IP traceback through (authenticated) deterministic flow marking: an empirical evaluation

Abstract

In this paper, we present a novel approach to IP traceback -deterministic flow marking (DFM). We evaluate this novel approach against two well-known IP traceback schemes. These are the probabilistic packet marking (PPM) and the deterministic packet marking (DPM) techniques. In order to do so, we analyzed these techniques in detail in terms of their performances and feasibilities on five Internet traces. These traces consist of Darpa 1999 traffic traces, CAIDA October 2012 traffic traces, MAWI December 2012 traffic traces, and Dal2010 traffic traces. We have employed 16 performance metrics to evaluate their performances. The empirical results show that the novel DFM technique can reduce the number of marked packets by 91% compared to the DPM, while achieving the same or better performance in terms of its ability to trace back the attack. Additionally, DFM provides an optional authentication so that a compromised router cannot forge markings of other uncompromised routers. Unlike PPM and DPM that trace the attack up to the ingress interface of the edge router close to the attacker, DFM allows the victim to trace the origin of incorrect or spoofed source addresses up to the attacker node, even if the attack has been originated from a network behind a network address translation (NAT) server. Our results show that DFM can reach up to approximately 99% traceback rate with no false positives.

Design and performance analysis of an efficient single flow IP traceback technique in the AS level

“…In the packet marking level, a packet is marked regardless of its relation with other packets in traffic. However, in the flow‐marking level, a limited number of packets are marked, which their 5 tuples are the same, ie, source and destination IP address, source and destination port number, and type protocol layer 4. In the flow‐marking level, the limited marked packets are representative of all packets in the flow.…”

“…Moreover, in terms of sending traceback data to a victim's system, the marking techniques are classified into two categories. These two groups are in‐band, in which the traceback data are marked in the header of the packet or a packet's header of flow and out‐of‐band, in which for a specific number of packets that are passed through the router (for example, 20 000 packets), a new packet is generated (Internet Control Message Protocol [ICMP]) and the traceback data are stored in the generated packet and sent to the destination.…”

Investigating unique flow marking for tracing back DDoS attacks

“…UFM is developed based on our previous proposal, DFM [1]- [3]. DFM marks every flow, instead of every packet.…”

“…Based on the work in [1] [2], the best value of K is either 2, so that the size of each fragment is 32 bits, or 5, so that the size of each fragment is 16 bits. Moreover, based on several previous studies on the IP traceback [10], it is possible to use the identification and the flag fields of the IP header as a 16-bit marking field, or to use the identification, the flag and the fragment offset fields of the IP header as a 32-bit marking field.…”

“…In this paper, we propose a new approach to IP traceback called Unique Flow Marking (UFM) to improve upon our previous work Deterministic Flow Marking (DFM) [1]- [4]. Unlike DFM that marks every flow by embedding the source identity data to the first packets of each flow, UFM marks only the unique flows of the network traffic.…”