# RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks
###### Abstract  
In the recent past, Distributed Denial of Service (DDoS) attacks have become more abundant and present one of the most serious security threats. In a DDoS attack, the attacker controls a _botnet_ of _daemons_ residing in vulnerable hosts that send a significant amount of traffic to flood the victim or the network infrastructure. In this paper, a common type of DDoS attacks known as \"TCP SYN-Flood\" is studied. This type of attack uses spoofed Internet Protocol (IP) addresses for SYN packets by exploiting the weakness in Transmission Control Protocol (TCP) 3-Way handshake used by the TCP/IP suite of protocols, which make the web servers unreachable for legitimate users or even worse, it might lead to server crash. In this paper, a resilient, efficient, lightweight, and robust IP traceback algorithm is proposed using an IP tracing packet for each attack path. The proposed algorithm suggests that edge routers--where the attack starts from--observe the traffic pattern passing through, and if the observed traffic carries the signature of TCP SYN-Flood DDoS attack and a high percentage of it is destined to a particular web server(s), it starts the tracing process by generating an IP trace packet, which accompanies the attack path recording the routers' IP addresses on the path between the attacker/daemon and the victim, which can extract the path and react properly upon receiving it by discarding any SYN packets originating from that attacker/daemon. To our knowledge, this is the first research that efficiently traces these kinds of attacks while they are running. The proposed solution has low computation and message overhead, efficient detection and tracing time, and converges in near optimal time. The results are validated using extensive simulation runs.  
DDoS mitigation; SYN-flood attack; IP traceback; cybersecurity +
Footnote †: journal:  
attacks [4]. Attackers have developed tools to coordinate distributed attacks from several separate locations. Unfortunately, the mechanisms for dealing with DoS/DDoS attacks are perhaps one of the least researched topics in network security. There are many reasons why there are no fundamental solutions to DoS/DDoS attacks due to the nature of the TCP/IP protocol suite that is not resilient to such attacks because, when TCP/IP was designed, security threats were not taken into consideration. Confidentiality and integrity were well-researched, and strong encryption protocols and algorithms have been found to provide robust defense against attacks on confidentiality and integrity. On the other hand, availability has received less research because security threats to availability began to emerge in the mid-1990s and its danger, complexity and negative effects intensified in the early 2000s attacks, which led to the disruption of huge servers and websites [5]. The contribution in this paper is a two-fold algorithm for tracing SYN-Flood attacks: the first is deployed on edge routers at the daemons' side, while the second is deployed on the core routers. The algorithm is characterized to be resilient, lightweight, and robust using IP traceback packets. The algorithm detects the potential of an attack based on recorded statistical information at the edge routers. When the SYN traffic surges towards a particular destination, the edge router compares the traffic surge with historical access patterns, and a decision will be taken to initiate the IP traceback packet that accompanies the generated attack traffic. This IP traceback packet will be used to record the IP addresses of the routers between the source and the victim. The efficiency and feasibility of the algorithm are validated using extensive simulation experiments and compare the performance of the proposed algorithm with the related algorithm. The obtained results show that the proposed algorithm is robust, effective, efficient, and reacts rapidly against DDoS attacks.