Practical network support for IP traceback

Abstract

This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or "spoofed", source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed "post-mortem" -after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.

Distributed Detection of DDoS Attack

“…DDoS attack detection can be done in various ways such as, Pattern Detection [6], Anomaly Detection [7], Third party detection [8] and Packet Marking [9] etc. For example in [10] The Ganguly et al [14] proposed a solution for detection of DDoS attack, our proposed solution is an extension of Ganguly et al work.…”

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

“…Savage [9] uses the method of statistics to define the function, which means the expected result of the number of marked packets. Let i be the current hops count of the packet, p be the marking probability which the value is 0.04, f be the number of fragments where f is greater than 1, d be the attack path, X be the number of packets and E(X) be the expected number of packets required to reconstruct attack paths.…”

AK-PPM: An Authenticated Packet Attribution Scheme for Mobile Ad Hoc Networks

“…In a marking-based scheme, e.g., probabilistic packet marking (PPM) [9,21], intermediate nodes (probabilistically) mark the packets being forwarded with partial path information, which later on allows a receiver to reconstruct the forwarding path given a modest number of the marked packets.…”