IP Traceback through modified Probabilistic Packet Marking algorithm using Chinese Remainder Theorem

Abstract

Probabilistic Packet Marking algorithm suggests a methodology to identify all the participated routers of the attack path by probabilistically marking the packets. In this approach, these marked packets contain partial information regarding the routers of the attack path. At receiver, to get the complete information of every router, it requires more number of marked packets and hence more combinations and more false positives. To overcome this drawback we have presented a novel idea in finding the exact IP address of the routers in the attack path by applying Chinese Remainder Theorem. The result of our implementation reveals that our idea requires less number of marked packets and takes no time in constructing the attack path. The same idea is true even in the case of multiple attackers. Ó 2014 Faculty of Engineering, Ain Shams University. Production and hosting by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

Deployment and validation of out of band IP traceback approach (OBTA) in wireless mesh network

“…In addition, the Chinese remainder theorem is used by the probabilistic marking solution . This solution allows regaining the marking router IP address.…”

Survey on packet marking fields and information for IP traceback

“…Bahrain et al [7] use the TTL field to know the distance from the router to the destination, by setting an arbitrary initial value and then counting the number of decrements performed.…”

“…Bhavani et al [7] propose a probabilistic marking algorithm based on the Chinese remainder theorem. The IP address of a marking router is divided into four fragments of 8 bits IP 1 , IP 2 , IP 3 and IP 4 .. X is computed as follows:…”

“…The ToS field is often used in its entirety [6], [7], [17]. Only Xiang et al [11] give conditions for the partial or complete use of this field depending on underlying network protocols.…”

“…Marking techniques often need a large amount of data before allowing the complete reconstruction of the packet path. To get around this problem, it can be necessary to consider several packets for the realization of marking services [3], [6], [7], [11], [12]. Therefore the marking information is divided into fragments, each one being associated to a fragment identifier [3], [11], [12].…”