Probabilistic Packet Marking Research Articles

A Precise Termination Condition of the Probabilistic Packet Marking Algorithm

The probabilistic packet marking (PPM) algorithm is a promising way to discover the Internet map or an attack graph that the attack packets traversed during a distributed denial-of-service attack. However, the PPM algorithm is not perfect, as its termination condition is not well defined in the literature. More importantly, without a proper termination condition, the attack graph constructed by the PPM algorithm would be wrong. In this work, we provide a precise termination condition for the PPM algorithm and name the new algorithm the rectified PPM (RPPM) algorithm. The most significant merit of the RPPM algorithm is that when the algorithm terminates, the algorithm guarantees that the constructed attack graph is correct, with a specified level of confidence. We carry out simulations on the RPPM algorithm and show that the RPPM algorithm can guarantee the correctness of the constructed attack graph under 1) different probabilities that a router marks the attack packets and 2) different structures of the network graph. The RPPM algorithm provides an autonomous way for the original PPM algorithm to determine its termination, and it is a promising means of enhancing the reliability of the PPM algorithm.

Markov Chain Modelling of the Probabilistic Packet Marking Algorithm

In this work, we show that the current termination condition of the Probabilistic Packet Marking (PPM) algorithm is not correct for general networks, and this implies the estimation of expected number of marked packets is not accurate. As a result, this may lead to an incomplete attack graph construction. To remedy this problem, we propose a Markov chain modelling of the PPM algorithm. By applying the fundamental matrix theory, one can result in an accurate estimation of the expected number of marked packets. Our simulation results show that the Markov chain modelling technique is effective in calculating the expected number of marked packets.

Performance analysis of probabilistic packet marking in IPv6

Probabilistic packet marking (PPM) has received considerable attention as an IP traceback approach against distributed Denial-of-Service attack, which is one of the most challenging security threat in the Internet. PPM is a technique that seeks to identify the source of such attacks by marking individual packets with portion of the attack path, and then relies on the volume of attack traffic generated to ensure that the whole path can be reconstructed. However, modifying the identification field in the IPv4 packet header to mark packet incurs backward incompatibility for IP fragmented packets. In this paper, we address this issue and analyze the viability of PPM under the next-generation Internet Protocol, IPv6. In doing so, we consider the flaws inherent to IPv4 implementations that limit their backward compatibility, and demonstrate how these shortcomings can be avoided in IPv6. We show that the Flow Label field in the IPv6 datagram header can be safely and effectively overloaded to implement PPM schemes, and present simulation results verifying the applicability and efficiency of this approach.

An IP Traceback Technique Based on Router’s Vector-Edge-Sampling

A new edge sampling approach called the 'Router's Vector-Edge-Sampling (RVES)' is presented, which is simple for PPM (probability packet marking) to be implemented and deployed. In the graph model, vertexes are denoted by network interfaces instead of routers, while edges by vector edges instead of traditional ones. With better simplicity of implementation and flexibility of policy deployment, RVES features effectiveness for Distributed Denial-of-Service (DDoS) attack reconstruction. PPM technologies based on traditional edge sampling are still applicable. Prototypes have been deployed in the Internet and experiments prove the effectiveness and feasibility of RVES.

Vulnerabilities in distance-indexed IP traceback schemes

In order to counter Denial-of-Service (DoS) attacks using spoofed source addresses, many IP traceback schemes have been proposed in the last few years. Among them, distance-indexed probabilistic packet marking schemes appear to be very attractive. In this paper, we first discover two intrinsic vulnerabilities in these schemes. Substantiated by efficacy analysis and numerical results, several exploits are designed to take advantage of these vulnerabilities in an efficient manner when compared with the traceback effort attempted by victims. Consequently, we show that the design goal of these schemes can be compromised in practice. Further, we discuss these vulnerabilities in a general context relevant to network protocols and examine a few possible alternatives.

Dynamic probabilistic packet marking for efficient IP traceback

Recently, denial-of-service (DoS) attack has become a pressing problem due to the lack of an efficient method to locate the real attackers and ease of launching an attack with readily available source codes on the Internet. Traceback is a subtle scheme to tackle DoS attacks. Probabilistic packet marking (PPM) is a new way for practical IP traceback. Although PPM enables a victim to pinpoint the attacker's origin to within 2-5 equally possible sites, it has been shown that PPM suffers from uncertainty under spoofed marking attack. Furthermore, the uncertainty factor can be amplified significantly under distributed DoS attack, which may diminish the effectiveness of PPM. In this work, we present a new approach, called dynamic probabilistic packet marking (DPPM), to further improve the effectiveness of PPM. Instead of using a fixed marking probability, we propose to deduce the traveling distance of a packet and then choose a proper marking probability. DPPM may completely remove uncertainty and enable victims to precisely pinpoint the attacking origin even under spoofed marking DoS attacks. DPPM supports incremental deployment. Formal analysis indicates that DPPM outperforms PPM in most aspects.

A practical and robust inter-domain marking scheme for IP traceback

A practical and robust inter-domain marking scheme for IP traceback is proposed. We first identify six drawbacks of Probabilistic Packet Marking (PPM), and then contrive a synergic scheme to address all of them. To relieve the victim from the daunting computational overhead, we derive the optimal marking probability with respect to the number of packets required for path reconstruction, and explore two different approaches to enhance PPM. In so doing, computational burden and spoofed marking inscribed by the attacker are thwarted. Next, we study the issue of bogus marking incurred by subverted routers. By coupling the marking and routing information, a downstream router can examine the correctness of the marking provided by upstream routers, thus eliminating the spurious marking embedded by subverted routers. Our coarse-grained marking tactic (marking at the AS level rather than hop-by-hop) brings two additional benefits: our scheme can effectively suppress false positives, and partial deployment of our scheme may achieve the similar effect as global deployment in the power-law Internet. Finally, we evaluate and analyze the performance of our proposal on empirical Internet measurement data. Results show that as many as 90.67% of marked packets required for path reconstruction may be reduced on average while false positives are greatly suppressed and robustness is significantly enhanced.

