Tracing Multiple Attackers with Deterministic Packet Marking (DPM)

Document Type

Conference Proceeding

Publication Date

11-7-2003

Abstract

The rising threat of cyber attacks, especially distributed denial-of-service (DDoS), makes the IP Traceback problem very relevant to today's Internet security. IP Traceback is one of the security problems associated with identifying the source of the attack packets. This work presents a novel approach to IP Traceback - Deterministic Packet Marking (DPM). The proposed approach is scalable, simple to implement, and introduces no bandwidth and practically no processing overhead on the network equipment. It is capable of tracing thousands of simultaneous attackers during DDoS attack. All of the processing is done at the victim. The traceback process can be performed post-mortem, which allows for tracing the attacks that may not have been noticed initially. The involvement of the Internet service providers (ISP) is very limited, and changes to the infrastructure and operation required to deploy DPM are minimal. DPM performs the traceback without revealing the internal topology of the provider's network, which is a desirable quality of a traceback scheme.

Identifier

0142199483 (Scopus)

Publication Title

IEEE Pacific RIM Conference on Communications Computers and Signal Processing Proceedings

First Page

49

Last Page

52

Volume

I

This document is currently not available here.

Share

COinS