IP Traceback Technology Research Articles

Research on IP Traceback Technology Based on DDoS Attack

DDoS attack threatens the stable development of internet and national information security seriously. IP traceback technology can track the attack packages to the attack source, and is making an important significance in against DDoS attack. For the DDoS attack, the basic theory and advantages and disadvantages of several common IP traceback technologies are analyzed and compared. Some ideas to improve the technologies are proposed by analyzing some current problems of IP traceback and source-finding technologies.

English

Migration of DDOS attack is one the biggest challenge on the internet and lan networks. Many techniques has been proposed , including DDOS prevention, ipspoof etc., each of them has advantages and disadvantages. Source IP spoofing attacks are critical issues to the Internet.There has been active research on IP traceback technologies. However, the traceback from an end victim host to an end spoofing host has never yet been achieved, because of the insufficient traceback probes installed on each routing path. Recently a great number of prevention mechanism of a given detection and prevention have been developed, but it is difficult to trace the source ip of the attacker due to misconfiguration of network router or dynamic changes in the network. Also traditional methods are completely depends on network router. In order to overcome these problems, an improved iptraceback mechanism is introduced. Existing approach detect ip using offline CAIDA dataset which isn't suitable to dynamic networks. Experimental results show, proposed scheme performs well compare to traditional methods in terms of detection rate and time to detect source ip.

The Research on Hybrid Communication Model for Trojan Based on P2P

Direct connection and reflective connection are commonly used in traditional Trojans communication model, which have some significant deficiencies in hiding, anti-tracking, and efficiency. To improve the aspects above in traditional Trojan horse communication model, the author proposed a hybrid communication model based on P2P technology. The model uses P2P intranet penetration protocol to build the channel between the controlled station and the control station, and uses P2P node servers for saving the Trojans status and transferring some data between the controlled and the control. The topology of networks for controller will be very flexible. Using the IP traceback technology will be difficult to track the controllers. Using UDP protocol in the hybrid communication model for data transmission will hide the network status. Control sites can work in distributed mode. By using the model, the hiding-ability, anti-traceability and communication efficiency will be greatly improved.

AN IMPROVED IP TRACEBACK MECHANISM FOR NETWORK SECURITY

IP traceback is amongst the main challenges that fa ce the security of today’s Internet. Many technique s were proposed, including inband packhranits alert and outband packets each of them has advantages and disadvantages. Source IP sp oofing attacks are critical issues to the Internet. These attacks are considere d to be sent from bot infected hosts. There has bee n active research on IP traceback technologies. However, the traceback from an end vi ctim host to an end spoofing host has never yet bee n achieved, because of the insufficient traceback probes installed on each rou ting path. There exists a will need to replace alte rnative probes in an effort to lessen the installation cost. Recently a great number of technologies of a given detection and prevention have developed, but it is difficult the fact that the IDS distinguishes normal traffic that are caused by the DDoS traffic due to many changes in network featur es. In existing work a whole new hybrid IP traceback sc heme with efficient packet logging reaching to tend to have a fixed storage requirement for each router ( CAIDA’s data set) in packet logging without the need to refresh the logg ed tracking information and then to achieve zero false positive and false negat ive rates in attack-path reconstruction. Existing h ybrid traceback approach applied on offline CAIDA dataset which isn't suitable to re altime tracing. With this proposed work efficient h ybrid approach for single-packet traceback to our best knowledge, our approach will reduces 2/3 of a given overhead in each of storage and how about recording packet paths, and to discover the time overhead for recovering packet paths is also reduced by a calcu latable amount.

An adaptive probabilistic marking scheme for fast and secure traceback

IP traceback can be used to find direct generator(s) and path(s) of attacking traffic. Probabilistic marking schemes, as one type of IP traceback technologies, have been most studied, but they are difficult to fast reconstruct attacking path(s) and defend against spoofed marks generated by attacking source(s). In this paper, we present Adaptive Probabilistic Marking scheme (APM). In APM, when each packet enters the first-hop router, its TTL value is set to a uniform value, and when it is forwarded by routers in the network, each intermediate router decreases the TTL value by one. Consequently, each intermediate router may infer the router-level hop number that each packet has already traveled, and then correspondingly marks the packet with the probability inversely proportional to the router-level hop number. APM is focused on the probability with which a router marks a packet, and APM can cooperate with other probabilistic marking schemes. NS2 simulation experiments prove that, in APM, the time for the victim to receive necessary marks for the path reconstruction is reduced by more than 20% compared with existing probabilistic marking schemes, and spoofed marks cannot reach the victim and influence the traceback process.

IP Traceback Using DNS Logs against Bots

Recently, source IP spoofing attacks are critical issues for the Internet. These attacks are considered to be sent from bot infected hosts. There has been active research on IP traceback technologies. However, the traceback from an end victim host to an end spoofing host has not yet been achieved, due to the lack of traceback probes installed on each routing path. Alternative probes should be employed in order to reduce the installation cost. In this research, we propose an IP traceback scheme against bots using DNS logs of existing servers. Many types of bots retrieve IP addresses of victim hosts from fully qualified domain names (FQDNs) at the beginning of an attack. The proposed scheme checks from the destination to the source DNS logs, in order to extract the actual IP addresses of bot infected hosts. Also, we propose a scheme to ascertain the reliability of traceback results, and a method to distinguish spoofing from non-spoofing attacks. We collect bot communication patterns to confirm that the DNS log can be used for reasonable probes and for achieving a high traceback success rate.

Tracing cyber attacks from the practical perspective

The integrity of the Internet is severely impaired by rampant denial of service and distributed DoS attacks. It is by no means trivial to devise a countermeasure to address these attacks because of their anonymous and distributed nature. This article presents a brief survey of the most promising recently proposed schemes for tracing cyber attacks: IP traceback. Since IP traceback technology is evolving rapidly, for the community to better comprehend and capture the properties of disparate traceback approaches, we first classify these schemes from multiple aspects. From the perspective of practicality and feasibility, we then analyze and explore the advantages and disadvantages of these schemes in depth so that shortcomings and possible enhancements of each scheme are highlighted. Finally, open problems and future work are discussed, and concluding remarks are drawn.