect. The internet has no protection against malicious packet modifications. Attackers exploit such vulnerabilities to forge the source IP addresses while instigating an attack. Consequently, investigating cybercrime is becoming extremely difficult. The best antidote would be to weed out the problem at its root by identifying the source of the attack. The objective of this study is to propose an IP traceback scheme that can identify the origin of an attack with a single packet with minimum computational and storage overhead while ensuring a high degree of accuracy. Compared to the state-ofthe-art single packet IP traceback technique, the proposed scheme entails lesser computation overhead. According to CAIDA topology dataset, it requires only 320 kB of storage on each router. Storage requirement is several thousand times lesser than the pioneer single packet traceback scheme and 6.25 times lesser than the state-of-the-art traceback scheme. It has the better endurance to the change in topology compared with the state-of-the-art schemes. It identifies the attack node with high accuracy and minimal false positive. The obtained result has been validated to demonstrate its statistical significance.

The problem of identifying DDoS (Distributed Denial of Service)Attack is one of the prevalent threats in the field of Internet security. The difficulty lies in distinguishing the attack traffic from the normal traffic, as their attack origin is often hidden. Several techniques are used to detect and identify the source of DDoS attack. One of the most popular techniques in identifying the attack source is the IP traceback mechanism. Different kinds of traceback approaches are proposed with each having its own advantages and disadvantages. This paper presents and evaluates some of the existing and recently evolving IP traceback techniques with respect to their pros and cons.