A Probabilistic Packet Marking Scheme with LT Code for IP Traceback

Abstract

Nowadays, Internet has become the most important technology in daily life. Due to the convenient internet, it brought many security issues in the modern world. In order to overcome these problems, Network Forensics is a good technique to handle such situations. Distributed Denial of Service (DDoS) is one of the most seriously attacks which harms the internet. In order to suspend the victim's service to legitimate users, attackers send many packets to the victim. The servers in victim side will be memory leak and CPU overload when they are under attacked. We need a mechanism to find the attack source and stop the attack. IP Traceback is a great method which is used to reconstruct all the attack paths and find the attack source. A good IP Traceback method needs a great marking scheme which could reconstruct all the attack paths correctly. Probabilistic Packet Marking (PPM) is the more efficient scheme currently. However, it needs lots of marking information to reconstruct all the attack paths. We propose the LT Code IP Traceback (LTCIT) to find the source of attack and reconstruct attack path. It uses the features of Luby Transform Code (LT Code) and the features of Dynamic Probability to mark the partial information of the router to the packet, and then use the decoding method to reconstruct all the attack paths. We will show different performance metrics to evaluate the IP Traceback schemes. The simulation shows that our LTCIT mechanism provides better performance than the traditional IP Traceback scheme.