Hybrid Single-Packet IP Traceback with Low Storage and High Accuracy

Ming Hour Yang

doi:10.1155/2014/239280

Abstract

Traceback schemes have been proposed to trace the sources of attacks that usually hide by spoofing their IP addresses. Among these methods, schemes using packet logging can achieve single-packet traceback. But packet logging demands high storage on routers and therefore makes IP traceback impractical. For lower storage requirement, packet logging and packet marking are fused to make hybrid single-packet IP traceback. Despite such attempts, their storage still increases with packet numbers. That is why RIHT bounds its storage with path numbers to guarantee low storage. RIHT uses IP header's ID and offset fields to mark packets, so it inevitably suffers from fragment and drop issues for its packet reassembly. Although the 16-bit hybrid IP traceback schemes, for example, MORE, can mitigate the fragment problem, their storage requirement grows up with packet numbers. To solve the storage and fragment problems in one shot, we propose a single-packet IP traceback scheme that only uses packets' ID field for marking. Our major contributions are as follows: (1) our fragmented packets with tracing marks can be reassembled; (2) our storage is not affected by packet numbers; (3) it is the first hybrid single-packet IP traceback scheme to achieve zero false positive and zero false negative rates.

Highlights

With the rapid growth of the internet, various internet applications have been developed for different purposes
Like MRT and MORE, their storage requirements increase with packet numbers
We propose a new hybrid single-packet traceback scheme that uses only 16 bits for marking

Summary

Introduction

With the rapid growth of the internet, various internet applications have been developed for different purposes. To trace the origins of software exploit attacks with only one packet, Snoeren et al propose SPIE [11] to digest the unchanged parts of a packet and use a bloom filter [12] to log the digests This scheme requires large storage and has false positives because their packet digests in each log table may have collision [11]. Despite the fact that current hybrid IP traceback schemes have been able to track single packet attacks and that RIHT has reduced the storage requirement to an extent that a router does not need to refresh its tracing logs, packet fragmentation and packet drop issues can still fail their path reconstruction.

Related Work

A 16-Bit Hybrid Single Packet Traceback Scheme

Performance Evaluation and Analysis

Conclusion