Deterministic packet marking for time-varying congestion price estimation

The addition of the two-bit Explicit Congestion Notification (ECN) field to the IP header provides routers with a mechanism for conveying link price information necessary for the successful operation of a number of congestion control schemes. Two recent proposals for probabilistic packet marking at the routers allow receivers to estimate path price from the fraction of marked packets. In this paper we introduce an alternative deterministic marking scheme for encoding path price. Each router quantizes the price of its outgoing link to a fixed number of bits. Every data packet sent along the path encodes a partial sum of the quantized link prices in its ECN field, allowing the receiver to estimate the path price. We evaluate the performance of our algorithm in terms of its error in representing prices, and compare it to probabilistic marking. We show that based on empirical Internet traffic characteristics, our algorithm performs better when estimating time-varying prices and static path price using small blocks of packets

Tabu marking scheme to speedup IP traceback

The IP traceback is an important mechanism in defending against distributed denial-of-service (DDoS) attacks. In this paper, we propose a probabilistic packet marking (PPM) scheme, Tabu Marking Scheme (TMS), to speedup IP traceback. The key idea of is that, a router still marks packets probabilistically, but regards a packet marked by an upstream router as a tabu and does not mark it again. We study the impact of the traffic aggregation on the convergence behavior of PPM schemes. Furthermore we derive a new analytical result on the partial coupon collection problem, which is a powerful tool applicable for computing the mean convergence time of any PPM scheme. Our study shows that the idea of not only helps a PPM scheme that allows overwriting to reduce the convergence time under a DDoS attack, but also ensures the authentication of the routers' markings.

Trade-offs in probabilistic packet marking for IP traceback

There has been considerable recent interest in probabilistic packet marking schemes for the problem of tracing a sequence of network packets back to an anonymous source. An important consideration for such schemes is the number of packet header bits that need to be allocated to the marking protocol. Let b denote this value. All previous schemes belong to a class of protocols for which b must be at least log n , where n is the number of bits used to represent the path of the packets. In this article, we introduce a new marking technique for tracing a sequence of packets sent along the same path. This new technique is effective even when b = 1. In other words, the sequence of packets can be traced back to their source using only a single bit in the packet header. With this scheme, the number of packets required to reconstruct the path is O (2 2 n ), but we also show that Ω(2 n ) packets are required for any protocol where b = 1. We also study the trade-off between b and the number of packets required. We provide a protocol and a lower bound that together demonstrate that for the optimal protocol, the number of packets required (roughly) increases exponentially with n , but decreases doubly exponentially with b . The protocol we introduce is simple enough to be useful in practice. We also study the case where the packets are sent along k different paths. For this case, we demonstrate that any protocol must use at least log(2 k − 1) header bits. We also provide a protocol that requires ⌈log(2 k + 1)⌉ header bits in some restricted scenarios. This protocol introduces a new coding technique that may be of independent interest.

Probabilistic Packet Marking With Non-Preemptive Compensation

A new scheme in probabilistic packet marking (PPM) for IP traceback against denial-of-service attack is presented. Non-preemptive PPM is performed while a marked packet is coming, but compensates the reduction of marking probability in marked-free packets. The nonpreemptive compensation makes the probability of each marked packet arrived at the victim is equal to its original marking probability. This scheme efficiently improves the convergent amount of marked packets required for reconstructing the complete attack path.

IP Traceback using header compression

Denial-of-service and other malicious attacks have become increasingly prevalent in recent years. A major issue hindering the ability to trace attacks to their sources is the ease of IP address spoofing which conceals the attackers’ identity. Several techniques, generically named IP traceback, have been proposed to enable tracing of IP packets from destination to source despite IP spoofing. In this paper, we propose a Simple, Novel IP Traceback using Compressed Headers (SNITCH) that is based upon Probabilistic Packet Marking (PPM). This technique employs header compression to increase the number of bits available for insertion of traceback information. Simulations performed on empirical data have shown that 100% of the attack paths can be determined with a maximum of 0.43% false positive paths.

An analysis of using reflectors for distributed denial-of-service attacks

Attackers can render distributed denial-of-service attacks more difficult to defend against by bouncing their flooding traffic off of reflectors ; that is, by spoofing requests from the victim to a large set of Internet servers that will in turn send their combined replies to the victim. The resulting dilution of locality in the flooding stream complicates the victim's abilities both to isolate the attack traffic in order to block it, and to use traceback techniques for locating the source of streams of packets with spoofed source addresses, such as ITRACE [Be00a], probabilistic packet marking [SWKA00], [SP01], and SPIE [S+01]. We discuss a number of possible defenses against reflector attacks, finding that most prove impractical, and then assess the degree to which different forms of reflector traffic will have characteristic signatures that the victim can use to identify and filter out the attack traffic. Our analysis indicates that three types of reflectors pose particularly significant threats: DNS and Gnutella servers, and TCP-based servers (particularly Web servers) running on TCP implementations that suffer from predictable initial sequence numbers. We argue in conclusion in support of "reverse ITRACE" [Ba00] and for the utility of packet traceback techniques that work even for low volume flows, such as SPIE.

Network support for IP traceback

This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back toward their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or "spoofed," source addresses. We describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet service providers (ISPs). Moreover, this traceback can be performed "post mortem"-after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backward compatible, and can be efficiently implemented using conventional technology.

Practical network support for IP traceback

This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or ``spoofed'', source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed ``post-mortem'' -- after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.