IP Traceback技术综述

拒绝服务攻击（DoS）和分布式拒绝服务攻击（DDoS）一直是网络上使用频率最高的攻击方式。为了能够找到网络攻击的发起源以便对攻击发起人进行法律和经济上的惩罚，也为了威慑那些试图进行网络攻击的人以减少攻击发起的数量，人们开始研究IP traceback技术。本文系统地介绍了各种IP traceback技术的研究成果，对其在性能和效率上做了纵向和横向的比较，并对该技术的发展趋势做了简单的分析。

Discovering Attack Path Oriented-IP Traceback

The technique of IP traceback may effectively block DOS (Denial Of Service) and meet the requirement of the computer forensic, but its accuracy depends upon that condition that each node in the Internet must support IP packet marking or detected agents. So far, this requirement is not satisfied. On the basis of traditional traceroute,this paper investigates the efficiency of discovering path methods from aspects of the size and order of detecting packets, and the length of paths.It points out that the size of padding in probed packets has a slight effect on discovering latency, and the latency with the method of bulk sending receiving is much smaller than one with the traditional traceroute. Moreover, the loss rate of packets with the technique of TTL (Time To Live) which increases monotonously is less than that with the technique of TTL which decreases monotonously. Lastly,OS (Operating System) passive fingerprint is used as heuristic to predict the length of the discovered path so as to reduce disturbance in network traffic.

A Coding-Based Incremental Traceback Scheme against DDoS Attacks in MANET

Due to constrained resources, DDoS attack is one of the biggest threats to MANET. IP traceback technique is useful to defend against such type of attacks, since it can identify the attack sources. Several types of traceback schemes have been proposed for wired networks. Among all the existing schemes, probabilistic packet marking (PPM) scheme might be the most promising scheme for MANET. However its performance in MANET is not as good as that in Internet. In this paper, a new scheme based on the codingtechnique (CT) is proposed for traceback in MANET. Furthermore, a new idea of Incremental traceback is raised to cope with the situation of incremental attack (ICT). We present the protocol design and conduct theoretical analysis of this scheme. Additionally, we conduct experiments to compare it with the traditional PPM scheme. The experimental results show that the new coding-based traceback scheme outperforms the PPM scheme in MANET.

A Defense Framework against DDoS in a Multipath Network Environment

The Internet is facing a major threat, consisting of a disruption to services caused by distributed denial-of-service (DDoS) attacks. This kind of attacks continues to evolve over the past two decades and they are well known to significantly affect?companies and businesses. DDoS is a popular choice among attackers community. Such attack can easily exhaust the computing and communication resources of its victim within a short period of time. Many approaches to countering DDoS attacks have been proposed, but few have addressed the use of multipath. In this paper, we analyze, how multipath routing based solutions could be used to address the DDoS problem. The proposed framework traces back the attack to its source and blocks it. It also calculates multiple paths to the attacker (if they exist) and alerts all gateways near the attacker to block possible traffic originating from this source in case another path(s) is (are) later used to attack the victim again. We demonstrate that our scheme performs better that other single path schemes.

基于入侵检测系统的IP traceback机制研究

本文结合"入侵检测系统(IDS)",当IDS检测到可疑封包时,即发送命令要求边界路由器对所经过的封包执行签名,而在受害者端IDS可透过验证封包上的签名,找到攻击封包的来源地址。

Building an IPv6 address generation and traceback system with NIDTGA in Address Driven Network

In the design and construction process of Next Generation Internet, it is important to identify the source of each IP packet forwarding accurately, especially for the support of precise fine-grained management,control, traceability and improving the trustworthiness of the Internet. This paper designed a scalable Network Identity(NID) scheme for the Internet users, proposed NIDTGA(Network Identity and Time Generated Address), an IPv6 address generation algorithm embedded NID and time information, then designed and implemented an IPv6 address generation and traceback system based on NIDTGA. The design of NIDTGA, which reflects the length, time and owner attributes of the IP address, can be a good support to ADN(Address Driven Network). At the same time, by embedding the key elements of user identity and time in the IPv6 address,and by taking into account both the traceability and privacy, NIDTGA can provide a technical basis for the establishment of the network trust mechanism, and achieve the traceability of security event.

Traceback in wireless sensor networks with packet marking and logging

In a hostile environment, sensor nodes may be compromised and then be used to launch various attacks. One severe attack is false data injection which is becoming a serious threat to wireless sensor networks. An attacker uses the compromised node to flood the network and exhaust network resources by injecting a large number of bogus packets. In this paper, we study how to locate the attack node using a framework of packet marking and packet logging. We propose a combined packet marking and logging scheme for traceback （CPMLT）. In CPMLT, one packet can be marked by up to M nodes, each node marks a packet with certain probability. When one packet is marked by M nodes, the next marking node will log this packet. Through combining packet marking and logging, we can reconstruct the entire attack path to locate the attack node by collecting enough packets. In our simulation, CPMLT achieves fast traceback with little logging overhead.

Topology-assisted deterministic packet marking for IP traceback

A novel deterministic packet marking （DPM） for IP traceback against denial of service （DOS） and distributed denial of service （DDoS） attacks is presented, which features good scalability and high accuracy. In this scheme, an ingress router pre-calculates a Hash of its IP address and splits the Hash into several fragments. When marking a packet, the router randomly selects a fragment to mark into the packet. In the traceback stage the victim identifies the marked router with the help of the map of its upstream routers. Based on the map, the victim can identify a candidate ingress router after receiving only several marked packets. The scheme overcomes defects in previous deterministic packet marking schemes, where too much packets are required to recover a router and high false positive rate occurs in case of large-scale DDoS. Theoretical analysis, the pseudo code and experimental results are provided. The scheme is proved to be accurate and efficient and can handle large-scale DDoS attacks.

Packet track and traceback mechanism against denial of service attacks

The denial of service attack is a main type of threat on the Internet today. On the basis of path identification （Pi） and Internet control message protocol （ICMP） traceback （iTrace） methods, a packet track and traceback mechanism is proposed, which features rapid response and high accuracy. In this scheme, routers apply packet marking scheme and send traceback messages, which enables the victim to design the path tree in peace time. During attack times the victim can trace attackers back within the path tree and perform rapid packet filtering using the marking in each packet. Traceback messages overcome Pi＇s limitation, wherein too much path information is lost in path identifiers; whereas path identifiers can be used to expedite the design of the path-tree, which reduces the high overhead in iTrace. Therefore, our scheme not only synthesizes the advantages but also compromises the disadvantages of the above two methods. Simulation results with NS-2 show the validity of our scheme.

A Dynamic Probabilistic Marking Approach with Multi-Tag for Tracing ICMP-Based DoS Attacks

This paper presents a dynamic probabilistic marking algorithm with multiple routing address tags, which allows the vic- tim to traceback the origin of ICMP （Internet Control Message Pro- tocol）-based direct and reflective DoS attacks. The proposed ap- proach makes full use of scalable data space of ICMP packet to achieve multiple information tags. The difference between this pro- posal and previous proposals lies in two points. First, the number of packets needed by the victim to reconstruct the attack path is greatly reduced because of three key mechanisms： multi-tag, uniform left- over probability, and tag location choice based on the module of accommodated tag numbers within a packet. Second, the true origin of both direct and reflective ICMP-based DoS attacks can be traced.