Date of Award

Summer 2003

Document Type

Dissertation

Degree Name

Doctor of Philosophy in Computer Engineering - (Ph.D.)

Department

Electrical and Computer Engineering

First Advisor

Nirwan Ansari

Second Advisor

Krishnan Padmanabhan

Third Advisor

Roberto Rojas-Cessa

Fourth Advisor

Sirin Tekinay

Fifth Advisor

MengChu Zhou

Abstract

In this dissertation, a novel approach to Internet Protocol (IP) Traceback - Deterministic Packet Marking (DPM) is presented. The proposed approach is scalable, simple to implement, and introduces no bandwidth and practically no processing overhead on the network equipment. It is capable of tracing thousands of simultaneous attackers during a Distributed Denial of Service (DDoS) attack. Given sufficient deployment on the Internet, DPM is capable of tracing back to the slaves for DDoS attacks which involve reflectors. Most of the processing is done at the victim. The traceback process can be performed post-mortem, which allows for tracing the attacks that may not have been noticed initially or the attacks which would deny service to the victim, so that traceback is impossible in real time. Deterministic Packet Marking does not introduce the errors for the reassembly errors usually associated with other packet marking schemes. More than 99.99% of fragmented traffic will not be affected by DPM. The involvement of the Internet service providers (ISP) is very limited, and changes to the infrastructure and operation required to deploy DPM are minimal. Deterministic Packet Marking performs the traceback without revealing the internal topology of the provider's network, which is a desirable quality of a traceback scheme.

Share

COinS