Skip to Main Content
 

Global Search Box

 
 
 
 

Files

File List


akron1164051699.pdf (521.13 KB)

ETD Abstract Container

Abstract Header

PERFORMANCE EVALUATION OF A TTL-BASED DYNAMIC MARKING SCHEME IN IP TRACEBACK

Devasundaram, Shanmuga Sundaram
http://rave.ohiolink.edu/etdc/view?acc_num=akron1164051699

Abstract Details

2006, Master of Science, University of Akron, Computer Science.
Providing networks with countermeasures against Denial of Service (DoS) attacks has become a pressing security issue in the Internet today. Network services get disrupted or become totally unavailable as malicious attackers flood a victim network with large amount of useless traffic. For accountability purpose and to thwart those attacks, it is essential to identify the source of these attacks, which is usually concealed using faked or spoofed IP addresses, and is known as the IP Traceback problem. Packet marking is a traceback approach that calls for routers to mark packets along the attack path with self-identifying information. In Probabilistic Packet Marking (PPM) routers probabilistically decide whether or not to mark packets. A victim node relies on the amount of marked packet samples received to reconstruct the attack path. However, a fixed marking probability set for all routers in PPM has proved to be ineffective as marked packets from distant routers are more likely to be remarked by downstream routers. This entails a loss of information and leads to increase in the volume of packets needed to reconstruct the attack path. Enabling each router to adjust its marking probability so as to obtain equal samples of marked packets, in particular from the furthest routers would help in minimizing the time taken to reconstruct the attack path. Dynamic schemes have been proposed for adjusting the marking probability, which can be derived by accurately estimating a router’s position in the attack path. However, most schemes are highly dependent on the underlying protocols and require routers to have knowledge of distance information to the potential victim node. This adversely increases the router overhead and is time consuming for real-time packet marking scenarios. In this work we propose an algorithm that dynamically set the value of the marking probability based on the 8-bit Time-To-Live (TTL) field in the IP header, which is a value that can be directly accessed by routers without external support. Our proposed scheme utilizes the variable TTL value as an estimate of the distance traveled by a packet and thereby its position in the attack path to derive the marking probability value. Our algorithm was simulated with a number of test cases using a user-friendly simulator that was developed to that effect. Results in terms of false positives, reconstruction time and number of packets needed for reconstruction have shown the efficacy of our dynamic scheme, which offers significantly higher precision with fewer overheads both at the router and at the victim in reconstructing the attack path. The main advantages of the proposed scheme reside both in its simplicity and low router overhead while offering comparable results with other dynamic schemes and outperforming static schemes at large attack distances. Future work includes fine-tuning the derivation of the dynamic marking probability to further improve performance at larger attack distances and a study of its applicability and performance in IPv6 networks.
Xuan-Hien Dang (Advisor)
38 p.
Computer Science
IP traceback; distributed denial-of-service attacks; DDoS; DoS; dynamic packetmarking; traceback

Recommended Citations

Citations

  • Devasundaram, S. S. (2006). PERFORMANCE EVALUATION OF A TTL-BASED DYNAMIC MARKING SCHEME IN IP TRACEBACK [Master's thesis, University of Akron]. OhioLINK Electronic Theses and Dissertations Center. http://rave.ohiolink.edu/etdc/view?acc_num=akron1164051699

    APA Style (7th edition)

  • Devasundaram, Shanmuga Sundaram. PERFORMANCE EVALUATION OF A TTL-BASED DYNAMIC MARKING SCHEME IN IP TRACEBACK. 2006. University of Akron, Master's thesis. OhioLINK Electronic Theses and Dissertations Center, http://rave.ohiolink.edu/etdc/view?acc_num=akron1164051699.

    MLA Style (8th edition)

  • Devasundaram, Shanmuga Sundaram. "PERFORMANCE EVALUATION OF A TTL-BASED DYNAMIC MARKING SCHEME IN IP TRACEBACK." Master's thesis, University of Akron, 2006. http://rave.ohiolink.edu/etdc/view?acc_num=akron1164051699

    Chicago Manual of Style (17th edition)

akron1164051699
1,343
© 2006, all rights reserved.
This open access ETD is published by University of Akron and OhioLINK.