Packet Marking Research Articles

Flexible Deterministic Router and Interface Marking for IP Traceback

involves identifying the actual source of a packet across the Internet. By identifying the real source address in packets, network security system can smartly protect the victim hosts and mitigate the attacks. Packet marking is the most important method of source identification using IP traceback and there are many variations. In this paper, we propose a modification to our previous capable IP traceback scheme, Deterministic Router and Interface Marking (DRIM), to handle fragmented traffic as well. The modification introduces nominal additional bandwidth overhead, with no additional memory requirements and processing overhead on the DRIM-enabled interface and also reduces the problem of false positives. The proposed technique is compared with similar traceback techniques against various performance metrics and is found to be efficient.

TRACEBACK OF DOS OVER AUTONOMOUS SYSTEMS

Denial of service (DoS) is a significant security threat in open networks such as the Internet. The existing limitations of the Internet protocols and thecommon availability tools make a DoS attack both effective and easy to launch. There are many different forms of DoS attack and the attack size could be amplified from a single attacker to a distributed attack such as a distributed denial of service (DDoS). IP traceback is one important tool proposed as part of DoS mitigat ion and a number of traceback techniques have been proposed including probabilistic packet marking (PPM). PPM is a promising technique that can be used to trace the complete path back from a victim to the attacker by encoding of each router's 32 -bit IP address in at least one packet of a traffic flow. However, in a network with multiple hops through a number of autonomous systems (AS), as is common with most Internet services, it may be undesirable for every router to contribute to packet marking or for anAS to reveal its internal routing structure. This paper propos es two new efficient autonomous system (AS) traceback techniques to identify the AS of the attacker by probabilistically marking the packets. Traceback on the AS level has a number of advantages including a reduction in the number of bits to be encoded and a reduction in the number of routers that need to participate in the marking. Our results show a better performance comparing to PPM and other techniques.

A Coding-Based Incremental Traceback Scheme against DDoS Attacks in MANET

Due to constrained resources, DDoS attack is one of the biggest threats to MANET. IP traceback technique is useful to defend against such type of attacks, since it can identify the attack sources. Several types of traceback schemes have been proposed for wired networks. Among all the existing schemes, probabilistic packet marking (PPM) scheme might be the most promising scheme for MANET. However its performance in MANET is not as good as that in Internet. In this paper, a new scheme based on the codingtechnique (CT) is proposed for traceback in MANET. Furthermore, a new idea of Incremental traceback is raised to cope with the situation of incremental attack (ICT). We present the protocol design and conduct theoretical analysis of this scheme. Additionally, we conduct experiments to compare it with the traditional PPM scheme. The experimental results show that the new coding-based traceback scheme outperforms the PPM scheme in MANET.

Benefit of Network Coding for Probabilistic Packet Marking and Collecting Coupons from Different Perspectives at the Collector

Probabilistic Packet Marking (PPM) is a scheme for IP traceback where each packet is marked randomly with an IP address of one router on the attack path in order for the victim to trace the source of attacks. In previous work, a network coding approach to PPM (PPM+NC) where each packet is marked with a random linear combination of router IP addresses was introduced to reduce number of packets required to infer the attack path. However, the previous work lacks a formal proof for benefit of network coding to PPM and its proposed scheme is restricted. In this paper, we propose a novel method to prove a strong theorem for benefit of network coding to PPM in the general case, which compares different perspectives (interests of collecting) at the collector in PPM+NC scheme. Then we propose Core PPM+NC schemes based on our core network coding approach to PPM. From experiments, we show that our Core PPM+NC schemes actually require less number of packets than previous schemes to infer the attack path. In addition, based on the relationship between Coupon Collector’s Problem (CCP) and PPM, we prove that there exists numerous designs that CCP still benefits from network coding. key words: IP traceback, probabilistic packet marking, network coding, coupon collector’s problem, different perspectives

Design and Simulation Implementation of an Improved PPM Approach

Different from recent probabilistic packet marking (PPM) methods, Dynamic PPM may solve many problems of traditional methods, such as loss of marking information, hard to reconstruct attack path, low accuracy, and so on. A novel DPPM approach is proposed and the network simulation software (NS2) is used to verify the performance and efficiency of the approach by constructing simulation DOS environments. In comparison with PPM methods, simulation results show that DPPM is much better.

AQM router design for TCP network via input constrained fuzzy control of time-delay affine Takagi–Sugeno fuzzy models

In this article, Takagi–Sugeno (T–S) fuzzy control theory is proposed as a key tool to design an effective active queue management (AQM) router for the transmission control protocol (TCP) networks. The probability control of packet marking in the TCP networks is characterised by an input constrained control problem in this article. By modelling the TCP network into a time-delay affine T–S fuzzy model, an input constrained fuzzy control methodology is developed in this article to serve the AQM router design. The proposed fuzzy control approach, which is developed based on the parallel distributed compensation technique, can provide smaller probability of dropping packets than previous AQM design schemes. Lastly, a numerical simulation is provided to illustrate the usefulness and effectiveness of the proposed design approach.

