Probabilistic Packet Marking Research Articles

The time for reconstructing the attack graph in DDoS attacks

Despite their frequency, denial-of-service (DoS5) and distributed-denial-of-service (DDoS) attacks are difficult to prevent and trace, thus posing a constant threat. One of the main defense techniques is to identify the source of the attack by reconstructing the attack graph, and then filtering the messages arriving from this source. One of the most common methods for reconstructing the attack graph is Probabilistic Packet Marking (PPM). We focus on edge sampling, which is the most common method. Here, we study the time, in terms of the number of packets, the victim needs to reconstruct the attack graph when there is a single attacker. This random variable plays an important role in the reconstruction algorithm. We mention in passing that the process of reconstructing the attack graph is analogous to a version of the well-known coupon collector's problem (with coupons having distinct probabilities). Thus, the results may be used in other applications of this problem.Our main theoretical results determine the asymptotic distribution and expected value of the reconstruction time. We present simulations, demonstrating that the approximations, obtained for short real-world attack paths, are pretty accurate.

A Low-Overhead and High-Precision Attack Traceback Scheme with Combination Bloom Filters

Distributed denial of service attacks seriously threatens the availability of highly resilient software-defined networking systems, such as data center networks. A traceback scheme is an effective means of mitigating attacks by identifying the location of the attacker and the attacking path. However, traditional traceback schemes suffer from low traceability success rates, high packet header overheads, and high communication traffic overheads, in addition to the fact that logically centralized traceability schemes make the control plane a prime target for attacks. To overcome the above challenges, we propose the low-overhead and high-precision traceback scheme, which is divided into two stages: packet marking and path reconstruction. The first stage of the traceback scheme utilizes programmable switches in the data plane to selectively mark the actual physical path information that the packet was forwarded on. The marking method is adaptive to the path length, which utilizes a combined Bloom filter so that the packet length does not grow with the length of the attacking path. The proposed probabilistic packet marking algorithm effectively reduces the number of packets collected to reconstruct the attacking path. The second stage of the traceback scheme utilizes the distributed victim host to reconstruct the attacking path without the controller and locate the source of the attacker. Theoretical analysis and experimental results show that the proposed scheme ensures the high accuracy of tracing and minimizes the traffic overhead and storage overhead required for the traceback process.

On packet marking and Markov modeling for IP Traceback: A deep probabilistic and stochastic analysis

From many years, the methods to defend against Denial of Service attacks have been very attractive from different point of views, although network security is a large and very complex topic. Different techniques have been proposed and so-called packet marking and IP tracing procedures have especially demonstrated a good capacity to face different malicious attacks. While host-based DoS attacks are more easily traced and managed, network-based DoS attacks are a more challenging threat. In this paper, we discuss a powerful aspect of the IP traceback method, which allows a router to mark and add information to attack packets on the basis of a fixed probability value. We propose a potential method for modeling the classic probabilistic packet marking algorithm as Markov chains, allowing a closed form to be obtained for evaluating the correct number of received marked packets in order to build a meaningful attack graph and analyze how marking routers must behave to minimize the overall overhead.

A Survey of Traceback Based on Probabilistic Packet Marking Under DDoS Attacks

DDoS attacks are mostly adopted by attackers in the network. This attack is malicious on the network protocol, resulting in the object not working properly. At present, the Packet Marking is the main method to trace back the attackers under DDoS attacks, especially the Probabilistic Packet Marking (PPM) of Packet Marking. Therefore, the two main types of Probabilistic Packet Marking are studied in this paper: Advanced Packet Marking and Authenticated Packet Marking (APM) and Adjusted Probabilistic Packet Marking (APPM).

