IP Traceback Research Articles

Locating subverted processes using random packet comparison in SCADA systems

A supervisory control and data acquisition (SCADA) system may be subject to integrity attacks. Anomalies in sensor measurements may be used to detect these attacks, but such techniques do not permit us to locate attacking nodes. We propose a novel technique to enable this. Each participating network node probabilistically copies packets and marks them with routing information, before encrypting them with private keys and forwarding them to the operator. Nodes regularly release the keys used to encrypt packets. At that point, the operator may compare the copied packets with the original. Using the differences in packet content and routing information, it is possible to deduce to within one or two processes the location of an attack. Our approach is based on IP traceback techniques originally used for detecting the origin of denial of service attacks. The complexity of the approach is low and the technique can be shown to be resilient to counter-attack.

Performance Analysis of ACO-based IP Traceback

The Internet has experienced a tremendous expansion in its size and complexity since its commercialization. Internet hosts are threatened by large-scale Distributed Denial-ofService (DDoS) attacks in the network. DDoS attacks typically rely on compromising a large number of hosts to generate traffic to a single destination node. Thus the severity of DDoS attacks will likely increase to the possible extend, as greater numbers of poorly secured hosts are connected to high-bandwidth Internet connections. To detect and coordinate DDoS attacks in the network usually an Intrusion Detection System (IDS) is used but, this method consumes most of the resources and thereby degrades the network performance. Moreover, the memory-less feature of the routing mechanism makes the operation hard to traceback the source of the DDoS attacks. This paper analyzed the performance of an Ant Colony Optimization (ACO)-based IP traceback method to identify the origin of the attack in the network. The ACO-based IP traceback approach uses flow level information to identify the origin of a DDoS attack. The ACO-based IP traceback method is implemented using NS-2 simulation on various network scenarios consisting of 8 nodes, 10 nodes, and 14 nodes. The results of the experimental and simulation studies demonstrate the effectiveness and efficiency of the proposed system.

Capacity and Robustness Tradeoffs in Bloom Filters for Distributed Applications

The Bloom filter is a space-efficient data structure often employed in distributed applications to save bandwidth during data exchange. These savings, however, come at the cost of errors in the shared data, which are usually assumed low enough to not disrupt the application. We argue that this assumption does not hold in a more hostile environment, such as the Internet, where attackers can send a carefully crafted Bloom filter in order to break the application. In this paper, we propose the concatenated Bloom filter (CBF), a robust Bloom filter that prevents the attacker from interfering on the shared information, protecting the application data while still providing space efficiency. Instead of using a single large filter, the CBF concatenates small subfilters to improve both the filter robustness and capacity. We propose three CBF variants and provide analytical results that show the efficacy of the CBF for different scenarios. We also evaluate the performance of our filter in an IP traceback application and simulation results confirm the effectiveness of the proposed mechanism in the face of attackers.

Geographical Division Traceback for Distributed Denial of Service

Problem statement: Distributed Denial of Service (DDoS) was a serious threat to the internet world that denies the legitimate users from being access the internet by blocking the service. Approach: In this study, we proposed a novel approach, Geographical Division Traceback (GDT) for efficient IP traceback and DDoS defense methodology. DDoS attack was one of the most serious and threatening issue in the modern world web because of its notorious harmfulness and it causes the delay in the availability of services to the intended users. Results: Unless like a traditional traceback methodology, GDT proposes a quick mechanism to identify the attacker with the help of single packet which imposes very less computational overhead on the routers and also victim can avoid receiving data from the same machine in future. This mechanism for IP Traceback utilizes the geographical information for finding out the machine which was responsible for making the delay was proposed. The IP packet consists of the subspaces details in which the path denotes. It helps to make sure whether the packet travels in the network and falls within any one of the subspaces. The division of subspaces leads to the source of attack system. Conclusion/Recommendations: This method possesses several advantageous features such as easy traversing to the attacker and improves the efficiency of tracing the attacker system.

