Practical network support for IP traceback

Authors:
Stefan Savage;David Wetherall;Anna Karlin;Tom Anderson
Affiliations:
Department of Computer Science and Engineering, University of Washington, Seattle, WA;Department of Computer Science and Engineering, University of Washington, Seattle, WA;Department of Computer Science and Engineering, University of Washington, Seattle, WA;Department of Computer Science and Engineering, University of Washington, Seattle, WA
Venue:
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Year:
2000

Citing 13
Cited 261

Fragmentation considered harmful

SIGCOMM '87 Proceedings of the ACM workshop on Frontiers in computer communications technology
End-to-end routing behavior in the Internet

IEEE/ACM Transactions on Networking (TON)
An analysis of security incidents on the Internet 1989-1995

An analysis of security incidents on the Internet 1989-1995
Resource containers: a new facility for resource management in server systems

OSDI '99 Proceedings of the third symposium on Operating systems design and implementation
Defending against denial of service attacks in Scout

OSDI '99 Proceedings of the third symposium on Operating systems design and implementation
Providing guaranteed services without per flow management

Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Security problems in the TCP/IP protocol suite

ACM SIGCOMM Computer Communication Review
A review of port scanning techniques

ACM SIGCOMM Computer Communication Review
A Formal Framework and Evaluation Method for Network Denial of Service

CSFW '99 Proceedings of the 12th IEEE workshop on Computer Security Foundations
Server Selection Using Dynamic Path Characterization in Wide-Area Networks

INFOCOM '97 Proceedings of the INFOCOM '97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution
Holding intruders accountable on the Internet

SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy
Centertrack: an IP overlay network for tracking DoS floods

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Anonymous connections and onion routing

IEEE Journal on Selected Areas in Communications

Using router stamping to identify the source of IP packets

Proceedings of the 7th ACM conference on Computer and communications security
Video over TCP with receiver-based delay control

NOSSDAV '01 Proceedings of the 11th international workshop on Network and operating systems support for digital audio and video
Hash-based IP traceback

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
An algebraic approach to IP traceback

ACM Transactions on Information and System Security (TISSEC)
An analysis of using reflectors for distributed denial-of-service attacks

ACM SIGCOMM Computer Communication Review
Tradeoffs in probabilistic packet marking for IP traceback

STOC '02 Proceedings of the thiry-fourth annual ACM symposium on Theory of computing
Protecting electronic commerce from distributed denial-of-service attacks

Proceedings of the 11th international conference on World Wide Web
Controlling high bandwidth aggregates in the network

ACM SIGCOMM Computer Communication Review
Efficient packet marking for large-scale IP traceback

Proceedings of the 9th ACM conference on Computer and communications security
Query-flood DoS attacks in gnutella

Proceedings of the 9th ACM conference on Computer and communications security
Awareness of Distributed Denial of Service Attacks' Dangers: Role of Internet Pricing Mechanisms

Netnomics
Tracing Network Attacks to Their Sources

IEEE Internet Computing
Measuring ISP topologies with rocketfuel

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Lightweight network support for scalable end-to-end services

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Sustaining Availability of Web Services under Distributed Denial of Service Attacks

IEEE Transactions on Computers
AEGIS: An Active-Network-Powered Defense Mechanism against DDoS Attacks

IWAN '01 Proceedings of the IFIP-TC6 Third International Working Conference on Active Networks
Practical Network Applications on a Lightweight Active Management Environment

IWAN '01 Proceedings of the IFIP-TC6 Third International Working Conference on Active Networks
Looking for Science in the Art of Network Measurement

IWDC '01 Proceedings of the Thyrrhenian International Workshop on Digital Communications: Evolutionary Trends of the Internet
Autonomic Response to Distributed Denial of Service Attacks

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Defeating Denial-of-Service Attacks on the Internet

ICICS '01 Proceedings of the Third International Conference on Information and Communications Security
An Evaluation of Different IP Traceback Approaches

ICICS '02 Proceedings of the 4th International Conference on Information and Communications Security
Providing Process Origin Information to Aid in Network Traceback

