Tracemax: A Novel Single Packet IP Traceback Strategy for Data-Flow Analysis

A Concise Network-Centric Survey of IP Traceback Schemes based on Probabilistic Packet Marking

Multiple probabilistic packet marking (PPM) schemes for IP traceback have been proposed to deal with Distributed Denial of Service (DDoS) attacks by reconstructing their attack graphs and identifying the attack sources. In this paper, ten PPM-based IP traceback schemes are compared and analyzed in terms of features such as convergence time, performance evaluation, underlying topologies, incremental deployment, re-marking, and upstream graph. Our analysis shows that the considered schemes exhibit a significant discrepancy in performance as well as performance assessment. We concisely demonstrat…

On Algebraic Traceback in Dynamic Networks

This paper introduces the concept of incremental traceback for determining changes in the trace of a network as it evolves with time. A distributed algorithm, based on the methodology of algebraic traceback developed by Dean et al, is proposed which can completely determine a path of d nodes/routers using O(d) marked packets, and subsequently determine the changes in its topology using O(log d) marked packets with high probability. The algorithm is established to be order-wise optimal i.e., no other distributed algorithm can determine changes in the path topology using lesser order of bits (i.…

追踪单个IP数据包以应对DDoS的策略

Strategies for Tracking Individual IP Packets Towards DDoS

本文提出Tracemax，一种结合DDoS防御的高效数据包追踪策略，支持单包多跳追踪，由受害者发起，路由器自组织协作，可分析流量路径并减轻带宽与资源消耗攻击。

IP Traceback for Flooding attacks on Internet Threat Monitors (ITM) Using Honeypots

The Internet Threat Monitoring (ITM) is an efficient monitoring system used globally to measure, detect, characterize and track threats such as denial of service (DoS) and distributed Denial of Service (DDoS) attacks and worms. . To block the monitoring system in the internet the attackers are targeted the ITM system. In this paper we address the flooding attack of DDoS against ITM monitors to exhaust the network resources, such as bandwidth, computing power, or operating system data structures by sending the malicious traffic. We propose an information-theoretic frame work that models the flo…

Tools and techniques for Network Forensics

Network forensics deals with the capture, recording and analysis of network events in order to discover evidential information about the source of security attacks in a court of law. This paper discusses the different tools and techniques available to conduct network forensics. Some of the tools discussed include: eMailTrackerPro to identify the physical location of an email sender; Web Historian to find the duration of each visit and the files uploaded and downloaded from the visited website; packet sniffers like Etherea to capture and analyze the data exchanged among the different computers …