A Concise Network-Centric Survey of IP Traceback Schemes based on Probabilistic Packet Marking <s> Definition 3 (Marked packet distribution) <s> This paper describes a technique for tracing anonymous packet flooding attacks in the Internet back toward their source. This work is motivated by the increased frequency and sophistication of denial-of-service attacks and by the difficulty in tracing packets with incorrect, or “spoofed,” source addresses. In this paper, we describe a general purpose traceback mechanism based on probabilistic packet marking in the network. Our approach allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs). Moreover, this traceback can be performed “post mortem”—after an attack has completed. We present an implementation of this technology that is incrementally deployable, (mostly) backward compatible, and can be efficiently implemented using conventional technology. <s> BIB001 </s> A Concise Network-Centric Survey of IP Traceback Schemes based on Probabilistic Packet Marking <s> Definition 3 (Marked packet distribution) <s> Defending against distributed denial-of-service attacks is one of the hardest security problems on the Internet today. One difficulty to thwart these attacks is to trace the source of the attacks because they often use incorrect, or spoofed IP source addresses to disguise the true origin. In this paper, we present two new schemes, the advanced marking scheme and the authenticated marking scheme, which allow the victim to trace-back the approximate origin of spoofed IP packets. Our techniques feature low network and router overhead, and support incremental deployment. In contrast to previous work, our techniques have significantly higher precision (lower false positive rate) and fewer computation overhead for the victim to reconstruct the attack paths under large scale distributed denial-of-service attacks. Furthermore the authenticated marking scheme provides efficient authentication of routers' markings such that even a compromised router cannot forge or tamper markings from other uncompromised routers. <s> BIB002 </s> A Concise Network-Centric Survey of IP Traceback Schemes based on Probabilistic Packet Marking <s> Definition 3 (Marked packet distribution) <s> Traceback mechanisms are a critical part of the defense against IP spoofing and DoS attacks, as well as being of forensic value to law enforcement. Currently proposed IP traceback mechanisms are inadequate to address the traceback problem for the following reasons: they require DDoS victims to gather thousands of packets to reconstruct a single attack path; they do not scale to large scale distributed DoS attacks; and they do not support incremental deployment. We propose fast Internet traceback (FIT), a new packet marking approach that significantly improves IP traceback in several dimensions: (1) victims can identify attack paths with high probability after receiving only tens of packets, a reduction of 1-3 orders of magnitude compared to previous packet marking schemes; (2) FIT performs well even in the presence of legacy routers, allowing every FIT-enabled router in path to be identified; and (3) FIT scales to large distributed attacks with thousands of attackers. Compared with previous packet marking schemes, FIT represents a step forward in performance and deployability. <s> BIB003 </s> A Concise Network-Centric Survey of IP Traceback Schemes based on Probabilistic Packet Marking <s> Definition 3 (Marked packet distribution) <s> Distributed denial of service attacks continue to pose major threats to the Internet. In order to traceback attack sources (i.e., IP addresses), a well studied approach is probabilistic packet marking (PPM), where each intermediate router of a packet marks it with a certain probability, enabling a victim host to traceback the attack source. In a recent study, we showed how attackers can take advantage of probabilistic nature of packet markings in existing PPM schemes to create spoofed marks, hence compromising traceback. In this paper, we propose a new PPM scheme called TTL-based PPM (TPM) scheme, where each packet is marked with a probability inversely proportional to the distance traversed by the packet so far. Thus, packets that have to traverse longer distances are marked with higher probability, compared to those that have to traverse shorter distances. This ensures that a packet is marked with much higher probability by intermediate routers than by traditional mechanisms, hence reducing the effectiveness of spoofed packets reaching victims. Using formal analysis and simulations using real Internet topology maps, we show how our TPM scheme can effectively trace DDoS attackers even in presence of spoofing when compared to existing schemes. <s> BIB004
. The marked packet distribution P i is described as the marked packets received by the victim from the i th attacker A i given i ∈ [1, n] where n is the number of attackers. We define P i = f (p, d, M ) as it depends on the marking probability p, the marking scheme M , and attack path length d. An alternative measure of the performance of a traceback scheme is the correctness of the attack graph G ret that the reconstruction procedure returns when compared to the actual attack graph G act . This is especially important in marking schemes where the router IP address is broken into fragments because of space constraints in the packet header as in BIB001 , BIB002 , BIB003 , BIB004 . In these works, a fragment of the router's IP address, instead of the entire address, is transmitted in the packet header, which requires an extra function of combining the fragments during the reconstruction procedure. This introduces the possibility of incorrect recombination where fragments from routers in G act are combined to identify an innocent router in G ′ act , whereby G ′ refers to the complement of G, as being part of G ret . Ideally, the returned attack graph should be identical to the actual attack graph, i.e. G ret = G act .