Progressive Congestion Management Based on Packet Marking and Validation Techniques

Congestion management in multistage interconnection networks is a serious problem, which is not solved completely. In order to avoid the degradation of network performance when congestion appears, several congestion management mechanisms have been proposed. Most of these mechanisms are based on explicit congestion notification. For this purpose, switches detect congestion and depending on the applied strategy, packets are marked to warn the source hosts. In response, source hosts apply some corrective actions to adjust their packet injection rate. Although these proposals seem quite effective, they either exhibit some drawbacks or are partial solutions. Some of them introduce some penalties over the flows not responsible for congestion, whereas others can cope only with congestion situations that last for a short time. In this paper, we present an overview of the different strategies to detect and correct congestion in multistage interconnection networks, and propose a new mechanism referred to as Marking and Validation Congestion Management (MVCM), targeted to this kind of lossless networks, and based on a more refined packet marking strategy combined with a fair set of corrective actions, that makes the mechanism able to effectively manage congestion regardless of the congestion degree. Evaluation results show the effectiveness and robustness of the proposed mechanism.

Defense of DDoS Attacks using Traffic Analysis at Router Level

Efficient Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria were selected to highlight commonalities and important features of attack strategies, that defines challenges and dictate the design of countermeasures. We propose a novel trace back method for DDoS attacks that is based on entropy variations between normal and DDoS attack traffic, which is fundamentally different from commonly used packet marking techniques, results are graphically represented, the proposed model out performs the existing models in a significant way. General Terms This paper exposes the work on IP Trace Back of DDoS attacker based on entropy(Traffic) variations at Router level.

A Precise and Practical IP Traceback Technique Based on Packet Marking and Logging

Tracing malicious packets back to their source is important to defend the Internet against Denial of Service (DoS) intrusion. IP traceback is just the technique to realize the goal, it reconstructs IP packets traversed path in the Internet to determine their origins. There are two major kinds of IP traceback techniques, which have been proposed as packet marking and packet logging. In packet marking, it incurs little overhead, but requires a large number of packets to get the complete path. In packet logging, it requires plenty of storage space to record packet digests information, but has the capability to trace even a single packet. Therefore, it is a new idea to draw on both advantages to get the intrusion source. HIT (Hybrid IP Traceback) is a representative hybrid IP traceback approach, but it has some vulnerabilities. It may return incorrect path in the traceback process, and its storage overhead remains high. In this paper, we propose a precise IP traceback approach with low storage overhead, which improves accuracy and practicality greatly. In the end, the feasibility and effectiveness are evaluated by mathematical analysis and simulations.

RIHT: A Novel Hybrid IP Traceback Scheme

Because the Internet has been widely applied in various fields, more and more network security issues emerge and catch people's attention. However, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks. For this reason, researchers have proposed a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring a longer search. In this paper, we propose a new hybrid IP traceback scheme with efficient packet logging aiming to have a fixed storage requirement for each router (under 320 KB, according to CAIDA's skitter data set) in packet logging without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction. In addition, we use a packet's marking field to censor attack traffic on its upstream routers. Lastly, we simulate and analyze our scheme, in comparison with other related research, in the following aspects: storage requirement, computation, and accuracy.

Detect DDoS Attack using Border Gateways and Edge Routers

The system is design to implement an identification and classification algorithm for tracing DDoS attack and multicast attack information to a edge router using cyclical deterministic packet marking (CDPM) method. Edge router registry stores the received packet IP source address and mark the packet. An Identification and classification algorithm implemented on Border gateway. An algorithm based on received packet and path variation. Border gateways analyze the packet path and number of request received from particular source address. And classify the packet if attacker multicast the attack packet information to edge router and intermediate router or if legitimate packet the border gateway allow to use server. Finally edge router can update their registry and block the attacker IP source address from home network itself. In our proposed model we identify an attack source and multicast the information to an edge router.

Active topology inference using network coding

Our goal, is to infer the topology of a network when (i) we can send probes between sources and receivers at the edge of the network and (ii) intermediate nodes can perform simple network coding operations, i.e., additions. Our key intuition is that network coding introduces topology-dependent correlation in the observations at the receivers, which can be exploited to infer the topology. For undirected tree topologies, we design hierarchical clustering algorithms, building on our prior work in Fragouli et al. (2006). For directed acyclic graphs (DAGs), first we decompose the topology into a number of two-source, two-receiver (2-by-2) subnetwork components and then we merge these components to reconstruct the topology. Our approach for DAGs builds on prior work on tomography in Rabbat et al. (2006), and improves upon it by employing network coding to accurately distinguish among all different 2-by-2 components. We evaluate our algorithms through simulation of a number of realistic topologies and compare them to active tomographic techniques without network coding. We also make connections between our approach and alternatives, including passive inference, traceroute, and packet marking.

