A More Practical Approach for Novel Hybrid Schemes of Packet Marking and Logging for IP Traceback

Computer network attacks are on the increase and are more sophisticated in today’s network environment than ever before. Tracing DoS attacks that employ source address spoofing is an important and challenging problem. Traditional traceback schemes provide spoofed packets traceback capability either by augmenting the packets with partial path information (i.e., packet marking), or by storing packet digests or signatures at intermediate routers (i.e., packet logging). Such approaches require either a large number of attack packets to be collected by the victim to infer the paths (packet marking), or a significant amount of resources to be reserved at intermediate routers (packet logging). We adopt a hybrid traceback approach in which packet marking and packet logging are integrated in a novel manner, so as to achieve the best of both worlds, that is, to achieve small number of attack packets to conduct the traceback process and small amount of resources to be allocated at intermediate routers for packet logging purposes. Based on this notion, two novel traceback schemes are presented. The first scheme, called Distributed Link-List Traceback (DLLT), is based on the idea of preserving the marking information at intermediate routers in such a way that it can be collected using a link list based approach. The second scheme, called Probabilistic Pipelined Packet Marking (PPPM), employs the concept of a “pipeline” for propagating marking information from one marking router to another so that it eventually reaches the destination. We evaluate the effectiveness of the proposed schemes against various performance metrics through a combination of analytical and simulation studies. I.Introduction Denial-of-service (DoS) attacks have been threatening the utility of the Internet severely [1]. In 2002, a coordinated attack on the Internet name service infrastructure showed the possibility and potential impact of such dedicated attacks [2]. More recently, it was reported that DoS attacks have been used as a means of extortion and become the subject of lawsuits [3]. Defending against DoS attacks requires not only measures for mitigating the effects of the attacks but also mechanisms for identifying the entities accountable for such attacks. Denial of Service (DoS) attacks [11], [12] and a more complicated version known as Distributed DoS (DDoS) are the most common to take advantage of source address spoofing. These attacks deny regular Internet services from being accessed by legitimate users either by blocking service completely or by disturbing it such that users become not interested in the service anymore (for example causing significant delay in accessing an airline reservation web site). In such attacks, the main objective is to overpower the victim while concealing attacker’s identity. Today’s Internet has witnessed several incidents that confirm the devastating effect of such attacks. For example, in October 2002, eight out of the thirteen root DNS servers were brought down as a result of severe flooding denial of service attack [11]. IP traceback is the the process of identifying the actual source(s) of attack packets. This has the benefit of holding attackers accountable for abusing the Internet1. Also, it helps in mitigating DoS attacks either by isolating the identified attack sources, or by filtering attack packets far away from the victim as proposed in the IP tracebackbased intelligent packet filtering technique [20]. IP traceback is a challenging problem Phani --International Journal of Computer Science information and Engg. , Technologies ISSN 2277-4408 || 01092013-036 IJCSIET-ISSUE3-VOLUME3-SERIES1 Page 2 because of the distributed anonymous nature of DDoS attacks, the stateless nature of the Internet, the destination oriented IP routing, and the fact of having millions of hosts connected to the Internet (implying huge search space). All these factors help attackers to stay behind the scenes and hence complicate the process of traceback. Generally, traceback schemes provide spoofed packets traceback capability either by augmenting the packets with partial path information (i.e., packet marking), or by storing packet digests or signatures at intermediate routers (i.e., packet logging). Such approaches require either a large number of attack packets to be collected by the victim to infer the paths (packet marking), or a significant amount of resources to be reserved at intermediate routers (packet logging). This paper adopts a hybrid traceback approach in which packet marking and packet logging are integrated to achieve the best of both worlds (i.e., small number of attack packets to conduct the traceback process, and small amount of resources to be allocated at intermediate routers for packet logging purposes). Based on this notion, two traceback schemes are presented. The first scheme is based on a novel concept called Distributed link-list (DLL), which refers to the process of keeping track of a subset of routers that were involved in forwarding certain packet by establishing a temporary link between them in a distributed manner. We utilize this concept and develop a novel traceback scheme, called Distributed Link List Traceback (DLLT), that combines the desirable features of PPM [15] and Hash-based traceback [19] schemes. The second scheme, called Probabilistic Pipelined Packet Marking (PPPM), is based on the concept of pipelining. PPPM aims at propagating the IP addresses of the routers that were involved in marking certain packet by loading them into packets going to the same destination. Therefore, preserving these addresses while avoiding the need for long term storage at intermediate routers. II. RELATED WORK We refer to a router with high speed links as a high-speed router. We also term a packet of interest an attack packet. Similarly, the source and destination of an attack packet is an attacker and a victim, respectively. The sequence of routers traversed by an attack packet on its way from source to destination make up an attack path. The attack path from the attacker to the victim is represented as an ordered list of routers (R1;R2.Rm). The objective of IP traceback is to figure out this ordered list of routers. The process of constructing attack paths is called traceback process. Based on the vulnerability that is exploited, DoS attacks can be classified into flooding attacks and software exploits [4]. Flooding attacks (e.g., smurf, SYN flood) work by flooding victims with large amounts of traffic. Flooding attacks consume some limited resource (e.g., link bandwidth or computing resource) at victims to prevent legitimate users from accessing that resource. Software exploits (e.g., teardrop, ping-ofdeath) work by sending victims a single or a few malformed packets to abuse some feature or implementation bug of operating systems or applications to disable the service. In our view, this is equivalent to identifying the end point of a link list starting at the victim, where each element in the list represents an intermediate router along the path from victim to attacker as can be seen in Fig. 1. Multiple attackers case corresponds to a tree of link lists rooted at the victim ( ), where each leaf represents a link list end point. Fig1. An Instance of the Trace-back The main assumptions made in our work are similar to those made in [15], [17] and [6], with an exception that we do not necessarily assume that each attack source has to send numerous packets. The imminent threats imposed by DoS attacks call for efficient and fast traceback schemes Phani --International Journal of Computer Science information and Engg. , Technologies ISSN 2277-4408 || 01092013-036 IJCSIET-ISSUE3-VOLUME3-SERIES1 Page 3 that enjoy the following features: 1) Providing accurate information about routers near the attack source rather than those near the victim. 2) Recognition and exclusion of false information injected by the attacker. 3) Avoiding the use of large amount of attack packets to construct the attack path or attack tree. 4) Low processing and storage overhead at intermediate routers. 5) Efficient collection of marking information stored at intermediate routers (if any). Previous schemes failed to satisfy the above features collectively. For example, in PPM [15], routers that are far away from the victim have very low chance to pass their marking information to the victim because intermediate routers overwrite this information, which leads to the loss of valuable marking information written by routers near the attacker(s). This is contradictory to our goal of having more knowledge about these routers. PPM requires considerable amount of packets to be collected at the victim before conducting the traceback process Waiting for a large number of attack packets to be collected at the victim will significantly increase the response time of countering an attack. This argument may not be valid when a small value for the marking probability is used in PPM. However, such marking probability introduces a serious vulnerability in PPM that was pointed out in [14], where the attacker has the ability to pass spoofed marking information to mislead the victim. The major drawback of Hash-based traceback [19] is that it incurs a heavy burden on routers by requiring them to log information about every forwarded packet. Moreover, the method employed to collect packet information from network routers is inefficient and requires special resources; the scheme assumes that a central management unit is available in each domain to download and search all packet digests looking for specific packet footprints. This results in a tedious process and an unnecessary overhead. The deterministic storage algorithm increases the memory requirement of the scheme. Moreover, a major concern in Hash-based traceback is the small window of time through which packets can be successfully traced. Generally, routers write their IP addresses in the forwarded