ATEC '02 Proceedings of the General Track of the annual conference on USENIX Annual Technical Conference
Adjusted Probabilistic Packet Marking for IP Traceback

NETWORKING '02 Proceedings of the Second International IFIP-TC6 Networking Conference on Networking Technologies, Services, and Protocols; Performance of Computer and Communication Networks; and Mobile and Wireless Communications
A Waypoint Service Approach to Connect Heterogeneous Internet Address Spaces

Proceedings of the General Track: 2002 USENIX Annual Technical Conference
Off-Line Generation of Limited-Use Credit Card Numbers

FC '01 Proceedings of the 5th International Conference on Financial Cryptography
Secure traceroute to detect faulty or malicious routing

ACM SIGCOMM Computer Communication Review
Internet intrusions: global characteristics and prevalence

SIGMETRICS '03 Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
A practical method to counteract denial of service attacks

ACSC '03 Proceedings of the 26th Australasian computer science conference - Volume 16
Pi: A Path Identification Mechanism to Defend against DDoS Attacks

SP '03 Proceedings of the 2003 IEEE Symposium on Security and Privacy
The effectiveness of request redirection on CDN robustness

ACM SIGOPS Operating Systems Review - OSDI '02: Proceedings of the 5th symposium on Operating systems design and implementation
Detection and Protection Against Network Scanning: IEDP

ICCNMC '01 Proceedings of the 2001 International Conference on Computer Networks and Mobile Computing (ICCNMC'01)
A Path Information Caching and Aggregation Approach to Traffic Source Identification

ICDCS '03 Proceedings of the 23rd International Conference on Distributed Computing Systems
A framework for classifying denial of service attacks

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
User-level internet path diagnosis

SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Using graphic turing tests to counter automated DDoS attacks against web servers

Proceedings of the 10th ACM conference on Computer and communications security
Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays

Proceedings of the 10th ACM conference on Computer and communications security
Hop-count filtering: an effective defense against spoofed DDoS traffic

Proceedings of the 10th ACM conference on Computer and communications security
The loop fallacy and serialization in tracing intrusion connections through stepping stones

Proceedings of the 2004 ACM symposium on Applied computing
Towards multisensor data fusion for DoS detection

Proceedings of the 2004 ACM symposium on Applied computing
Distributed Management Architecture for Cooperative Detection and Reaction to DDoS Attacks

Journal of Network and Systems Management
Tracing DDoS Floods: An Automated Approach

Journal of Network and Systems Management
Preventing Internet denial-of-service with capabilities

ACM SIGCOMM Computer Communication Review
Taming IP packet flooding attacks

ACM SIGCOMM Computer Communication Review
Measuring ISP topologies with rocketfuel

IEEE/ACM Transactions on Networking (TON)
Alliance formation for DDoS defense

Proceedings of the 2003 workshop on New security paradigms
A taxonomy of DDoS attack and DDoS defense mechanisms

ACM SIGCOMM Computer Communication Review
The session token protocol for forensics and traceback

ACM Transactions on Information and System Security (TISSEC)
Loose source routing as a mechanism for traffic policies

Proceedings of the ACM SIGCOMM workshop on Future directions in network architecture
Design and analysis of a replicated elusive server scheme for mitigating denial of service attacks

Journal of Systems and Software - Special issue: Performance modeling and analysis of computer systems and networks
Payload attribution via hierarchical bloom filters

Proceedings of the 11th ACM conference on Computer and communications security
New client puzzle outsourcing techniques for DoS resistance

Proceedings of the 11th ACM conference on Computer and communications security
Mitigating bandwidth-exhaustion attacks using congestion puzzles

Proceedings of the 11th ACM conference on Computer and communications security
Attack resistant cache replacement for survivable services

Proceedings of the 2003 ACM workshop on Survivable and self-regenerative systems: in association with 10th ACM Conference on Computer and Communications Security
New techniques for making transport protocols robust to corruption-based loss

ACM SIGCOMM Computer Communication Review
Scalable multicast based filtering and tracing framework for defeating distributed DoS attacks

International Journal of Network Management
Analyzing Distributed Denial of Service Tools: The Shaft Case

LISA '00 Proceedings of the 14th USENIX conference on System administration
Distinguishing between single and multi-source attacks using signal processing

