An efficient probabilistic packet marking scheme for IP traceback

Abstract

Denial of Service (DoS) attacks represent a major threat to the availability of Internet services. Identifying the sources of these attacks is considered an important step toward a DoS-free Internet. In this paper, we propose a new scheme, called Distributed Link-List Traceback, which combines the good features of probabilistic packet marking [6] and Hash-based traceback [9]. The main idea used in the scheme is to preserve the marking information at intermediate routers in such a way that it can be collected in an efficient manner. We evaluate the effectiveness of the proposed scheme for various performance metrics through combination of analytical and simulation studies. Our studies show that the proposed scheme requires small number of packets, adjustable amount of memory. At the same time, offers high attack source detection percentage. © IFIP International Federation for Information Processing 2004.