Defense of DDoS Attacks using Traffic Analysis at Router Level

Efficient Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria were selected to highlight commonalities and important features of attack strategies, that defines challenges and dictate the design of countermeasures. We propose a novel trace back method for DDoS attacks that is based on entropy variations between normal and DDoS attack traffic, which is fundamentally different from commonly used packet marking techniques, results are graphically represented, the proposed model out performs the existing models in a significant way. General Terms This paper exposes the work on IP Trace Back of DDoS attacker based on entropy(Traffic) variations at Router level.

An Incrementally Deployable Flow-Based Scheme for IP Traceback

IP traceback can be used to find the origins and paths of attacking traffic. However, so far, most approaches for IP traceback are hard to be deployed in the Internet because of deployment difficulties. In this paper, we present an incrementally deployable approach based on sampled flows for IP traceback (SampleTrace). In SampleTrace, it is not necessary to deploy any dedicated traceback software and hardware at routers, and an AS-level overlay network is built for incremental deployment. We theoretically analyze the quantitative relation among the probability that a flow is successfully traced back various AS-level hop number, independently sampling probability, and the packet number that the attacking flow comprises. According to Bernoulli's Law of Large Numbers, when a large number of attacking flows are practically traced back in the Internet by SampleTrace, the successfully-traced back relative frequency will approach the successfully-traced back probability.

An incrementally deployable path address scheme

The research community has proposed numerous network security solutions, each dealing with a specific problem such as address spoofing, denial-of-service attacks, denial-of-quality attacks, reflection attacks, viruses, or worms. However, due to the lack of fundamental support from the Internet, individual solutions often share little common ground in their design, which causes a practical problem: deploying all these vastly different solutions will add exceedingly high complexity to the Internet routers. In this paper, we propose a simple generic extension to the Internet, providing a new type of information, called path addresses, that simplify the design of security systems for packet filtering, fair resource allocation, packet classification, IP traceback, filter push-back, etc. IP addresses are owned by end hosts; path addresses are owned by the network core, which is beyond the reach of the hosts. We describe how to enhance the Internet protocols for path addresses that meet the uniqueness requirement, completeness requirement, safety requirement, and incrementally deployable requirement. We evaluate the performance of our scheme both analytically and by simulations, which show that, at small overhead, the false positive ratio and the false negative ratio can both be made negligibly small.

A Precise and Practical IP Traceback Technique Based on Packet Marking and Logging

Tracing malicious packets back to their source is important to defend the Internet against Denial of Service (DoS) intrusion. IP traceback is just the technique to realize the goal, it reconstructs IP packets traversed path in the Internet to determine their origins. There are two major kinds of IP traceback techniques, which have been proposed as packet marking and packet logging. In packet marking, it incurs little overhead, but requires a large number of packets to get the complete path. In packet logging, it requires plenty of storage space to record packet digests information, but has the capability to trace even a single packet. Therefore, it is a new idea to draw on both advantages to get the intrusion source. HIT (Hybrid IP Traceback) is a representative hybrid IP traceback approach, but it has some vulnerabilities. It may return incorrect path in the traceback process, and its storage overhead remains high. In this paper, we propose a precise IP traceback approach with low storage overhead, which improves accuracy and practicality greatly. In the end, the feasibility and effectiveness are evaluated by mathematical analysis and simulations.

Effective Analysis of Distributed Denial of Service Attacks Using IP Traceback Algorithm

Effective Analysis of Distributed Denial of Service Attacks Using IP Traceback Algorithm

RIHT: A Novel Hybrid IP Traceback Scheme

Because the Internet has been widely applied in various fields, more and more network security issues emerge and catch people's attention. However, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks. For this reason, researchers have proposed a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring a longer search. In this paper, we propose a new hybrid IP traceback scheme with efficient packet logging aiming to have a fixed storage requirement for each router (under 320 KB, according to CAIDA's skitter data set) in packet logging without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction. In addition, we use a packet's marking field to censor attack traffic on its upstream routers. Lastly, we simulate and analyze our scheme, in comparison with other related research, in the following aspects: storage requirement, computation, and accuracy.