Computer Networks: The International Journal of Computer and Telecommunications Networking
Change-Point Monitoring for the Detection of DoS Attacks

IEEE Transactions on Dependable and Secure Computing
An Extensible Platform for Evaluating Security Protocols

ANSS '05 Proceedings of the 38th annual Symposium on Simulation
Adaptive Distributed Traffic Control Service for DDoS Attack Mitigation

IPDPS '05 Proceedings of the 19th IEEE International Parallel and Distributed Processing Symposium (IPDPS'05) - Workshop 17 - Volume 18
Tabu Marking Scheme for IP Traceback

IPDPS '05 Proceedings of the 19th IEEE International Parallel and Distributed Processing Symposium (IPDPS'05) - Workshop 17 - Volume 18
Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles

IEEE/ACM Transactions on Networking (TON)
Trade-offs in probabilistic packet marking for IP traceback

Journal of the ACM (JACM)
The effectiveness of request redirection on CDN robustness

OSDI '02 Proceedings of the 5th symposium on Operating systems design and implementationCopyright restrictions prevent ACM from being able to make the PDFs for this conference available for downloading
Towards asymptotic optimality in probabilistic packet marking

Proceedings of the thirty-seventh annual ACM symposium on Theory of computing
Providing process origin information to aid in computer forensic investigations

Journal of Computer Security
Perimeter-Based Defense against High Bandwidth DDoS Attacks

IEEE Transactions on Parallel and Distributed Systems
On the robustness of router-based denial-of-service (DoS) defense systems

ACM SIGCOMM Computer Communication Review
Tussle in cyberspace: defining tomorrow's internet

IEEE/ACM Transactions on Networking (TON)
You Can Run, But You Can't Hide: An Effective Statistical Methodology to Trace Back DDoS Attackers

IEEE Transactions on Parallel and Distributed Systems
A DoS-limiting network architecture

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Towards an evolvable internet architecture

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Flash crowd mitigation via adaptive admission control based on application-level observations

ACM Transactions on Internet Technology (TOIT)
OPERA: An open-source extensible router architecture for adding new network services and protocols

Journal of Systems and Software
WebSOS: an overlay-based system for protecting web servers from denial of service attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking - Web security
An internet routing forensics framework for discovering rules of abnormal BGP events

ACM SIGCOMM Computer Communication Review
Monitoring the Macroscopic Effect of DDoS Flooding Attacks

IEEE Transactions on Dependable and Secure Computing
Tracking anonymous peer-to-peer VoIP calls on the internet

Proceedings of the 12th ACM conference on Computer and communications security
Exploiting open functionality in SMS-capable cellular networks

Proceedings of the 12th ACM conference on Computer and communications security
CAPTRA: coordinated packet traceback

Proceedings of the 5th international conference on Information processing in sensor networks
Novel Hybrid Schemes Employing Packet Marking and Logging for IP Traceback

IEEE Transactions on Parallel and Distributed Systems
Inferring Internet denial-of-service activity

ACM Transactions on Computer Systems (TOCS)
Analysis of traceback techniques

ACSW Frontiers '06 Proceedings of the 2006 Australasian workshops on Grid computing and e-research - Volume 54
On the Effectiveness of Secure Overlay Forwarding Systems under Intelligent Distributed DoS Attacks

IEEE Transactions on Parallel and Distributed Systems
Coloring the Internet: IP Traceback

ICPADS '06 Proceedings of the 12th International Conference on Parallel and Distributed Systems - Volume 1
Source selectable path diversity via routing deflections

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
Mitigating attacks on open functionality in SMS-capable cellular networks

Proceedings of the 12th annual international conference on Mobile computing and networking
Quality of service provisioning for composable routing elements

Computer Networks: The International Journal of Computer and Telecommunications Networking
Distributed mechanism in detecting and defending against the low-rate TCP attack

Computer Networks: The International Journal of Computer and Telecommunications Networking
Flexible network monitoring with FLAME

Computer Networks: The International Journal of Computer and Telecommunications Networking - Active networks
One step ahead to multisensor data fusion for DDoS detection