LPM: A lightweight authenticated packet marking approach for IP traceback

IP traceback approaches have an important role to play in mitigating the attacks based on IP spoofing like Denial of service/Distributed denial of service attacks. Due to the obvious significance of such attacks, numerous approaches have been proposed in the literature. However, as per our observations, there is still a scope to improve the IP traceback techniques especially in terms of reducing the number of false-positives, reducing the number of packets required at the victim node and the requirement of an upstream router map.Motivated by this observation, in this paper, we propose a novel Light-weight Packet Marking (LPM) that is a probabilistic packet marking (PPM) approach, to trace back the sources of an attack. LPM improves upon the existing PPM approaches in the number of packets required by the victim to reconstruct the attack paths, reduced false-positives and support incremental deployment. It does not even require an upstream router map. LPM also authenticates the marking that enables a victim to detect the attackers attempts to forge the marking. LPM uses multiple hash functions to reduce the false positives further to zero. We carry out experimental analysis as well as security analysis of LPM considering attacker and compromised routers in our attacker model.

Towards Smart Healthcare: Patient Data Privacy and Security in Sensor‐Cloud Infrastructure

Nowadays, wireless body area networks (WBANs) systems have adopted cloud computing (CC) technology to overcome limitations such as power, storage, scalability, management, and computing. This amalgamation of WBANs systems and CC technology, as sensor‐cloud infrastructure (S‐CI), is aiding the healthcare domain through real‐time monitoring of patients and the early diagnosis of diseases. Hence, the distributed environment of S‐CI presents new threats to patient data privacy and security. In this paper, we review the techniques for patient data privacy and security in S‐CI. Existing techniques are classified as multibiometric key generation, pairwise key establishment, hash function, attribute‐based encryption, chaotic maps, hybrid encryption, Number Theory Research Unit, Tri‐Mode Algorithm, Dynamic Probability Packet Marking, and Priority‐Based Data Forwarding techniques, according to their application areas. Their pros and cons are presented in chronological order. We also provide our six‐step generic framework for patient physiological parameters (PPPs) privacy and security in S‐CI: (1) selecting the preliminaries; (2) selecting the system entities; (3) selecting the technique; (4) accessing PPPs; (5) analysing the security; and (6) estimating performance. Meanwhile, we identify and discuss PPPs utilized as datasets and provide the performance evolution of this research area. Finally, we conclude with the open challenges and future directions for this flourishing research area.

Record route IP traceback: Combating DoS attacks and the variants

The Internet introduces a variety of vulnerabilities that put the security and privacy of computer based systems under risk. One of the most perilous threats in the Internet is the Denial of Service (DoS) attack and its variants such as Distributed DoS (DDoS). In this work we propose a novel probabilistic packet marking scheme to infer forward paths from attacker sites to a victim site and enable the victim to delegate the defense to the upstream Internet Service Providers (ISPs). We exploit the record route feature of the IP protocol to implement our probabilistic packet marking scheme. Compared to the other techniques, our approach requires less many packets to construct the paths from attacker sites toward a victim site. Our results show that a victim site can construct the forward path from an attacker site after receiving 20.23 packets on the average under DoS attacks. Moreover, we construct the forward-paths graph from 5000 attacker sites toward the victim site by receiving 11.58 packets per attacker site, on the average.

On the Similarities Between Urban Traffic Management and Communication Networks: Application of the Random Early Detection Algorithm for Self-Regulating Intersections

Communications are revolutionizing transport systems. Recently, novel technologies from the fields of telecommunications and data networks have been incorporated into both vehicle systems and road infrastructures, setting new frontiers in the design and development of Smart Cities and Smart Urban Mobility. Whereas each scenario, i.e., the vehicular one and the data communications one, has its own and well-defined particularities, there are also similarities that should be further explored. In this work, we address this confluence of research areas by investigating the applicability in vehicle traffic management of an active queue control algorithm employed in communication networks and called Random Early Detection (RED). RED provides congestion avoidance in data networks by controlling the average queue size of network buffers. It detects incipient congestion and, using probabilistic packet-marking or packet-dropping behavior, it is able to keep the data network at high throughput and low delay. In this work, we propose an adaption of RED to vehicle traffic management in signaled intersections, namely, RED for Vehicles (REDV). A complete characterization of REDV is provided, including the impact of several configuration parameters. We also conduct an extensive comparative performance evaluation via computer simulation. Results show that REDV is a light and simple algorithm able to significantly reduce the average trip time, waiting time, and CO2 emissions in a signaled intersection compared to other approaches from the related literature.