An adaptive probabilistic marking scheme for fast and secure traceback

IP traceback can be used to find direct generator(s) and path(s) of attacking traffic. Probabilistic marking schemes, as one type of IP traceback technologies, have been most studied, but they are difficult to fast reconstruct attacking path(s) and defend against spoofed marks generated by attacking source(s). In this paper, we present Adaptive Probabilistic Marking scheme (APM). In APM, when each packet enters the first-hop router, its TTL value is set to a uniform value, and when it is forwarded by routers in the network, each intermediate router decreases the TTL value by one. Consequently, each intermediate router may infer the router-level hop number that each packet has already traveled, and then correspondingly marks the packet with the probability inversely proportional to the router-level hop number. APM is focused on the probability with which a router marks a packet, and APM can cooperate with other probabilistic marking schemes. NS2 simulation experiments prove that, in APM, the time for the victim to receive necessary marks for the path reconstruction is reduced by more than 20% compared with existing probabilistic marking schemes, and spoofed marks cannot reach the victim and influence the traceback process.

A Practical Hybrid IP Traceback Method under IPv6

Recently, Distributed Denial of Service (DDoS) attacks have been threatening the Internet severely. Tracing IP packets back to their origins is an efficient and important part of the defense against those attacks. Currently two major kinds of IP traceback methods have been used for IP traceback in IPv6: packet marking and packet logging. IP traceback based on packet marking requires routers to write their identifiable information into the forwarded packets. It incurs little overhead on routers but needs a large number of packets to construct the complete attack path. IP traceback based on packet logging requires routers to store the digests of the forwarded packets. It only needs a few packets to construct the attack path but causes high storage overhead in routers. In this paper, we present a practical hybrid IP traceback method under IPv6 (PHIT-IPv6) which integrates packet marking and packet logging so as to obtain both of their advantages. We improved the practicality of DDoS traceback in that our method requires a less number of packets to conduct the traceback progress and reduces the storage overload of the intermediate routers for packet logging. We present both mathematical analysis and simulation of our method. The results show that our method can reduce the storage overhead by almost fifty percent and can also significantly decrease the number of packets for attack path construction.

Securing Data using Pre-filtering and Traceback Method

In this paper, we propose RegEx-Filter(pre-filtering approach) and IP traceback method to trace an unauthorized access incidents in the Internet, The current control technologies cannot stop specific way of access. The basic idea is to generate the RegEx print from RegEx set and use it in prefiltering most unmatched items and trace out the unauthorized user by means of traceback method. There are two key challenges in RegEx: the generation of RegEx print and the matching process of RegEx print. The generation of RegEx is tricky as it needs to tradeoff between two conflicting goals: filtering effectiveness, which means to filter out as many unmatched items as possible, and matching speed, which means that we want RegEx print to be as high as possible. Here we describe the development and the evaluation of our prototype system. The main features of our proposed method are the RegEx-Filter which filters the unmatched items. Packet feature, which is composed of specific packet information contained in a packet for identification of an unauthorized packet. And the algorithm using datalink identifier to identify a routing of a packet. We show the development of the prototype system, RegEx-Filter equipped with tracing functions on routers and its processing result.

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

An IP traceback scheme based on hop count

An IP traceback scheme based on hop count

A Lightweight IP Traceback Scheme Depending on TTL

This article proposes a new type of IP traceback scheme, through recording TTL of the IP header to get the attack path, when the algorithm is in processing, you do not need to generate additional packages, so attackers could not detect the trackback happened, the scheme can be applied in at any strength of DDoS attack, solves the problem of traditional PPM algorithm failed in high strength DDoS attack, also improves the efficiency of traceback, compare with the other scheme, this scheme is simple, efficiency and robustness. So this scheme can effectively resolve the reconstruction problem.