Journal of Computer Security - Special issue on security track at ACM symposium on applied computing 2004
Attacker traceback with cross-layer monitoring in wireless multi-hop networks

Proceedings of the fourth ACM workshop on Security of ad hoc and sensor networks
Survey of network-based defense mechanisms countering the DoS and DDoS problems

ACM Computing Surveys (CSUR)
Design and Analysis of an Adaptive, Global Strategy for Detecting and Mitigating Distributed DoS Attacks in GRID Environments

ANSS '06 Proceedings of the 39th annual Symposium on Simulation
Dynamic probabilistic packet marking for efficient IP traceback

Computer Networks: The International Journal of Computer and Telecommunications Networking
Tabu marking scheme to speedup IP traceback

Computer Networks: The International Journal of Computer and Telecommunications Networking
LIPS: a lightweight permit system for packet source origin accountability

Computer Networks: The International Journal of Computer and Telecommunications Networking
BASE: an incrementally deployable mechanism for viable IP spoofing prevention

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
Non-intrusive IP traceback for DDoS attacks

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
Stateful DDoS attacks and targeted filtering

Journal of Network and Computer Applications
Provider-based deterministic packet marking against distributed DoS attacks

Journal of Network and Computer Applications
Enhanced Internet security by a distributed traffic control service based on traffic ownership

Journal of Network and Computer Applications
Honeypot back-propagation for mitigating spoofing distributed Denial-of-Service attacks

Journal of Parallel and Distributed Computing - Special issue: Security in grid and distributed systems
An edge-to-edge filtering architecture against DoS

ACM SIGCOMM Computer Communication Review
Analysis of area-congestion-based DDoS attacks in ad hoc networks

Ad Hoc Networks
Defense against spoofed IP traffic using hop-count filtering

IEEE/ACM Transactions on Networking (TON)
Improving the resilience of content distribution networks to large scale distributed denial of service attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Active internet traffic filtering: real-time response to denial-of-service attacks

ATEC '05 Proceedings of the annual conference on USENIX Annual Technical Conference
Attrition defenses for a peer-to-peer digital preservation system

ATEC '05 Proceedings of the annual conference on USENIX Annual Technical Conference
Adaptive defense against various network attacks

SRUTI'05 Proceedings of the Steps to Reducing Unwanted Traffic on the Internet on Steps to Reducing Unwanted Traffic on the Internet Workshop
Leveraging good intentions to reduce unwanted network traffic

SRUTI'06 Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet - Volume 2
Inferring internet denial-of-service activity

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Protecting Grid Data Transfer Services with Active Network Interfaces

GRID '05 Proceedings of the 6th IEEE/ACM International Workshop on Grid Computing
A Divide-and-Conquer Strategy for Thwarting Distributed Denial-of-Service Attacks

IEEE Transactions on Parallel and Distributed Systems
Inferring internet denial-of-service activity

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
A measurement study on overhead distribution of value-added internet services

Computer Networks: The International Journal of Computer and Telecommunications Networking
Tracing back attacks against encrypted protocols

IWCMC '07 Proceedings of the 2007 international conference on Wireless communications and mobile computing
Truth in advertising: lightweight verification of route integrity

Proceedings of the twenty-sixth annual ACM symposium on Principles of distributed computing
ZSBT: a novel algorithm for tracing DoS attackers in MANETs

EURASIP Journal on Wireless Communications and Networking
AID: A global anti-DoS service

Computer Networks: The International Journal of Computer and Telecommunications Networking
On the Design and Performance of an Adaptive, Global Strategy for Detecting and Mitigating Distributed DoS Attacks in GRID and Collaborative Workflow Environments

Simulation
A Comprehensive Framework for Enhancing Security in InfiniBand Architecture

IEEE Transactions on Parallel and Distributed Systems
Robust and efficient detection of DDoS attacks for large-scale internet

Computer Networks: The International Journal of Computer and Telecommunications Networking
AS-based accountability as a cost-effective DDoS defense

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
An autonomous defense against SYN flooding attacks: Detect and throttle attacks at the victim side independently

Journal of Parallel and Distributed Computing
DDoS: design, implementation and analysis of automated model

