Advertisement

Deterministic Packet Marking with Link Signatures for IP Traceback

  • Shi Yi
  • Yang Xinyu
  • Li Ning
  • Qi Yong
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4318)

Abstract

Probabilistic Packet Marking algorithm, one promising solution to the IP traceback problem, uses one fixed marking space to store router information. Since this fixed space is not sufficient for storing all routers information, each router writes its information into packets chosen with probability p, so-called probabilistic marking. Probabilistic marking seems to be helpful in lowering router overhead, however, it also bring computation overhead for the victim to reconstruct the attack paths and large number of false positives. In this paper, we present a new approach for IP traceback, Deterministic Packet Marking Scheme with Link Signatures, which needs routers mark all packets during forwarding (so-called deterministic marking). We make a study of how much both the probabilistic and our deterministic packet marking schemes affect router overhead through simulations. The results confirm that our deterministic marking scheme will slightly lower router overhead, and besides, it has superior performance than another improved probabilistic packet marking method, Advanced Marking Schemes. Further performance analysis and simulation results are given to show that our technique is superior in precision to previous work—it has almost zero false positive rate. It also has lower computation overhead for victim and needs just a few packets to trace back attacks and to reconstruct the attack paths even under large scale distributed denial-of-service attacks. In addition, our scheme is simple to implement and support incremental deployment.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Savage, G.S., Wetherall, D., Karlin, A., Anderson, T.: Network support for IP traceback. IEEE/ACM Transaction on Networking 9, 226–237 (2001)CrossRefGoogle Scholar
  2. 2.
    Savage, G.S., Wetherall, D., Karlin, A., Anderson, T.: Practical network support for IP traceback. In: Proc. of ACM SIGCOMM, pp. 295–306 (2000)Google Scholar
  3. 3.
    Song, D.X., Perrig, A.: Advanced and Authenticated Marking Schemes for IP Traceback. In: Proc. of INFOCOM, vol. 2, pp. 878–886 (2001)Google Scholar
  4. 4.
    Peng, T., Leckie, C., Ramamohanarao, K.: Adjusted probabilistic packet marking for IP traceback. In: Proc. Networking, pp. 697–708 (2002)Google Scholar
  5. 5.
    Adler, M.: Tradeoffs in probabilistic packet marking for IP traceback. In: Proc. 34th ACMSymp. Theory of Computing (STOC), pp. 407–418 (2002)Google Scholar
  6. 6.
    Park, K., Lee, H.: On the Effectiveness of Probabilistic Packet Marking for IP Traceback under Denial of Service Attack. In: Proc. of IEEE INFOCOM (2001)Google Scholar
  7. 7.
    Shannon, C., Moore, D., Claffy, K.: Characteristics of fragmented IP traffic on internet links. In: Proc. SIGCOMM, pp. 83–97 (2001)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Shi Yi
    • 1
  • Yang Xinyu
    • 1
  • Li Ning
    • 1
  • Qi Yong
    • 1
  1. 1.Dept. of Computer Science and TechnologyXi’an Jiaotong UniversityXi’anP.R.C.

Personalised recommendations