IP Traceback Schemes Research Articles

Development of Internet Protocol Traceback Scheme for Detection of Denial-of-Service Attack

To mitigate the challenges that Flash Event (FE) poses to IP-Traceback techniques, this paper presents an IP Traceback scheme for detecting the source of a DoS attack based on Shark Smell Optimization Algorithm (SSOA). The developed model uses a discrimination policy with the hop-by-hop search. Random network topologies were generated using the WaxMan model in NS2 for different simulations of DoS attacks. Discrimination policies used by SSOA-DoSTBK for the attack source detection in each case were set up based on the properties of the detected attack packets. SSOA-DoSTBK was compared with a number of IP Traceback schemes for DoS attack source detection in terms of their ability to discriminate FE traffics from attack traffics and the detection of the source of Spoofed IP attack packets. SSOA-DoSTBK IP traceback scheme outperformed ACS-IPTBK that it was benchmarked with by 31.8%, 32.06%, and 28.45% lower FER for DoS only, DoS with FE, and spoofed DoS with FE tests respectively, and 4.76%, 11.6%, and 5.2% higher performance in attack path detection for DoS only, DoS with FE, and Spoofed DoS with FE tests, respectively. However, ACS-IPTBK was faster than SSOA-DoSTBK by 0.4%, 0.78%, and 1.2% for DoS only, DoS with FE, and spoofed DoS with FE tests, respectively. Keywords : DoS Attacks Detection, Denial-of-Service, Internet Protocol, IP Traceback, Flash Event, Optimization Algorithm.

HPSIPT: A high-precision single-packet IP traceback scheme

Distributed Denial of Service (DDoS) attack remains a major threat, even in the era of connected devices. Attackers often hide their identity, making defending or identifying and subsequently prosecuting them difficult. In this paper, we propose a novel high-precision single-packet IP traceback (HPSIPT) scheme that facilitates the trace back of each spoofed packet to its origin. Numerous IP trace back techniques for tracing attackers exist; however, they are limited either by the number of packets required or the storage and computational overheads incurred at the routers. By contrast, the proposed technique incurs negligible storage and computational overheads. Simulation results based on real-world Internet topologies (obtained from CAIDA) reveal that the proposed IP traceback scheme has a precision of 0.9751, accuracy of 0.9053, recall of 0.8580 and an F1 score of 0.9128 when tracing 130,000 attackers. The implementation of the proposed scheme requires less than 10 KB of storage in most routers, which is approximately 32 times less than that required by other state-of-the-art single-packet traceback techniques. The efficacy of the proposed scheme is compared with that of other single-packet traceback schemes in terms of computational time, storage, accuracy, precision, recall and F1 score. Statistical tests are performed to support the statistical significance of the obtained results.

Design and analysis of hybrid single packet IP traceback scheme

Although cybercrime and cyber threats are increasing significantly, yet prevention and security of the critical infrastructure are still far from perfect. The internet has no protection against malicious packet modifications. Attackers exploit such vulnerabilities to forge the source IP addresses while instigating an attack. Consequently, investigating cybercrime is becoming extremely difficult. The best antidote would be to weed out the problem at its root by identifying the source of the attack. The objective of this study is to propose an IP traceback scheme that can identify the origin of an attack with a single packet with minimum computational and storage overhead while ensuring a high degree of accuracy. Compared to the state-of-the-art single packet IP traceback technique, the proposed scheme entails lesser computation overhead. According to CAIDA topology dataset, it requires only 320 kB of storage on each router. Storage requirement is several thousand times lesser than the pioneer single packet traceback scheme and 6.25 times lesser than the state-of-the-art traceback scheme. It has the better endurance to the change in topology compared with the state-of-the-art schemes. It identifies the attack node with high accuracy and minimal false positive. The obtained result has been validated to demonstrate its statistical significance.