International Journal of Wireless and Mobile Computing
Scalable traceback against distributed denial of service

International Journal of Web and Grid Services
LIP: a lightweight interlayer protocol for preventing packet injection attacks in mobile ad hoc network

International Journal of Security and Networks
Vulnerabilities in distance-indexed IP traceback schemes

International Journal of Security and Networks
The loop fallacy and deterministic serialisation in tracing intrusion connections through stepping stones

International Journal of Security and Networks
On attack causality in internet-connected cellular networks

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Packet forwarding with source verification

Computer Networks: The International Journal of Computer and Telecommunications Networking
Evaluating the partial deployment of an AS-level IP traceback system

Proceedings of the 2008 ACM symposium on Applied computing
Generic denial of service prevention through a logical fibering algorithm

ISP'06 Proceedings of the 5th WSEAS International Conference on Information Security and Privacy
A general model of probabilistic packet marking for IP traceback

Proceedings of the 2008 ACM symposium on Information, computer and communications security
Adaptive and selective packet marking in communication networks

ICCOM'05 Proceedings of the 9th WSEAS International Conference on Communications
Probabilistic packet marking for large-scale IP traceback

IEEE/ACM Transactions on Networking (TON)
Trajectory sampling with unreliable reporting

IEEE/ACM Transactions on Networking (TON)
Mitigating application-level denial of service attacks on Web servers: A client-transparent approach

ACM Transactions on the Web (TWEB)
CSAMP: a system for network-wide flow monitoring

NSDI'08 Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation
Passport: secure and adoptable source authentication

NSDI'08 Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation
Statistical techniques for detecting traffic anomalies through packet header data

IEEE/ACM Transactions on Networking (TON)
An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

ICCS '07 Proceedings of the 7th international conference on Computational Science, Part IV: ICCS 2007
Dynamic Probabilistic Packet Marking with Partial Non-Preemption

UIC '08 Proceedings of the 5th international conference on Ubiquitous Intelligence and Computing
A First Step towards Live Botmaster Traceback

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
A comprehensive taxonomy of DDOS attacks and defense mechanism applying in a smart classification

WSEAS Transactions on Computers
Exploiting open functionality in SMS-capable cellular networks

Journal of Computer Security
A packet marking with fair probability distribution function for minimizing the convergence time in wireless sensor networks

Computer Communications
Fast autonomous system traceback

Journal of Network and Computer Applications
TVA: a DoS-limiting network architecture

IEEE/ACM Transactions on Networking (TON)
Mitigating attacks on open functionality in SMS-capable cellular networks

IEEE/ACM Transactions on Networking (TON)
A middleware system for protecting against application level denial of service attacks

Proceedings of the ACM/IFIP/USENIX 2006 International Conference on Middleware
Low-overhead message tracking for distributed messaging

Proceedings of the ACM/IFIP/USENIX 2006 International Conference on Middleware
On the state of IP spoofing defense

ACM Transactions on Internet Technology (TOIT)
Targeting spam control on middleboxes: Spam detection based on layer-3 e-mail content classification

Computer Networks: The International Journal of Computer and Telecommunications Networking
A Novel Marking Probability Distribution Using Probability Propagation in Hierarchical WSN

Information Security and Cryptology
A Dynamic Programming Algorithm for the Generalized Minimum Filter Placement Problem on Tree Structures

INFORMS Journal on Computing
An auto-responsive honeypot architecture for dynamic resource allocation and QoS adaptation in DDoS attacked networks

Computer Communications
An innovative approach to identify the IP address in denial-of-service (DoS) attacks based on Cauchy's integral theorem

International Journal of Network Management
De-anonymizing the internet using unreliable IDs

Proceedings of the ACM SIGCOMM 2009 conference on Data communication
SMEs and Cybersecurity Threats in E-Commerce

The EDP Audit, Control, and Security Newsletter
A2M: Access-Assured Mobile Desktop Computing

ISC '09 Proceedings of the 12th International Conference on Information Security
TrueIP: prevention of IP spoofing attacks using identity-based cryptography

Proceedings of the 2nd international conference on Security of information and networks
A dynamic signaling mechanism based on symbiotic packet processing

