Document Type
Dissertation
Date of Award
Summer 8-31-2003
Degree Name
Doctor of Philosophy in Computer Engineering - (Ph.D.)
Department
Electrical and Computer Engineering
First Advisor
Nirwan Ansari
Second Advisor
Krishnan Padmanabhan
Third Advisor
Roberto Rojas-Cessa
Fourth Advisor
Sirin Tekinay
Fifth Advisor
MengChu Zhou
Abstract
In this dissertation, a novel approach to Internet Protocol (IP) Traceback - Deterministic Packet Marking (DPM) is presented. The proposed approach is scalable, simple to implement, and introduces no bandwidth and practically no processing overhead on the network equipment. It is capable of tracing thousands of simultaneous attackers during a Distributed Denial of Service (DDoS) attack. Given sufficient deployment on the Internet, DPM is capable of tracing back to the slaves for DDoS attacks which involve reflectors. Most of the processing is done at the victim. The traceback process can be performed post-mortem, which allows for tracing the attacks that may not have been noticed initially or the attacks which would deny service to the victim, so that traceback is impossible in real time. Deterministic Packet Marking does not introduce the errors for the reassembly errors usually associated with other packet marking schemes. More than 99.99% of fragmented traffic will not be affected by DPM. The involvement of the Internet service providers (ISP) is very limited, and changes to the infrastructure and operation required to deploy DPM are minimal. Deterministic Packet Marking performs the traceback without revealing the internal topology of the provider's network, which is a desirable quality of a traceback scheme.
Recommended Citation
Belenky, Andrey, "IP traceback with deterministic packet marking DPM" (2003). Dissertations. 586.
https://digitalcommons.njit.edu/dissertations/586
