A SINGLE-PACKET IP TRACEBACK: COMBATING DOS-DDOS ATTACKS

Abstract

Cyber-attacks such as Denial of Service (DoS) and Distributed Denial of Service(DDoS) can affect Internet security so that they become a major threat to the computer and computer networks. Therefore, several IP traceback methods were developed to trace back each attack packet to its origin of the attack. These schemes require many packets to trace back the origin of the DoS attack. In this paper, we proposed a novel approach that can trace back the origin of the DoS attack using a single packet-based on Deterministic Packet Marking (DPM) and Probabilistic Router Logging(PRL). Our experimental results, using NS-3 simulator, show that our novel proposed approach can reconstruct the attack path from the victim target to the exact attacker after receiving only a single attack packet. Moreover, this novel proposed approach detects spoofed attack packets in reactive and proactive schemes so that our proposed traceback solution is, therefore, robust because it has a null false positive (negative) rate.