Computer Communications
Distributed packet pairing for reflector based DDoS attack mitigation

Computer Communications
WebSOS: an overlay-based system for protecting web servers from denial of service attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking - Web security
On cellular botnets: measuring the impact of malicious devices on a cellular network core

Proceedings of the 16th ACM conference on Computer and communications security
IP traceback based on Chinese Remainder Theorem

CIIT '07 The Sixth IASTED International Conference on Communications, Internet, and Information Technology
NetReplay: a new network primitive

ACM SIGMETRICS Performance Evaluation Review
The sisterhood of the traveling packets

NSPW '09 Proceedings of the 2009 workshop on New security paradigms workshop
QuIT: quantitative IP traceback

WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
A master-slave recommended credibility model in mobile P2P based on chord

WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
Cooperative detection and protection against network attacks using decentralized information sharing

Cluster Computing
Cooperative routers against DoS attacks

ACISP'03 Proceedings of the 8th Australasian conference on Information security and privacy
Tagged fragment marking scheme with distance-weighted sampling for a fast IP traceback

APWeb'03 Proceedings of the 5th Asia-Pacific web conference on Web technologies and applications
Unified defense against DDoS attacks

NETWORKING'07 Proceedings of the 6th international IFIP-TC6 conference on Ad Hoc and sensor networks, wireless networks, next generation internet
DDoS mitigation in non-cooperative environments

NETWORKING'08 Proceedings of the 7th international IFIP-TC6 networking conference on AdHoc and sensor networks, wireless networks, next generation internet
Efficient querying and maintenance of network provenance at internet-scale

Proceedings of the 2010 ACM SIGMOD International Conference on Management of data
The Coremelt attack

ESORICS'09 Proceedings of the 14th European conference on Research in computer security
Reconstruction of malicious internet flows

Proceedings of the 6th International Wireless Communications and Mobile Computing Conference
Design and analysis of a hierarchical IP traceback system

ICC'09 Proceedings of the 2009 IEEE international conference on Communications
Passive IP traceback: capturing the origin of anonymous traffic through network telescopes

Proceedings of the ACM SIGCOMM 2010 conference
Pretty good packet authentication

HotDep'08 Proceedings of the Fourth conference on Hot topics in system dependability
Advantages and vulnerabilities of pull-based email-delivery

AISC '10 Proceedings of the Eighth Australasian Conference on Information Security - Volume 105
PinDr0p: using single-ended audio features to determine call provenance

Proceedings of the 17th ACM conference on Computer and communications security
A new form of DOS attack in a cloud and its avoidance mechanism

Proceedings of the 2010 ACM workshop on Cloud computing security workshop
Benchmarks for DDoS defense evaluation

MILCOM'06 Proceedings of the 2006 IEEE conference on Military communications
Honeypot back-propagation for mitigating spoofing distributed denial-of-service attacks

IPDPS'06 Proceedings of the 20th international conference on Parallel and distributed processing
Back to Berferd

Proceedings of the 26th Annual Computer Security Applications Conference
Privacy-preserving network forensics

Communications of the ACM
DHCP origin traceback

ICDCN'11 Proceedings of the 12th international conference on Distributed computing and networking
DTRAB: combating against attacks on encrypted protocols through traffic-feature analysis

IEEE/ACM Transactions on Networking (TON)
DDoS detection and traceback with decision tree and grey relational analysis

International Journal of Ad Hoc and Ubiquitous Computing
An effective defense mechanism against DoS/DDoS attacks in flow-based routers

Proceedings of the 8th International Conference on Advances in Mobile Computing and Multimedia
Enabling flow-level latency measurements across routers in data centers

Hot-ICE'11 Proceedings of the 11th USENIX conference on Hot topics in management of internet, cloud, and enterprise networks and services
Depth-in-defense approach against DDoS

ISP'07 Proceedings of the 6th WSEAS international conference on Information security and privacy
IP trace back techniques to ferret out denial of service attack source

ISP'07 Proceedings of the 6th WSEAS international conference on Information security and privacy
A new and comprehensive taxonomy of DDoS attacks and defense mechanism

