IP traceback using digital watermark and honeypot

Abstract

Nowadays, The widespread networks are intensively threatened by Internet attack. It's highly urgent to traceback the attack origination, neutralize the attack and punish the malicious attackers. There are many IP traceback methods, but none of the existing solutions can fulfill all the effective traceback requirements. This paper proposed a novel IP traceback scheme. In this scheme, an elaborate digital watermark is put into a honeypot, and the probe-scan-entrap the attacks through the honeypot, which sequentially induces the attacks to visit the digital watermark. Thus in the overlay network, the trail of the digital watermark will reconstruct the attack route so that the hacker's address can be located. It is very difficult to carry out single packet traceback in traditional methods and their measures heavily depend on the router capability, the network administrators' and co-operation between ISPs. Our proposal has solved such problems and it can against attacks through proxy or slave hosts. © 2008 Springer-Verlag Berlin Heidelberg.