PROJECT TITLE :

A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking

ABSTRACT:

DDoS attack source traceback is an open and challenging drawback. Deterministic packet marking (DPM) could be a simple and effective traceback mechanism, but the present DPM based mostly traceback schemes aren't sensible thanks to their scalability constraint. We tend to noticed a issue that solely a restricted variety of computers and routers are concerned in an attack session. Thus, we tend to only want to mark these concerned nodes for traceback purpose, instead of marking every node of the Net as the prevailing schemes doing. Based mostly on this finding, we propose a unique marking on demand (MOD) traceback theme based mostly on the DPM mechanism. So as to traceback to involved attack supply, what we have a tendency to want to do is to mark these involved ingress routers using the ancient DPM strategy. The image of existing schemes, we have a tendency to need participated routers to put in a traffic monitor. When a monitor notices a surge of suspicious network flows, it can request a distinctive mark from a globally shared MOD server, and mark the suspicious flows with the distinctive marks. At the identical time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim will get the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we have a tendency to use the marking house during a spherical-robin style, that essentially addresses the scalability downside of the existing DPM based traceback schemes. We tend to establish a mathematical model for the proposed traceback theme, and totally analyze the system. Theoretical analysis and extensive real-world knowledge experiments demonstrate that the proposed traceback methodology is feasible and effective.