Analysis of the false-positive error rate of tagged fragment marking scheme

IP traceback is an effective measure to deter internet attacks. A number of techniques have been suggested to realize IP traceback. The Fragment Marking Scheme (FMS) is one of the most promising techniques. However, it suffers a combinatorial explosion when computing the attackerʼs location in the presence of multiple attack paths. The Tagged Fragment Marking Scheme (TFMS) has been suggested to suppress the combinatorial explosion by attaching a tag to each IP fragment. Tagging is effective because it allows the victim to differentiate IP fragments belonging to different routers, thereby greatly reducing the search space and finding the correct IP fragments. TFMS, however, increases the number of false positives when the number of routers on the attack path grows beyond some threshold. In this paper, we rigorously analyze the performance of TFMS to determine the correlation between the number of routers and the false positive error rate. Using a probabilistic argument, we determine the formulas for combination counts and error probabilities in terms of the number of routers. Under TFMS, our results show that we can reduce the required time to find an attackerʼs location at the cost of a low error rate for a moderate number of routers.

IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

IP traceback is known to be one of the most effective measures to deter Internet attacks. Various techniques for IP traceback have been suggested. Among them, we focus on Probabilistic Packet Marking scheme (PPM) with tagging. We believe PPM is more advantageous than others because it does not generate additional network traffic and requires minimal protocol change. However, three parameters need to be optimized to make PPM practical under massively multiple attack paths: the number of packets to collect, the number of fragment combinations to recover the IP addresses, and the false positive error rate. Tagging is an effective way to reduce the number of combinations but it increases the false positive error rates when the number of routers in the attack paths grows. Other PPM-related techniques suggested in the past have similar problems. They improve one or two parameters at the expense of others, or they require additional data structures such as an upstream router map. In this paper, we propose a method that optimizes the three parameters at the same time and recovers original IPs quickly and correctly even in the presence of massive multiple attack paths. Our method does not need either a combinatorial process to recover IPs or additional information such as an upstream router map. Our result shows that our method recovers 95% of the original IPs correctly with no fragment combinations and with zero false positives. It needs to collect only 8N packets per router where N is the number of routers involved in the attack paths.

Low-Rate DDoS Attacks Detection and Traceback by Using New Information Metrics

A low-rate distributed denial of service (DDoS) attack has significant ability of concealing its traffic because it is very much like normal traffic. It has the capacity to elude the current anomaly-based detection schemes. An information metric can quantify the differences of network traffic with various probability distributions. In this paper, we innovatively propose using two new information metrics such as the generalized entropy metric and the information distance metric to detect low-rate DDoS attacks by measuring the difference between legitimate traffic and attack traffic. The proposed generalized entropy metric can detect attacks several hops earlier (three hops earlier while the order α = 10 ) than the traditional Shannon metric. The proposed information distance metric outperforms (six hops earlier while the order α = 10) the popular Kullback-Leibler divergence approach as it can clearly enlarge the adjudication distance and then obtain the optimal detection sensitivity. The experimental results show that the proposed information metrics can effectively detect low-rate DDoS attacks and clearly reduce the false positive rate. Furthermore, the proposed IP traceback algorithm can find all attacks as well as attackers from their own local area networks (LANs) and discard attack traffic.

IP traceback based on router interface

IP traceback is an important way to defend against distributed denial of service attack.Gong et al's IP traceback method was analyzed and the disadvantage of low speed in reconstructing path was pointed out.An improved scheme was proposed to overcome the disadvantage.The presented scheme employed the information of router interface to mark a route so as to shorten the mark length in original method.In the proposed scheme,the speed of reconstructing path was enhanced and the false positive was lowered since it was decided whether the log was detected according to the deployment of router.Moreover,the scheme can well support incremental deployment.