Implementation of single‐packet hybrid IP traceback for IPv4 and IPv6 networks

The Internet and other computing technologies have seen rapid growth in the recent years; the malicious users continue to look for vulnerabilities in the Internet infrastructure to perform various types of attacks. Distributed denial-of-service attack is an attack in which licit users are repudiated the access to available resources either temporarily or indefinitely. To establish liability for these attacks, there is a need to scout for real attack sources. Schemes that identify the source of packets on the Internet are called IP traceback schemes. Hybrid IP traceback schemes outdo discrete marking and logging approaches and trace the source of attack using a few packets. The findings of this research redound to current single-packet hybrid IP traceback schemes by employing the double hashing technique to resolve collisions in the hash table and thus reducing the logging time at routers by 15%. Besides, the proposed scheme ensures zero false positives by encoding the options field in IPv4 header. The research also introduces the first single-packet hybrid IP traceback implementation for IPv6 networks using hop-by-hop extension header. The simulation results correctly demonstrate the viability of the proposed scheme and unveil that IPv6 implementation requires 82.5% less storage in contrast to existing work.

Secured Icmp Based Ip Traceback Scheme To Trace The Spoofed Ip Locations

The Internet Protocol (IP) is the basic protocol for sending data over the Internet and many other computer networks. IP spoofing is the creation of Internet Protocol (IP) packets with a forged source IP address, with the purpose of thrashing the identity of the sender or an attacker can make it appear that the packet was sent by a different machine. The objective of this paper is to devise the passive IP trace back (PIT) scheme using Internet Control Message Protocol(ICMP) to avoid the operational obstacles of IP trace back schemes. PIT investigates ICMP error messages (path backscatter) triggered by spoofing traffic, and tracks the spoofers based on public available information (eg.topology). This scheme(PIT) discover the spoofers without any operational requirement and exhibits the causes, collection, and the statistical results on path backscatter, demonstrates the processes and effectiveness of PIT, and shows the captured locations of spoofers throughout applying PIT on the path backscatter data set. These results are capable of expose the spoofed IP locations.

Defending against DDoS Attacks under IP Spoofing Using Image Processing Approach

This paper presents a novel defense scheme for attacks that uses an image processing method. This scheme especially focused on the prevalence of adjacent neighbor spoofing, called subnet spoofing. It is rarely studied and there is few or no feasible approaches than other attacks. The key idea is that a DDoS attack with IP spoofing is represented as a specific pattern such as a line on the spatial image planes, which can be recognized through an image processing technique. Applying the clustering technique to the lines makes it possible to identify multiple attack source networks simultaneously. For the identified networks in which the zombie hosts reside, we then employ a signaturebased pattern extraction algorithm, called a pivoted movement, and the attacks are filtered by correlating the IP and media access control pairing signature. As a result, this proposed scheme filters attacks without disturbing legitimate traffic. Unlike previous IP traceback schemes such as packet marking and path fingerprinting, which try to diagnose the entire attack path, our proposed scheme focuses on identifying only the attack source. Our approach can achieve an adaptive response to attacks, thereby mitigating them at the source, while minimizing the disruption of legitimate traffic. The proposed scheme is analyzed and evaluated on the IPv4 and IPv6 network topology from CAIDA, the results of which show its effectiveness.

Using network motifs to investigate the influence of network topology on PPM-based IP traceback schemes

Multiple schemes that utilize Probabilistic Packet Marking (PPM) have been proposed to deal with Distributed Denial of Service (DDoS) attacks by reconstructing their attack graphs and identifying the attack sources. By analyzing a set of PPM-based schemes, we show that past researchers have evaluated the schemes using disparate and often inadequate underlying topologies, which makes a side-by-side comparison of the scheme performance a complex problem.To tackle this problem, we evaluate selected schemes on a large set of Internet-like topologies and adapt the network motif approach to provide a common ground for comparing the schemes’ performances in different network topologies. This approach allows us to determine the level of structural similarity between network topologies and consequently enables the comparison of scheme performance even when the schemes are implemented on different topologies.Our results reveal that both the value of the PPM-based schemes’ convergence times, and their rankings vary depending on the underlying network topology. However the variation is considerably less when the topologies are compared within superfamilies of structural similarity. More specifically, the standard deviation in convergence times across the networks drops to about a tenth of its original value when the set of 28 networks are arranged in four superfamilies. To complement our results, we present an analytical model showing a link between scheme performance in any superfamily, and the motifs exhibited by the networks in that superfamily.Our work proposes an effective way of comparing general network protocol performance in which the protocol is evaluated on specific representative networks instead of an entire set of networks.

