Probabilistic Packet Marking Scheme Research Articles

Record route IP traceback: Combating DoS attacks and the variants

The Internet introduces a variety of vulnerabilities that put the security and privacy of computer based systems under risk. One of the most perilous threats in the Internet is the Denial of Service (DoS) attack and its variants such as Distributed DoS (DDoS). In this work we propose a novel probabilistic packet marking scheme to infer forward paths from attacker sites to a victim site and enable the victim to delegate the defense to the upstream Internet Service Providers (ISPs). We exploit the record route feature of the IP protocol to implement our probabilistic packet marking scheme. Compared to the other techniques, our approach requires less many packets to construct the paths from attacker sites toward a victim site. Our results show that a victim site can construct the forward path from an attacker site after receiving 20.23 packets on the average under DoS attacks. Moreover, we construct the forward-paths graph from 5000 attacker sites toward the victim site by receiving 11.58 packets per attacker site, on the average.

A Probabilistic Packet Marking Scheme with LT Code for IP Traceback

Nowadays, Internet has become the most important technology in daily life. Due to the convenient internet, it brought many security issues in the modern world. In order to overcome these problems, Network Forensics is a good technique to handle such situations. Distributed Denial of Service (DDoS) is one of the most seriously attacks which harms the internet. In order to suspend the victim's service to legitimate users, attackers send many packets to the victim. The servers in victim side will be memory leak and CPU overload when they are under attacked. We need a mechanism to find the attack source and stop the attack. IP Traceback is a great method which is used to reconstruct all the attack paths and find the attack source. A good IP Traceback method needs a great marking scheme which could reconstruct all the attack paths correctly. Probabilistic Packet Marking (PPM) is the more efficient scheme currently. However, it needs lots of marking information to reconstruct all the attack paths. We propose the LT Code IP Traceback (LTCIT) to find the source of attack and reconstruct attack path. It uses the features of Luby Transform Code (LT Code) and the features of Dynamic Probability to mark the partial information of the router to the packet, and then use the decoding method to reconstruct all the attack paths. We will show different performance metrics to evaluate the IP Traceback schemes. The simulation shows that our LTCIT mechanism provides better performance than the traditional IP Traceback scheme.

A Coding-Based Incremental Traceback Scheme against DDoS Attacks in MANET

Due to constrained resources, DDoS attack is one of the biggest threats to MANET. IP traceback technique is useful to defend against such type of attacks, since it can identify the attack sources. Several types of traceback schemes have been proposed for wired networks. Among all the existing schemes, probabilistic packet marking (PPM) scheme might be the most promising scheme for MANET. However its performance in MANET is not as good as that in Internet. In this paper, a new scheme based on the codingtechnique (CT) is proposed for traceback in MANET. Furthermore, a new idea of Incremental traceback is raised to cope with the situation of incremental attack (ICT). We present the protocol design and conduct theoretical analysis of this scheme. Additionally, we conduct experiments to compare it with the traditional PPM scheme. The experimental results show that the new coding-based traceback scheme outperforms the PPM scheme in MANET.

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

A Probabilistic Packet Marking scheme with LT Code for IP Traceback

IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

IP traceback is known to be one of the most effective measures to deter Internet attacks. Various techniques for IP traceback have been suggested. Among them, we focus on Probabilistic Packet Marking scheme (PPM) with tagging. We believe PPM is more advantageous than others because it does not generate additional network traffic and requires minimal protocol change. However, three parameters need to be optimized to make PPM practical under massively multiple attack paths: the number of packets to collect, the number of fragment combinations to recover the IP addresses, and the false positive error rate. Tagging is an effective way to reduce the number of combinations but it increases the false positive error rates when the number of routers in the attack paths grows. Other PPM-related techniques suggested in the past have similar problems. They improve one or two parameters at the expense of others, or they require additional data structures such as an upstream router map. In this paper, we propose a method that optimizes the three parameters at the same time and recovers original IPs quickly and correctly even in the presence of massive multiple attack paths. Our method does not need either a combinatorial process to recover IPs or additional information such as an upstream router map. Our result shows that our method recovers 95% of the original IPs correctly with no fragment combinations and with zero false positives. It needs to collect only 8N packets per router where N is the number of routers involved in the attack paths.