A Practical Hybrid IP Traceback Method under IPv6

Recently, Distributed Denial of Service (DDoS) attacks have been threatening the Internet severely. Tracing IP packets back to their origins is an efficient and important part of the defense against those attacks. Currently two major kinds of IP traceback methods have been used for IP traceback in IPv6: packet marking and packet logging. IP traceback based on packet marking requires routers to write their identifiable information into the forwarded packets. It incurs little overhead on routers but needs a large number of packets to construct the complete attack path. IP traceback based on packet logging requires routers to store the digests of the forwarded packets. It only needs a few packets to construct the attack path but causes high storage overhead in routers. In this paper, we present a practical hybrid IP traceback method under IPv6 (PHIT-IPv6) which integrates packet marking and packet logging so as to obtain both of their advantages. We improved the practicality of DDoS traceback in that our method requires a less number of packets to conduct the traceback progress and reduces the storage overload of the intermediate routers for packet logging. We present both mathematical analysis and simulation of our method. The results show that our method can reduce the storage overhead by almost fifty percent and can also significantly decrease the number of packets for attack path construction.

Marking Certification of Adaptive Probability Packet Based on Hash Function

Denial of Service Attack is a very important security event in the current network security .Address the problem of DDoS Network Attacks ,researchers have proposed a variety of tracking programs against Denial of Service Attack .Such as IP tracking program, packet marking ,logging ,connection test ,ICMP tracking ,covering networks ,and so on .The marked storage space has been expended by the use of authentication machnism of adaptive probability packet .Increasing marks could store the hash value of the IP addresses of the head node .With the selection of the mentioned two methods above ,the quantity of needed packet while reconstructing the path has been decreased .And ultimately ,the propose of decreasing the rate of false positives and the computational complexity ,as well as improving the convergence and security have been reached.

IP Traceback for Flooding Attacks on Internet Threat Monitors (ITM ) Using Honeypots

The Internet Threat Monitoring (ITM) is an efficient monitoring system used globally to measure, detect, characterize and track threats such as denial of service (DoS) and distributed Denial of Service (DDoS) attacks and worms. . To block the monitoring system in the internet the attackers are targeted the ITM system. In this paper we address the flooding attack of DDoS against ITM monitors to exhaust the network resources, such as bandwidth, computing power, or operating system data structures by sending the malicious traffic. We propose an information-theoretic frame work that models the flooding attacks using Botnet on ITM. One possible way to counter DDoS attacks is to trace the attack sources and punish the perpetrators. we propose a novel traceback method for DDoS using Honeypots. IP tracing through honeypot is a single packet tracing method and is more efficient than commonly used packet marking techniques.

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

A Modified Packet Marking Algorithm to Improve Bandwidth Fairness in Diffserv Networks

A Modified Packet Marking Algorithm to Improve Bandwidth Fairness in Diffserv Networks

Modified BLUE Packet Buffer for Base-Stations in Mobile IP-based Networks

Performance of TCP can be severely degraded in Mobile IP-based wireless networks where packet losses not related to network congestion occur frequently during inter-subnetwork handoffs by user mobility. To solve such a problem in the networks using Mobile IP, the packet buffering method at a base station(BS) recovers those packets dropped during handoff by forwarding the buffered packets at the old BS to the mobile users. But, when the mobile user moves to a congested BS in a new foreign subnetwork, those buffered packets forwarded by the old BS are dropped and TCP transmission performance of a mobile user degrades severely. In this paper, we propose a Modified BLUE(MBLUE) buffer required at a BS to increase TCP throughput in Mobile IP-based networks. When a queue length exceed a threshold and congestion grows, MBLUE increases its packet drop probability. But, when a TCP connection is added at new BS by a handoff, the old BS marks the buffered packets. And new BS receives the marked packets without dropping. Simulation results show that MBLUE buffer reduces congestion during handoffs and increases TCP throughputs.

An Improved Dynamic Probabilistic Packet Marking Algorithm

An improved dynamic probabilistic packet marking algorithm named IDPPM is presented, which not only can reduce the marking overhead of routers near the attackers, but also can locate attack source rapidly and accurately. The challenge of weakest node and weakest link is solved with the price of a little more numbers of packets to reconstruct the attack path. Theoretical analysis and NS2 simulation demonstrate the effectiveness of the algorithm.

IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

IP traceback is known to be one of the most effective measures to deter Internet attacks. Various techniques for IP traceback have been suggested. Among them, we focus on Probabilistic Packet Marking scheme (PPM) with tagging. We believe PPM is more advantageous than others because it does not generate additional network traffic and requires minimal protocol change. However, three parameters need to be optimized to make PPM practical under massively multiple attack paths: the number of packets to collect, the number of fragment combinations to recover the IP addresses, and the false positive error rate. Tagging is an effective way to reduce the number of combinations but it increases the false positive error rates when the number of routers in the attack paths grows. Other PPM-related techniques suggested in the past have similar problems. They improve one or two parameters at the expense of others, or they require additional data structures such as an upstream router map. In this paper, we propose a method that optimizes the three parameters at the same time and recovers original IPs quickly and correctly even in the presence of massive multiple attack paths. Our method does not need either a combinatorial process to recover IPs or additional information such as an upstream router map. Our result shows that our method recovers 95% of the original IPs correctly with no fragment combinations and with zero false positives. It needs to collect only 8N packets per router where N is the number of routers involved in the attack paths.