IP Traceback using Flow Based Classification

Abstract

Distributed Denial of Service (DDoS) attack is a major threat over the internet. The IP traceback mechanism defends against DDoS attacks by tracing the path traversed by attack packets. The existing traceback techniques proposed till now are found with few short comings. The victim required many number of packets to trace the attack path. The requirement of a large number of packets resulted in more number of combinations and more false positives. To overcome this, we have proposed a novel probabilistic packet marking algorithm that finds the IP address of the routers in the attack path through the application of Chinese Remainder theorem. We also applied K-Nearest Neighbor (KNN) algorithm to classify the packets depending on their traffic flow, this reducing the number of packets to reconstruct the attack path. This algorithm enables the victim to construct the attack path very quickly with less combination overhead, thereby reducing the number of false positives and false negatives drastically.