Coloring networks for attacker identification and response

Abstract

Network-based attacks such as denial-of-service attacks are usually performed by spoofing the source IP address. Packet marking techniques are used to trace such attackers as close as possible to their source. A packet mark consists of some traceback information pertaining to a router being embedded in the IP packet header. In this work, we use the concept of star coloring to assign reusable colors (marks) to routers but at the same time limits false positives and false negatives. The proposed scheme minimizes the bit space required for marking in the IP header. We introduce the concept of path identifier, to identify an attack path. The path identifiers are used to provide an elegant solution to collect attack packets in the midst of a distributed denial-of-service attack and then traceback. Although identifying the attacker is crucial to institute protection measures against future attacks, it cannot mitigate the effects of an ongoing attack. We establish the use of path identifiers, to filter packets during an ongoing attack. We present a validation of the proposed techniques in an emulated environment using real attack traffic.Coloring networks for attacker identification and response Figure 7. Construction of path identifier. Security Comm. Networks 2015; 8:751-768

International Journal of Electronics and Telecommunications

“…In [57], the authors reduced the traffic load of high capacity cellular networks, by mapping the problem of caching popular files to a graph which is divided into four new subgraphs serving as the foundation of graph coloring in the presented method. In [58], the authors presented a scheme to trackback DoS attacks based on packet marking. The trackback involves color balanced star coloring to assign color to routers.…”

Increasing the effectiveness of packet marking schemes using wrap-around counting Bloom filter

“…IP traceback brings the attackers under the ambit of law and deters them from launching further attacks. The latest variants of DoS attack like low‐rate DoS (LRDoS) attack and highly distributed DoS attack require very few packets for launching a DoS attack .…”