A Secure Cryptographic Puzzle based Approach Ensuring Total Security for transmitted Information with IP Tracing

Today internet is extremely affected by several attacks such as Denial-of-Service attacks. The source IP address in a packet can be falsified. Thus IP Protocol fails to determine the originator. The attacker performs IP Spoofing and creates attacks. Thus for determining the real source of the attacker several IP Traceback schemes come forward. The available schemes have their own advantages and disadvantages. Computational Complexity is considered as common drawback. With the aim of overcoming the drawback an IP Traceback Digital Signature Algorithm is used for ensuring security for the transmitted data using Socket communication As all the available methodologies for IP Traceback, the current approach also focuses only on tracing attacker. With the aim of ensuring a Total security, a Cryptographic puzzle based scheme is also incorporated along with the new approach for preventing Hackers. Here certain puzzles are also used for encrypting the message along with the available methodology. Here the opponent cannot solve the puzzle until the encrypted packet reaches the destination. . The scheme is implemented based on a share market based application. The security of the scheme is also analyzed.

Hybrid Single-Packet IP Traceback with Low Storage and High Accuracy

Traceback schemes have been proposed to trace the sources of attacks that usually hide by spoofing their IP addresses. Among these methods, schemes using packet logging can achieve single-packet traceback. But packet logging demands high storage on routers and therefore makes IP traceback impractical. For lower storage requirement, packet logging and packet marking are fused to make hybrid single-packet IP traceback. Despite such attempts, their storage still increases with packet numbers. That is why RIHT bounds its storage with path numbers to guarantee low storage. RIHT uses IP header's ID and offset fields to mark packets, so it inevitably suffers from fragment and drop issues for its packet reassembly. Although the 16-bit hybrid IP traceback schemes, for example, MORE, can mitigate the fragment problem, their storage requirement grows up with packet numbers. To solve the storage and fragment problems in one shot, we propose a single-packet IP traceback scheme that only uses packets' ID field for marking. Our major contributions are as follows: (1) our fragmented packets with tracing marks can be reassembled; (2) our storage is not affected by packet numbers; (3) it is the first hybrid single-packet IP traceback scheme to achieve zero false positive and zero false negative rates.

Storage-efficient 16-Bit Hybrid IP traceback with Single Packet.

Since adversaries may spoof their source IPs in the attacks, traceback schemes have been proposed to identify the attack source. However, some of these schemes' storage requirements increase with packet numbers. Some even have false positives because they use an IP header's fragment offset for marking. Thus, we propose a 16-bit single packet hybrid IP traceback scheme that combines packet marking and packet logging with high accuracy and low storage requirement. The size of our log tables can be bounded by route numbers. We also set a threshold to determine whether an upstream interface number is stored in a log table or in a marking field, so as to balance the logging frequency and our computational loads. Because we store user interface information on small-degree routers, compared with current single packet traceback schemes, ours can have the lowest storage requirements. Besides, our traceback achieves zero false positive/negative rates and guarantees reassembly of fragmented packets at the destination.

IP traceback through (authenticated) deterministic flow marking: an empirical evaluation

In this paper, we present a novel approach to IP traceback - deterministic flow marking (DFM). We evaluate this novel approach against two well-known IP traceback schemes. These are the probabilistic packet marking (PPM) and the deterministic packet marking (DPM) techniques. In order to do so, we analyzed these techniques in detail in terms of their performances and feasibilities on five Internet traces. These traces consist of Darpa 1999 traffic traces, CAIDA October 2012 traffic traces, MAWI December 2012 traffic traces, and Dal2010 traffic traces. We have employed 16 performance metrics to evaluate their performances. The empirical results show that the novel DFM technique can reduce the number of marked packets by 91% compared to the DPM, while achieving the same or better performance in terms of its ability to trace back the attack. Additionally, DFM provides an optional authentication so that a compromised router cannot forge markings of other uncompromised routers. Unlike PPM and DPM that trace the attack up to the ingress interface of the edge router close to the attacker, DFM allows the victim to trace the origin of incorrect or spoofed source addresses up to the attacker node, even if the attack has been originated from a network behind a network address translation (NAT) server. Our results show that DFM can reach up to approximately 99% traceback rate with no false positives.