English

English

Increasing the effectiveness of packet marking schemes using wrap-around counting Bloom filter

Latest variants of denial-of-service attack like low-rate denial-of-service attack require very few packets for launching an attack. As a result, reducing the number of packets required for IP traceback has gained considerable importance. In packet marking schemes, routers probabilistically mark the packets. Therefore, a large number of packets is required by the victim to reconstruct the complete attack path. In this paper, we introduce an efficient data structure known as wrap-around counting Bloom filter WCBF to minimize the required number of packets. WCBF maintains a set of cyclic counters to decide which particular mark needs to be sent to the victim for faster IP traceback. We prove the efficacy of our technique by performing detailed theoretical analysis and confirm it using extensive experimental results. In case of probabilistic packet marking, the proposed scheme reduces the number of packets by 5-10 times. Likewise, in case of deterministic packet marking, the number of packets required is reduced by 2-4 times. We also show that WCBF can be incorporated with different variants of probabilistic packet marking and deterministic packet marking to obtain effective results. Finally, we highlight the benefits of WCBF over the other traceback schemes like logging and hybrid traceback. Copyright © 2016 John Wiley & Sons, Ltd.

Distributed Denial of Service Attack Source Detection Using Efficient Traceback Technique (ETT) in Cloud-Assisted Healthcare Environment

Security and privacy are the first and foremost concerns that should be given special attention when dealing with Wireless Body Area Networks (WBANs). As WBAN sensors operate in an unattended environment and carry critical patient health information, Distributed Denial of Service (DDoS) attack is one of the major attacks in WBAN environment that not only exhausts the available resources but also influence the reliability of information being transmitted. This research work is an extension of our previous work in which a machine learning based attack detection algorithm is proposed to detect DDoS attack in WBAN environment. However, in order to avoid complexity, no consideration was given to the traceback mechanism. During traceback, the challenge lies in reconstructing the attack path leading to identify the attack source. Among existing traceback techniques, Probabilistic Packet Marking (PPM) approach is the most commonly used technique in conventional IP- based networks. However, since marking probability assignment has significant effect on both the convergence time and performance of a scheme, it is not directly applicable in WBAN environment due to high convergence time and overhead on intermediate nodes. Therefore, in this paper we have proposed a new scheme called Efficient Traceback Technique (ETT) based on Dynamic Probability Packet Marking (DPPM) approach and uses MAC header in place of IP header. Instead of using fixed marking probability, the proposed scheme uses variable marking probability based on the number of hops travelled by a packet to reach the target node. Finally, path reconstruction algorithms are proposed to traceback an attacker. Evaluation and simulation results indicate that the proposed solution outperforms fixed PPM in terms of convergence time and computational overhead on nodes.

Increasing Accuracy and Reliability of IP Traceback for DDoS Attack Using Completion Condition

Probabilistic Packet Marking (PPM) is one of the most promising schemes for performing IP Traceback. PPM reconstructs the attack graph in order to trace back to the attackers. Finding the Completion Condition Number (i.e. precise number of packets required to complete the traceback) is very important. Without a proper completion-condition, we might reconstruct a wrong attack-graph and attackers can evade detection. One presently being used works only for a single attacker based DoS attack and has an accuracy of just around 70%. We propose a new Completion Condition Number which has an accuracy of 95% and it works even for the multiple attacker based DDoS attacks. We confirm the results using detailed theoretical analysis and extensive simulation work. To the best of our knowledge, we are the first to apply the concept of Completion Condition Number to increase the reliability of IP Traceback for the DDoS attacks.