ISP'07 Proceedings of the 6th WSEAS international conference on Information security and privacy
IPT framework: a technical & administrative approach for IP packets traceback and identifying cyber criminals

ICCOMP'10 Proceedings of the 14th WSEAS international conference on Computers: part of the 14th WSEAS CSCC multiconference - Volume I
CluB: a cluster based framework for mitigating distributed denial of service attacks

Proceedings of the 2011 ACM Symposium on Applied Computing
Cloud security defence to protect cloud computing against HTTP-DoS and XML-DoS attacks

Journal of Network and Computer Applications
Effective digital forensics research is investigator-centric

HotSec'11 Proceedings of the 6th USENIX conference on Hot topics in security
DMIPS: defensive mechanism against IP spoofing

ACISP'11 Proceedings of the 16th Australasian conference on Information security and privacy
Traceback in wireless sensor networks with packet marking and logging

Frontiers of Computer Science in China
A new active DDoS defense system based on automatic learning

ASIAN'05 Proceedings of the 10th Asian Computing Science conference on Advances in computer science: data management on the web
An interval centroid based spread spectrum watermarking scheme for multi-flow traceback

Journal of Network and Computer Applications
An efficient probabilistic packet marking scheme (NOD-PPM)

ISC'06 Proceedings of the 9th international conference on Information Security
Deterministic packet marking with link signatures for IP traceback

Inscrypt'06 Proceedings of the Second SKLOIS conference on Information Security and Cryptology
A middleware system for protecting against application level denial of service attacks

Middleware'06 Proceedings of the 7th ACM/IFIP/USENIX international conference on Middleware
Low-Overhead message tracking for distributed messaging

Middleware'06 Proceedings of the 7th ACM/IFIP/USENIX international conference on Middleware
Proving optimality of DWS(distance-weighted sampling) probability function for FMS IP trace-back technique

ICDCN'06 Proceedings of the 8th international conference on Distributed Computing and Networking
Toward a framework for forensic analysis of scanning worms

ETRICS'06 Proceedings of the 2006 international conference on Emerging Trends in Information and Communication Security
Improved technique of IP address fragmentation strategies for dos attack traceback

CSR'06 Proceedings of the First international computer science conference on Theory and Applications
IP traceback algorithm for DoS/DDoS attack

APNOMS'06 Proceedings of the 9th Asia-Pacific international conference on Network Operations and Management: management of Convergence Networks and Services
A probe detection model using the analysis of the fuzzy cognitive maps

ICCSA'05 Proceedings of the 2005 international conference on Computational Science and its Applications - Volume Part I
Nonexistence of 2-reptile simplices

JCDCG'04 Proceedings of the 2004 Japanese conference on Discrete and Computational Geometry
Efficient and beneficial defense against DDoS direct attack and reflector attack

ISPA'05 Proceedings of the Third international conference on Parallel and Distributed Processing and Applications
Secure overlay network design

AAIM'06 Proceedings of the Second international conference on Algorithmic Aspects in Information and Management
A novel architecture for detecting and defending against flooding-based DDoS attacks

CIS'05 Proceedings of the 2005 international conference on Computational Intelligence and Security - Volume Part II
Matching connection pairs

PDCAT'04 Proceedings of the 5th international conference on Parallel and Distributed Computing: applications and Technologies
Analysis of the false-positive error rate of tagged fragment marking scheme

Information Processing Letters
Two novel packet marking schemes for IP traceback

ATC'06 Proceedings of the Third international conference on Autonomic and Trusted Computing
Users and services in intelligent networks

AINTEC'05 Proceedings of the First Asian Internet Engineering conference on Technologies for Advanced Heterogeneous Networks
Enable a trustworthy network by source address spoofing prevention routers: a formal description

EUC'06 Proceedings of the 2006 international conference on Emerging Directions in Embedded and Ubiquitous Computing
Efficient technique for fast IP traceback

CDVE'06 Proceedings of the Third international conference on Cooperative Design, Visualization, and Engineering
Indexing information for data forensics

ACNS'05 Proceedings of the Third international conference on Applied Cryptography and Network Security
An adaptive edge marking based hierarchical IP traceback system

