Abstract:DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.

A Flow-Based Traceback Scheme on an AS-Level Overlay Network

Easytrace: An Easily-Deployable Light-Weight Ip Traceback On An As-Level Overlay Network

An Incrementally Deployable Flow-Based Scheme for IP Traceback.

Autonomous System-Based Marking Scheme for Internet Traceback

Research of Improved Probabilistic Packet Marking Algorithms

An Adaptive Probabilistic Marking Scheme for Fast and Secure Traceback

Flow Anomaly Telemetry Driven by Programmable Data Plane

A Feasible IP Traceback Framework Through Dynamic Deterministic Packet Marking

Overlay logging: an IP traceback scheme in MPLS network

A Tool for Tracing Network Data Plane Via SDN/OpenFlow

A Real-Time Traceback Scheme for DDoS Attacks

Flexible Deterministic Packet Marking: an IP Traceback System to Find the Real Source of Attacks

A Method of IP Traceback Against DDoS Attack

A Probabilistic Marking Scheme for Fast Traceback

A Logless Fast IP Traceback Scheme Against DDoS Attacks

Distributed-Log-based Scheme for IP Traceback

DDoS Traceback Scheme Based on Real-Time Consideration

A New Scheme for Ip Traceback under Dos Attack

FlowTracer: A Tool for Uncovering Network Path Usage Imbalance in AI Training Clusters

A Framework to Quantify the Pitfalls of Using Traceroute in AS-Level Topology Measurement.