TRACEBACK OF DDOS ATTACKS USING ENTROPY VARIATIONS

Distributed Denial-of-Service (DDoS) attacks are a critical threat to the Internet which deny normal service and degrade quality of service. However, the Network security mechanisms does not have effective and efficient methods to trace back the source of these attacks. In this paper, I propose a novel traceback method for DDoS attacks that is based on entropy variations between normal and DDoS attack traffic, which is fundamentally different from commonly used packet marking techniques. In comparison to the existing DDoS traceback methods, the proposed strategy possesses a number of advantages—it is memory non intensive, efficiently scalable, robust against packet pollution, and independent of attack traffic patterns. The results are presented to demonstrate the effectiveness and efficiency of the proposed method. My experiment shows that accurate traceback is possible within 20 seconds (approximately) in a large-scale attack network with thousands of zombies and to block them by IP traceback algorithm. The total trace back time is evaluated by monitoring and recording flow information and providing authentication to the new user. Keywords—DDoS, IP traceback, entropy variation, flow. Introduction IT is an extraordinary challenge to traceback the source of Distributed Denial-of-Service (DDoS) attacks in the Internet. In DDoS attacks, attackers generate a huge amount of requests to victims through compromised computers (zombies), with the aim of denying normal service or degrading of the quality of services. It has been a major threat to the Internet since year 2000, and a recent survey on the largest 70 Internet operators in the world demonstrated that DDoS attacks are increasing dramatically, and individual attacks are more strong and sophisticated. Furthermore, the survey [1] also found that the peak of 40 gigabit DDoS attacks nearly doubled in 2008 compared with the previous year. The key reason behind this phenomena is that the network security community does not have effective and efficient traceback methods to locate attackers as it is easy for attackers to disguise themselves by taking advantages of the vulnerabilities of the World Wide Web, such as the dynamic, stateless, and anonymous nature of the Internet[2][3]. IP traceback means the capability of identifying the actual source of any packet sent across the Internet. Because of the vulnerability of the original design of the Internet, we may not be able to find the actual hackers at present. In fact, IP traceback schemes are considered successful if they can identify the zombies from which the DDoS attack packets entered the Internet. Research on DDoS detection [4][5][6], mitigation [8][9], and filtering [10] has been conducted pervasively. However, the efforts on IP traceback are limited. A number of IP traceback approaches have been suggested to identify attackers , and there are two major methods for IP traceback, the probabilistic packetmarking (PPM)[12][13] , and the deterministic packet marking (DPM) [14][15][16]. Both of these strategies require routers to inject marks into individual packets. Moreover, the PPM strategy can only operate in a local range of the Internet (ISP network), where the defender has the authority to manage. However, this kind of ISP networks is generally quite small, and we cannot traceback to the attack sources located out of the ISP network. The DPM strategy requires all the Internet routers [11] to be updated for packet marking. However, with only 25 spare bits available in as IP packet, the scalability of DPM is a huge problem . Moreover, the DPM mechanism poses an extraordinary challenge on storage for packet logging for routers. Therefore, it is infeasible in practice at present. Further, both PPM and DPM are vulnerable to hacking , which is referred to as packet pollution. IP traceback methods should be independent of packet pollution and various attack patterns Entropy rate, the entropy growth rate as the length of a stochastic sequence increases, was employed to find the similarity between normal and attack flows on the entropy growth pattern , and relative entropy, an abstract distance between two probabilistic mass distributions , was taken to measure the instant difference between two flows . In this paper, I propose a novel mechanism for IP traceback using information theoretical parameters, and there is no packet marking in the proposed strategy; therefore, can avoid the inherited shortcomings of the packet marking mechanisms. I categorize packets that are passing through a router into flows, which are defined by the upstream router where a packet came from, and the destination address of the packet. During nonattack periods, routers are required to observe and record entropy variations of local flows. In this paper, I use flow entropy variation or entropy variation interchangeably. Once a DDoS attack has been identified, the victim initiates the following pushback process to identify the locations of zombies: the victim first identifies which of its upstream routers are in the attack tree based on the flow entropy variations it has accumulated, and then submits requests to the related immediate upstream routers. The upstream routers identify where the attack flows came from based on their local entropy variations that they have monitored. Once the immediate upstream routers have identified the attack flows, they will forward the requests to their immediate upstream routers, respectively, to identify