IP traceback through modified probabilistic packet marking algorithm

Abstract

Denial of service (DOS) attack is one of the most common attacks on the internet. The most difficult part of this attack is to find the source of the denial of service (DOS) attack. Savage et al. proposed PPM algorithm to traceback the route to the attacker. We found two disadvantages of the Savage traceback technique. The first disadvantage is probability of finding of far away routers is very less which results in losing some of the routers identity. This affects the attack graph construction. The second disadvantage is, because of re-marking of the edges the constructed graph contain new edges which do not exist in attack graph. In this paper, we propose a modified probabilistic packet marking (MPPM) IP traceback methodology and we found that the results are quite interesting when compared with the approach proposed by Savage.

Survey on Packet Marking Algorithms for IP Traceback

“…In this technique each router in the attack path as shown in fig.2 marks the packet with the partial IP address information called the marking information. This marking information is placed into the IP packet with a fixed probability 5,12 .…”

Traceback model for identifying sources of distributed attacks in real time

“…The most significant traceback strategies related to the proposed system have been implemented using probabilistic packet marking (PPM) or deterministic packet marking (DPM) . In PPM, each router probabilistically marks packets with its IP address.…”

IP Traceback through modified Probabilistic Packet Marking algorithm using Chinese Remainder Theorem

“…If rand is less than the threshold marking probability P m and if flag field is equal to 0, then the packet is marked. This is done by setting the TOS field with the fragment number, identification field with the fragment (any two successive parts of X value), TTL field with distance and finally flag to 1 indicating that it has been marked [8]. When the same packet is selected to mark by the subsequent router, as the flag is set to 1, only the distance field is decremented keeping the remaining fields unaltered.…”

“…Let Restable be a table of tuples(fragno, fragment, distance) for each packet pkt from attacker Restable.Insert(pkt.fragno, pkt.fragment, pkt.distance) if pkt.distance > maxd then maxd: = pkt.distance Remove duplicates from the Restable /* delete from Restable where ID not in (select min(ID) from Restable group by fragno, fragment, distance) */ Let S d be empty for 0 6 d 6 maxd for d: = 0 to maxd /* Select pkt.fragno, pkt.fragment from Restable pkt, Restable pkt1 where pkt.substr(0,7) = pkt.substr (8,15) and pkt.distance = d ordered by pkt.fragno */ for all ordered combinations and successive fragments if(pkt.substring(8,15) = pkt1.substring(0,7) /* where pkt and pkt1 are two successive fragments */ if(pkt.fragno = 0) S d = pkt.fragment else S d = Concatenate(S d , pkt.substring(8,15)) for d = 0 to maxd firstpart = pkt.substring(0,7); lastpart = pkt.substring(32,40); if(firstpart = lastpart) X dec = S d .substring(0, 32) Convert X dec from decimal to binary and store in X /* Find IP 1 IP 2 IP 3 IP 4 using CRT */ IP 1 = X mod 251 IP 2 = X mod 253 IP 3 = X mod 255 IP 4 = X mod 256 Combined IP address = (IP 1 . IP 2 .…”