Non‐repeatedly marking traceback model for wireless sensor networks

When networks are under attack, traceback schemes can be used to locate the compromised node and remove the compromised node from the network. To resolve the problem that marked information has been easy to be covered by the information of down-stream node in the traceback schemes based on probabilistic packet marking (PPM), ‘a non-repeatedly marking traceback scheme for wireless sensor networks (NMtrace) is proposed to locate the compromised nodes in this study’. In the NMtrace, when a packet is forwarding to the base station, if the edge information of the packet has been marked by forwarding nodes, the packet will not be marked again by the other nodes. The security shows that the NMtrace can resilience against various attacks which are launched by the compromised forwarding nodes collude with compromised source node. The performance evaluation shows that with the length of the attack path increasing, ‘the NMtrace needs fewer’ packets to reconstruct the attack path than the PPM-based schemes, the complete convergence rate less affected by the marking probability p and the energy ‘consumption of the NMtrace is also’ less than PPM-based schemes.

IP Traceback through modified Probabilistic Packet Marking algorithm using Chinese Remainder Theorem

Abstract Probabilistic Packet Marking algorithm suggests a methodology to identify all the participated routers of the attack path by probabilistically marking the packets. In this approach, these marked packets contain partial information regarding the routers of the attack path. At receiver, to get the complete information of every router, it requires more number of marked packets and hence more combinations and more false positives. To overcome this drawback we have presented a novel idea in finding the exact IP address of the routers in the attack path by applying Chinese Remainder Theorem. The result of our implementation reveals that our idea requires less number of marked packets and takes no time in constructing the attack path. The same idea is true even in the case of multiple attackers.

Detection of Denial of Service Attack in Wireless Network using Dominance based Rough Set

Denial-of-service (DoS) attack is aim to block the services of victim system either temporarily or permanently by sending huge amount of garbage traffic data in various types of protocols such as transmission control protocol, user datagram protocol, internet connecting message protocol, and hypertext transfer protocol using single or multiple attacker nodes. Maintenance of uninterrupted service system is technically difficult as well as economically costly. With the invention of new vulnerabilities to system new techniques for determining these vulnerabilities have been implemented. In general, probabilistic packet marking (PPM) and deterministic packet marking (DPM) is used to identify DoS attacks. Later, intelligent decision proto-type was proposed. The main advantage is that it can be used with both PPM and DPM. But it is observed that, data available in the wireless network information system contains uncertainties. Therefore, an effort has been made to detect DoS attack using dominance based rough set. The accuracy of the proposed model obtained over the KDD cup dataset is 99.76 and it is higher than the accuracy achieved by resilient back propagation (RBP) model.

METRO: Measurement of End-to-End Route Trust

Given the current situation on the Internet, it is important to determine the trust of the communication routes between a client and server. Such determination can only be established by end terminals such as clients and servers, not by intermediate routers or network providers so far. The revelations regarding PRISM and other programs highlight the importance of this issue. In this paper, a method to identify the trust level of a route between a client and a server is proposed. This method identifies the trust level using packet authentication, Probabilistic Packet Marking (PPM), and knowledge bases maintained by trusted third parties. A prototype system of the proposed method was developed and evaluated, and the evaluation results prove its feasibility. To the best of our knowledge, the proposed method is the first method to identify the trust level of a route based on information obtained from intermediate routers or Autonomous Systems (ASs).

