Tagged fragment marking scheme with distance-weighted sampling for a fast IP traceback

Authors:
Ki Chang Kim;Jin Soo Hwang;Byung Yong Kim;Soo-Duk Kim
Affiliations:
School of Information and Communication Engineering, Inha Univ., Korea;Department of Statistics, Inha Univ., Korea;School of Information and Communication Engineering, Inha Univ., Korea;School of Information and Communication Engineering, Inha Univ., Korea
Venue:
APWeb'03 Proceedings of the 5th Asia-Pacific web conference on Web technologies and applications
Year:
2003

Citing 6
Cited 3

Fragmentation considered harmful

SIGCOMM '87 Proceedings of the ACM workshop on Frontiers in computer communications technology
An analysis of security incidents on the Internet 1989-1995

An analysis of security incidents on the Internet 1989-1995
Providing guaranteed services without per flow management

Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Practical network support for IP traceback

Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Analyzing Distributed Denial of Service Tools: The Shaft Case

LISA '00 Proceedings of the 14th USENIX conference on System administration
Centertrack: an IP overlay network for tracking DoS floods

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9

Proving optimality of DWS(distance-weighted sampling) probability function for FMS IP trace-back technique

ICDCN'06 Proceedings of the 8th international conference on Distributed Computing and Networking
Analysis of the false-positive error rate of tagged fragment marking scheme

Information Processing Letters
IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

Cluster Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

IP traceback technique allows a victim to trace the routing path that an attacker has followed to reach his system. It has an effect of deterring future attackers as well as capturing the current one. FMS (Fragment Marking Scheme) is an efficient implementation of IP traceback. Every router participating in FMS leaves its IP information on the passing-through packets, partially and with some probability. The victim, then, can collect the packets and analyze them to reconstruct the attacking path. FMS and similar schemes, however, suffer a long convergence time to build the path when the attack path is lengthy. Also they suffer a combinatorial explosion problem when there are multiple attack paths. This paper suggests techniques to restrain the convergence time and the combinatorial explosion. The convergence time is reduced considerably by insuring all routers have close-to-equal chance of sending their IP fragments through a distance-weighted sampling technique. The combinatorial explosion is avoided by tagging each IP fragment with the corresponding router's hashed identifier.