Dynamic probabilistic packet marking for efficient IP traceback q.pdfVIP

Computer Networks 51 (2007) 866–882 /locate/comnet Dynamic probabilistic packet marking for efficient IP traceback q Jenshiuh Liu a,*,1, Zhi-Jian Lee a, Yeh-Ching Chung b a Department of Information Engineering and Computer Science, Feng-Chia University, Taichung 407, Taiwan, ROC b Department of Computer Science, National Tsing Hua University, HsingChu 300, Taiwan, ROC Received 23 May 2005; received in revised form 20 December 2005; accepted 28 June 2006 Available online 28 July 2006 Responsible Editor: M. Smirnow Abstract Recently, denial-of-service (DoS) attack has become a pressing problem due to the lack of an efficient method to locate the real attackers and ease of launching an attack with readily available source codes on the Internet. Traceback is a subtle scheme to tackle DoS attacks. Probabilistic packet marking (PPM) is a new way for practical IP traceback. Although PPM enables a victim to pinpoint the attacker’s origin to within 2–5 equally possible sites, it has been shown that PPM suffers from uncertainty under spoofed marking attack. Furthermore, the uncertainty factor can be amplified significantly under distributed DoS attack, which may diminish the effectiveness of PPM. In this work, we present a new approach, called dynamic probabilistic packet marking (DPPM), to further improve the effectiveness of PPM. Instead of using a fixed mark- ing probability, we propose to deduce the traveling distance of a packet and then choose a proper marking probability. DPPM may completely remove uncertainty and enable victims to precisely pi