Using network motifs to investigate the influence of network topology on PPM-based IP traceback schemes

Multiple schemes that utilize Probabilistic Packet Marking (PPM) have been proposed to deal with Distributed Denial of Service (DDoS) attacks by reconstructing their attack graphs and identifying the attack sources. By analyzing a set of PPM-based schemes, we show that past researchers have evaluated the schemes using disparate and often inadequate underlying topologies, which makes a side-by-side comparison of the scheme performance a complex problem.To tackle this problem, we evaluate selected schemes on a large set of Internet-like topologies and adapt the network motif approach to provide a common ground for comparing the schemes’ performances in different network topologies. This approach allows us to determine the level of structural similarity between network topologies and consequently enables the comparison of scheme performance even when the schemes are implemented on different topologies.Our results reveal that both the value of the PPM-based schemes’ convergence times, and their rankings vary depending on the underlying network topology. However the variation is considerably less when the topologies are compared within superfamilies of structural similarity. More specifically, the standard deviation in convergence times across the networks drops to about a tenth of its original value when the set of 28 networks are arranged in four superfamilies. To complement our results, we present an analytical model showing a link between scheme performance in any superfamily, and the motifs exhibited by the networks in that superfamily.Our work proposes an effective way of comparing general network protocol performance in which the protocol is evaluated on specific representative networks instead of an entire set of networks.

Uniform DoS traceback

Denial of service (DoS) is a significant security challenge in the Internet. Identifying the attackers so that their attack traffic can be blocked at source is one strategy that can be used to mitigate DoS attacks. However, determining the source can be difficult due to the inherent connectionless nature of IP. Traceback using various marking schemes that overload, mostly unused, fields in the IP header are promising techniques to identify the source of the attack. This paper shows that the marking probability used in two existing techniques: probabilistic packet marking (PPM) and dynamic probabilistic packet marking (DPPM) are not optimal and derives an optimal marking scheme called uniform probabilistic packet marking (UPPM). The performance of UPPM is shown to be improved compared to PPM and DPPM by performing comparative numerical analysis. One significant advantage of UPPM over these earlier techniques is that it performs marking at the level of autonomous systems (ASs) rather than at every router. This has advantages both in terms of marking overhead and allowing the optimal formulation of marking probability by utilizing metrics readily available from BGP-4, the inter-AS routing protocol.

Identification Method of Attack Path Based on Immune Intrusion Detection

This thesis takes researches on the immune intrusion detection and IP trace back technology. To find out the network data features of the real-time analyses, the distributed immune intrusion detection system and the packet marking theory are used; to guide the dynamically processing of path signs technology, the immune intrusion detection system is used; what's more, to dynamically adaptive different methods of characteristics of network data, the path signs technology is adopted. After that, the attack paths can be quickly identified to provide path information for feature detector on attack path in the immune intrusion detection system. Experiment results show that this scheme can quickly reconstruct the attack path information, and the performance on the aspects of the convergence is with efficiency rate and false positive rate, which is superior to the current probabilistic packet marking algorithm and can provide characteristic path information for immune intrusion detection system.

A practical approach for provenance transmission in wireless sensor networks

Assessing the trustworthiness of sensor data and transmitters of this data is critical for quality assurance. Trust evaluation frameworks utilize data provenance along with the sensed data values to compute the trustworthiness of each data item. However, in a sizeable multi-hop sensor network, provenance information requires a large and variable number of bits in each packet, resulting in high energy dissipation due to the extended period of radio communication. In this paper, we design energy-efficient provenance encoding and construction schemes, which we refer to as Probabilistic Provenance Flow (PPF). Our work demonstrates the feasibility of adapting the Probabilistic Packet Marking (PPM) technique in IP traceback to wireless sensor networks. We design two bit-efficient provenance encoding schemes along with a complementary vanilla scheme. Depending on the network size and bit budget, we select the best method based on mathematical approximations and numerical analysis. We integrate PPF with provenance-based trust frameworks and investigate the trade-off between trustworthiness of data items and transmission overhead. We conduct TOSSIM simulations with realistic wireless links, and perform testbed experiments on 15–20TelosB motes to demonstrate the effectiveness of PPF. Our results show that the encoding schemes of PPF have identical performance with a low bit budget (∼32-bit), requiring 33% fewer packets and 30% less energy than PPM variants to construct provenance. With a twofold increase in bit budget, PPF with the selected encoding scheme reduces energy consumption by 46–60%.