On Evaluating IP Traceback Schemes: A Practical Perspective

Abstract

This paper presents an evaluation of two promising schemes for tracing cyber-attacks, the well-known Deterministic Packet Marking, DPM, and a novel marking scheme for IP traceback, Deterministic Flow Marking, DFM. First of all we explore the DPM in detail and then by investigating the DFM, we analyze the pros and cons of both approaches in depth in terms of practicality and feasibility, so that shortcomings of each scheme are highlighted. This evaluation is based on CAIDA Internet traces October 2012 dataset. The results show that using DFM may reduce as many as 90% of marked packets on average required for tracing attacks with no false positives, while it eliminates the spoofed marking embedded by the attacker as well as compromised routers in the attack path. Moreover, unlike DPM that traces the attack up to the ingress interface of the edge router close to the attacker, DFM allows the victim to trace the origin of incorrect or spoofed source addresses up to the attacker node, even if the attack has been originated from a network behind a network address translation (NAT), firewall, or a proxy server.

Investigating unique flow marking for tracing back DDoS attacks

“…UFM is developed based on our previous proposal, DFM [1]- [3]. DFM marks every flow, instead of every packet.…”

An enhanced Deterministic Flow Marking technique to efficiently support detection of network spoofing attacks

“…Proposed by Vahid Aghaei-Foroushani et al [12], DFM is an improved scheme of DPM. Like DPM, the marking process of DFM is carried out at edge routers for ingress traffic.…”

“…TABLE I. shows the required numbef of packets K for a successfully-marked flow depending on the usage of the fields in IP header for marking. Marking just only K first packets in each flow, in comparison to DPM, the number of marked packets decreases by as much as nearly 90% [12]. Therefore, the computational overhead of marking at edge routers is also reduced.…”

IP traceback through (authenticated) deterministic flow marking: an empirical evaluation

“…DFM is a deterministic approach, which marks every flow (in contrast with making every packet) and performs on the edge router near the source of traffic. We have shown that using DFM may reduce as many as 90% of marked packets on average required for tracing attacks with no false positives, while it eliminates the spoofed marking embedded by the attacker as well as compromised routers in the attack path in [27].…”

“…So we cannot compare the performance of the PPM directly with the DPM and DFM under the same conditions on the same network. Thus, we only compared the performance of DFM and DPM under the same conditions and on the same network platform [27]. Figure 7 is a schematic illustration of both DPM and DFM approaches, and is a comparison between two methods.…”