AN IMPROVED IP TRACEBACK MECHANISM FOR NETWORK SECURITY

IP traceback is amongst the main challenges that fa ce the security of today’s Internet. Many technique s were proposed, including inband packhranits alert and outband packets each of them has advantages and disadvantages. Source IP sp oofing attacks are critical issues to the Internet. These attacks are considere d to be sent from bot infected hosts. There has bee n active research on IP traceback technologies. However, the traceback from an end vi ctim host to an end spoofing host has never yet bee n achieved, because of the insufficient traceback probes installed on each rou ting path. There exists a will need to replace alte rnative probes in an effort to lessen the installation cost. Recently a great number of technologies of a given detection and prevention have developed, but it is difficult the fact that the IDS distinguishes normal traffic that are caused by the DDoS traffic due to many changes in network featur es. In existing work a whole new hybrid IP traceback sc heme with efficient packet logging reaching to tend to have a fixed storage requirement for each router ( CAIDA’s data set) in packet logging without the need to refresh the logg ed tracking information and then to achieve zero false positive and false negat ive rates in attack-path reconstruction. Existing h ybrid traceback approach applied on offline CAIDA dataset which isn't suitable to re altime tracing. With this proposed work efficient h ybrid approach for single-packet traceback to our best knowledge, our approach will reduces 2/3 of a given overhead in each of storage and how about recording packet paths, and to discover the time overhead for recovering packet paths is also reduced by a calcu latable amount.

A Review of Packet Marking IP Traceback Schemes

Today, Internet has become the primary source of communication in networks. The attack on its infrastructure poses a great challenge in its expansion. Distributed Denial of Service attack is a serious security threat encountered during the past decade. The goal of the attacker is to spoof the source of IP address to hide its source. Various IP traceback schemes such as Probabilistic Packet Marking, Deterministic Packet marking, TTL base Packet Marking and Hash base IP traceback schemes are proposed to trace the source of the attacker. This paper summarizes the different IP traceback techniques and compares their effectiveness in countering DDoS attack. General Terms IP traceback

A Probabilistic Packet Marking Scheme with LT Code for IP Traceback

Nowadays, Internet has become the most important technology in daily life. Due to the convenient internet, it brought many security issues in the modern world. In order to overcome these problems, Network Forensics is a good technique to handle such situations. Distributed Denial of Service (DDoS) is one of the most seriously attacks which harms the internet. In order to suspend the victim's service to legitimate users, attackers send many packets to the victim. The servers in victim side will be memory leak and CPU overload when they are under attacked. We need a mechanism to find the attack source and stop the attack. IP Traceback is a great method which is used to reconstruct all the attack paths and find the attack source. A good IP Traceback method needs a great marking scheme which could reconstruct all the attack paths correctly. Probabilistic Packet Marking (PPM) is the more efficient scheme currently. However, it needs lots of marking information to reconstruct all the attack paths. We propose the LT Code IP Traceback (LTCIT) to find the source of attack and reconstruct attack path. It uses the features of Luby Transform Code (LT Code) and the features of Dynamic Probability to mark the partial information of the router to the packet, and then use the decoding method to reconstruct all the attack paths. We will show different performance metrics to evaluate the IP Traceback schemes. The simulation shows that our LTCIT mechanism provides better performance than the traditional IP Traceback scheme.

Flexible Deterministic Router and Interface Marking for IP Traceback

involves identifying the actual source of a packet across the Internet. By identifying the real source address in packets, network security system can smartly protect the victim hosts and mitigate the attacks. Packet marking is the most important method of source identification using IP traceback and there are many variations. In this paper, we propose a modification to our previous capable IP traceback scheme, Deterministic Router and Interface Marking (DRIM), to handle fragmented traffic as well. The modification introduces nominal additional bandwidth overhead, with no additional memory requirements and processing overhead on the DRIM-enabled interface and also reduces the problem of false positives. The proposed technique is compared with similar traceback techniques against various performance metrics and is found to be efficient.

