A Hybrid Optimization Algorithm Based on Ant Colony and Particle Swarm Algorithm to Address IP Traceback Problem

Saini, Amrita; Ramakrishna, C.; Kumar, Sachin

doi:10.1007/978-981-13-0617-4_43

Cited by 4 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The primary objective is to utilize and combine existing methods to leverage their strengths. The core idea of packet marking method [11][12][13][14][15][16] is to record routing information within the packet itself, allowing the victim to trace the packet's transmission path. A packet can carry complete encoded routing information or have one or more markers inserted by intermediate routers.…”

Section: Al Proposed a Flooding Technique Inmentioning

confidence: 99%

IGPPM: interface grouped probabilistic packet marking scheme for IP traceback

Yang,

Chen,

Guo

2024

Second International Conference on Informatics, Networking, and Computing (ICINC 2023)

View full text Add to dashboard Cite

The Data Packet Marking method is a classic and effective approach for Internet Protocol (IP) traceback, and it has two traditional implementations -Deterministic Packet Marking (DPM) and Probabilistic Packet Marking (PPM). However, these two methods have certain shortcomings: DPM appends routing information for each hop to the packet header to achieve single-packet traceback, which results in oversized packet headers and fragmentation issues. PPM, on the other hand, includes only a single router's information in each marked packet, requiring a large number of marked packets for IP traceback. The IGPPM approach proposed in this article overcomes these limitations by marking multiple router interface numbers within a single packet. This allows recording multiple routing information within a single packet, effectively reducing the number of packets and the time required for traceback. Furthermore, it doesn't increase packet header size, avoiding fragmentation problems, and enhancing the efficiency of traceback.

show abstract

Section: Al Proposed a Flooding Technique Inmentioning

confidence: 99%

IGPPM: interface grouped probabilistic packet marking scheme for IP traceback

Yang,

Chen,

Guo

2024

Second International Conference on Informatics, Networking, and Computing (ICINC 2023)

View full text Add to dashboard Cite

show abstract

“…(1) Link testing [18,19] is often used to trace back the attacking path and the attacking source in real time. (2) e packet marking methods [2,3,20] are characterized by inserting the required traceability data into the IP packet to be traced, thus marking the packet as it travels through the forwarding network facilities (switches or routers) to the destination host. e packet marking schemes only use the information embedded in packets without generating additional traffic.…”

Section: Related Workmentioning

confidence: 99%

“…Internet Protocol (IP) traceback is a method of reconstructing the attacking path and identifying the source of the attacker, with the message provided by the network devices where the attacking packets are forwarded. However, the effectiveness of traditional traceback schemes is affected by different problems, such as IP spoofing, packet length limits, and additional communication overhead [2][3][4][5]. Among them, IP spoofing means attackers often forge the source IP address of packets, resulting in low traceability accuracy.…”

Section: Introductionmentioning

confidence: 99%

A Low-Overhead and High-Precision Attack Traceback Scheme with Combination Bloom Filters

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Distributed denial of service attacks seriously threatens the availability of highly resilient software-defined networking systems, such as data center networks. A traceback scheme is an effective means of mitigating attacks by identifying the location of the attacker and the attacking path. However, traditional traceback schemes suffer from low traceability success rates, high packet header overheads, and high communication traffic overheads, in addition to the fact that logically centralized traceability schemes make the control plane a prime target for attacks. To overcome the above challenges, we propose the low-overhead and high-precision traceback scheme, which is divided into two stages: packet marking and path reconstruction. The first stage of the traceback scheme utilizes programmable switches in the data plane to selectively mark the actual physical path information that the packet was forwarded on. The marking method is adaptive to the path length, which utilizes a combined Bloom filter so that the packet length does not grow with the length of the attacking path. The proposed probabilistic packet marking algorithm effectively reduces the number of packets collected to reconstruct the attacking path. The second stage of the traceback scheme utilizes the distributed victim host to reconstruct the attacking path without the controller and locate the source of the attacker. Theoretical analysis and experimental results show that the proposed scheme ensures the high accuracy of tracing and minimizes the traffic overhead and storage overhead required for the traceback process.

show abstract

“…The marking rate in is depends on trustable nodes or not. To trace back an attack using a single packet, research has proposed the packet logging traceback [24] [25] [26] [27] and hybrid IP traceback [28] [38].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Multilayer Network Traceback to the Real Sources of Attack Devices

et al. 2020

View full text Add to dashboard Cite

In recent years, multiple connected devices and diversified network services have made the Internet an indispensable part of people's daily lives. As a result, copious valuable or personal data are stored online, attracting many malicious attackers and causing serious security threats. However, because attackers can conceal their actual attack locations by spoofing IP addresses, law enforcement cannot easily track them. Therefore, a method to trace stealth attacks is required. However, the traceback methods detailed in other studies all possess disadvantages. For example, they can only trace the attacker's edge router and cannot traceback to the actual device that launched the attack. In an environment where the core network includes a switch, several current IP traceback methods cannot correctly traceback the true attacker. Conventional IP traceback methods that traceback only attackers on the network layer and cannot infer the path information of a packet traversing the switch. This paper proposes a method to simultaneously traceback attack sources at the network layer and the data link layer. Using the method proposed in this paper, only a single packet is required to traceback the source of a stealth attack. Even if the core network contains a switch or if multiple attackers launch attacks from different locations, the method can correctly traceback the true devices responsible for the attacks, and its achievements include a zero false negative rate and a low false positive rate.

show abstract

A Hybrid Optimization Algorithm Based on Ant Colony and Particle Swarm Algorithm to Address IP Traceback Problem

Cited by 4 publications

References 13 publications

IGPPM: interface grouped probabilistic packet marking scheme for IP traceback

IGPPM: interface grouped probabilistic packet marking scheme for IP traceback

A Low-Overhead and High-Precision Attack Traceback Scheme with Combination Bloom Filters

Hybrid Multilayer Network Traceback to the Real Sources of Attack Devices

Contact Info

Product

Resources

About