ICCNMC'05 Proceedings of the Third international conference on Networking and Mobile Computing
A packet marking scheme for IP traceback

ICN'05 Proceedings of the 4th international conference on Networking - Volume Part II
Intra-domain IP traceback using OSPF

Computer Communications
An intelligent approach of packet marking at edge router for IP traceback

KES'05 Proceedings of the 9th international conference on Knowledge-Based Intelligent Information and Engineering Systems - Volume Part III
Key-exchange protocol using pre-agreed Session-ID

WISA'04 Proceedings of the 5th international conference on Information Security Applications
Tracing attackers with deterministic edge router marking (DERM)

ICDCIT'04 Proceedings of the First international conference on Distributed Computing and Internet Technology
BGP route selection notice

ICOIN'06 Proceedings of the 2006 international conference on Information Networking: advances in Data Communications and Wireless Networks
RCS: a distributed mechanism against link flooding DDoS attacks

ICOIN'06 Proceedings of the 2006 international conference on Information Networking: advances in Data Communications and Wireless Networks
Botnet tracking: exploring a root-cause methodology to prevent distributed denial-of-service attacks

ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security
Interval-based flow watermarking for tracing interactive traffic

Computer Networks: The International Journal of Computer and Telecommunications Networking
A proposal of extension of FMS-Based mechanism to find attack paths

ICCSA'06 Proceedings of the 2006 international conference on Computational Science and Its Applications - Volume Part III
DDoS defense mechanisms: a new taxonomy

DPM'09/SETOP'09 Proceedings of the 4th international workshop, and Second international conference on Data Privacy Management and Autonomous Spontaneous Security
A fast search and advanced marking scheme for network IP traceback model

ICDCIT'05 Proceedings of the Second international conference on Distributed Computing and Internet Technology
LOT: A Defense Against IP Spoofing and Flooding Attacks

ACM Transactions on Information and System Security (TISSEC)
Collaborative scheme for VoIP traceback

Digital Investigation: The International Journal of Digital Forensics & Incident Response
A functional reference model of passive systems for tracing network traffic

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Where is the debugger for my software-defined network?

Proceedings of the first workshop on Hot topics in software defined networks
An incrementally deployable path address scheme

Journal of Parallel and Distributed Computing
Adaptive selective verification: an efficient adaptive countermeasure to thwart DoS attacks

IEEE/ACM Transactions on Networking (TON)
Stepping-stone detection via request-response traffic analysis

ATC'07 Proceedings of the 4th international conference on Autonomic and Trusted Computing
AK-PPM: an authenticated packet attribution scheme for mobile ad hoc networks

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses
Declarative secure distributed information systems

Computer Languages, Systems and Structures
A novel hybrid IP traceback scheme with packet counters

IDCS'12 Proceedings of the 5th international conference on Internet and Distributed Computing Systems
Detection of distributed denial of service attacks using an ensemble of adaptive and hybrid neuro-fuzzy systems

Computer Communications
A Host-Based Intrusion Detection System Using Architectural Features to Improve Sophisticated Denial-of-Service Attack Detections

International Journal of Information Security and Privacy
IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

Cluster Computing
Detecting IP spoofing by modelling history of IP address entry points

AIMS'13 Proceedings of the 7th IFIP WG 6.6 international conference on Autonomous Infrastructure, Management, and Security: emerging management mechanisms for the future internet - Volume 7943
A novel sequential watermark detection model for efficient traceback of secret network attack flows

Journal of Network and Computer Applications
An IP Traceback Protocol using a Compressed Hash Table, a Sinkhole Router and Data Mining based on Network Forensics against Network Attacks

Future Generation Computer Systems
A practical approach for provenance transmission in wireless sensor networks

Ad Hoc Networks
Capability-Based Defenses Against DoS Attacks in Multi-path MANET Communications

Wireless Personal Communications: An International Journal
I know what your packet did last hop: using packet histories to troubleshoot networks

NSDI'14 Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation

Quantified Score

Hi-index	0.02

Visualization

Abstract

This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back towards their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or ``spoofed'', source addresses. In this paper we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed ``post-mortem'' -- after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backwards compatible and can be efficiently implemented using conventional technology.