FBT: an efficient traceback scheme in hierarchical wireless sensor network

AbstractWith limited resource constraints, wireless sensor networks (WSNs) pose unique technical challenges: WSNs are vulnerable to DoS/DDoS attacks that can easily exhaust rare available resources to prevent execution of their expected functions. Reconstructing the attacking path and locating the attacking source are challenging tasks in the traceback research areas. In conventional IP networks, probabilistic packet marking (PPM) schemes are among the widely used traceback algorithms. However, due to their high convergence times, conventional PPM schemes are not enough for the need for quick and accurate traceback in WSNs. Because marking probability assignment schemes have considerable influence on convergence time and performance, we place a particular emphasis on how to improve both easiness and efficiency for the marking probability assignment of the PPM. In this paper, we propose a novel traceback scheme, called fishbone traceback (FBT), which can be deployed in hierarchical WSN environments. FBT is designed based on the two‐layer labelling technique and a smart marking probability distribution function (MPDF). The use of two‐layer FBT labels is to derive the main branch (‘fish spine’) of the attacking path quickly, while the use of MPDF can greatly reduce the convergence time by integrating with a priori information of hierarchical WSN topology. The FBT path reconstruction procedure is able to rebuild the spine path (for inter‐cluster traceback) via cluster head marking packets. It also reforms the details of the micro fishbone path (for intra‐cluster traceback) on‐demand within a cluster. Both numerical analysis and simulation results show that our solution has better performance in terms of shorter traceback convergence time. In particular, the proposed FBT also includes many salient features (such as the enhanced robustness of the traceback algorithm in case of multi‐attack and reusable spine path), which enable FBT to be a practical solution to the traceback problem in hierarchical WSNs. Copyright © 2008 John Wiley & Sons, Ltd.

Performance analysis of probabilistic packet marking in IPv6

Probabilistic packet marking (PPM) has received considerable attention as an IP traceback approach against distributed Denial-of-Service attack, which is one of the most challenging security threat in the Internet. PPM is a technique that seeks to identify the source of such attacks by marking individual packets with portion of the attack path, and then relies on the volume of attack traffic generated to ensure that the whole path can be reconstructed. However, modifying the identification field in the IPv4 packet header to mark packet incurs backward incompatibility for IP fragmented packets. In this paper, we address this issue and analyze the viability of PPM under the next-generation Internet Protocol, IPv6. In doing so, we consider the flaws inherent to IPv4 implementations that limit their backward compatibility, and demonstrate how these shortcomings can be avoided in IPv6. We show that the Flow Label field in the IPv6 datagram header can be safely and effectively overloaded to implement PPM schemes, and present simulation results verifying the applicability and efficiency of this approach.

Vulnerabilities in distance-indexed IP traceback schemes

In order to counter Denial-of-Service (DoS) attacks using spoofed source addresses, many IP traceback schemes have been proposed in the last few years. Among them, distance-indexed probabilistic packet marking schemes appear to be very attractive. In this paper, we first discover two intrinsic vulnerabilities in these schemes. Substantiated by efficacy analysis and numerical results, several exploits are designed to take advantage of these vulnerabilities in an efficient manner when compared with the traceback effort attempted by victims. Consequently, we show that the design goal of these schemes can be compromised in practice. Further, we discuss these vulnerabilities in a general context relevant to network protocols and examine a few possible alternatives.

Tabu marking scheme to speedup IP traceback

The IP traceback is an important mechanism in defending against distributed denial-of-service (DDoS) attacks. In this paper, we propose a probabilistic packet marking (PPM) scheme, Tabu Marking Scheme (TMS), to speedup IP traceback. The key idea of is that, a router still marks packets probabilistically, but regards a packet marked by an upstream router as a tabu and does not mark it again. We study the impact of the traffic aggregation on the convergence behavior of PPM schemes. Furthermore we derive a new analytical result on the partial coupon collection problem, which is a powerful tool applicable for computing the mean convergence time of any PPM scheme. Our study shows that the idea of not only helps a PPM scheme that allows overwriting to reduce the convergence time under a DDoS attack, but also ensures the authentication of the routers' markings.

Trade-offs in probabilistic packet marking for IP traceback

There has been considerable recent interest in probabilistic packet marking schemes for the problem of tracing a sequence of network packets back to an anonymous source. An important consideration for such schemes is the number of packet header bits that need to be allocated to the marking protocol. Let b denote this value. All previous schemes belong to a class of protocols for which b must be at least log n , where n is the number of bits used to represent the path of the packets. In this article, we introduce a new marking technique for tracing a sequence of packets sent along the same path. This new technique is effective even when b = 1. In other words, the sequence of packets can be traced back to their source using only a single bit in the packet header. With this scheme, the number of packets required to reconstruct the path is O (2 2 n ), but we also show that Ω(2 n ) packets are required for any protocol where b = 1. We also study the trade-off between b and the number of packets required. We provide a protocol and a lower bound that together demonstrate that for the optimal protocol, the number of packets required (roughly) increases exponentially with n , but decreases doubly exponentially with b . The protocol we introduce is simple enough to be useful in practice. We also study the case where the packets are sent along k different paths. For this case, we demonstrate that any protocol must use at least log(2 k − 1) header bits. We also provide a protocol that requires ⌈log(2 k + 1)⌉ header bits in some restricted scenarios. This protocol introduces a new coding technique that may be of independent interest.