RIHT: A Novel Hybrid IP Traceback Scheme

Because the Internet has been widely applied in various fields, more and more network security issues emerge and catch people's attention. However, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks. For this reason, researchers have proposed a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring a longer search. In this paper, we propose a new hybrid IP traceback scheme with efficient packet logging aiming to have a fixed storage requirement for each router (under 320 KB, according to CAIDA's skitter data set) in packet logging without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction. In addition, we use a packet's marking field to censor attack traffic on its upstream routers. Lastly, we simulate and analyze our scheme, in comparison with other related research, in the following aspects: storage requirement, computation, and accuracy.

A Lightweight IP Traceback Scheme Depending on TTL

This article proposes a new type of IP traceback scheme, through recording TTL of the IP header to get the attack path, when the algorithm is in processing, you do not need to generate additional packages, so attackers could not detect the trackback happened, the scheme can be applied in at any strength of DDoS attack, solves the problem of traditional PPM algorithm failed in high strength DDoS attack, also improves the efficiency of traceback, compare with the other scheme, this scheme is simple, efficiency and robustness. So this scheme can effectively resolve the reconstruction problem.

An IP traceback scheme based on hop count

An IP traceback scheme based on hop count

CATCH: A protocol framework for cross-layer attacker traceback in mobile multi-hop networks

Flooding-type Denial-of-Service ( DoS) and Distributed DoS ( DDoS) attacks can cause serious problems in mobile multi-hop networks due to its limited network/host resources. Attacker traceback is a promising solution to take a proper countermeasure near attack origins, for forensics and to discourage attackers from launching the attacks. However, attacker traceback in mobile multi-hop networks is a challenging problem. Existing IP traceback schemes developed for the fixed networks cannot be directly applied to mobile multi-hop networks due to the peculiar characteristics of the mobile multi-hop networks (e.g., dynamic/autonomous network topology, limited network/host resources such as memory, bandwidth and battery life). We introduce a protocol framework for attacker traceback, CATCH, geared towards mobile multi-hop networks utilizing MAC and network cross-layer approach. We also perform systematic risk analysis on mobile multi-hop networks. Based on the risk analysis, we extend CATCH for a mobile attacker traceback scheme. We show that CATCH successfully tracks down attacker under diverse mobile multi-hop network environment with low communication, computation, and memory overhead. We provide comprehensive evaluation of our proposed protocols through extensive simulations.

Three Dimensional Multidirectional Geographical IP Traceback: Direction Ratio Sampling Algorithm

Problem statement: An important and challenging problem is that of tracing DOS/DDOS attack source. IP traceback is the process of identifying the actual source(s) of attack packets, So that the attackers can be held accountable as also in mitigating them, either by isolating the attack sources or by filtering packets for away from the victim. Several IP traceback schemes have been proposed to solve this problem. Among many IP traceback schemes, a recent development was Directed Geographical Traceback (DGT). Though multidirectional two-dimensional DGT schemes were available, in the real scenario, three dimensional, Multidirectional DGT has potential applications. Approach: The Direction Ratio Algorithm (DRA) has the limitation of the impossibility of ensuring sufficient unused space in the packet header for the complete Direction Ratio List (DRL) especially when the length of the path is not known apriori. To overcome this, DRSA was proposed. The methods used in DRSA were random sampling methods, where the sufficient numbers of samples were drawn; one can reconstruct the path of the attack packets and trace the attack source. Results: In this study those limitation had been overcome using Direction Ratio Sampling Algorithm (DRSA) which works well for 3-dimensional, multi-directional, geographical IP traceback. This approach enables the attack path reconstruction was easily possible and hence a victim can typically reconstruct the path after receiving 75 packets from the attacker. This same algorithm can efficiently discern multiple attacks. When attackers from different sources produce disjoint edges in the tree structure of reconstruction, the number of packets needed to reconstruct each path is independent of other paths. Conclusion: DRSA was found to be a robust scheme of attack path reconstruction in Geographical traceback.