2nd International ICST Conference on Communications and Networking in China

Research Article

Across-Domain Deterministic Packet Marking for IP Traceback

Cite
BibTeX Plain Text
  • @INPROCEEDINGS{10.1109/CHINACOM.2007.4469407,
    author={Guang Jin and Jiangang Yang and Wei Wei and Yabo Dong},
    title={Across-Domain Deterministic Packet Marking for IP Traceback},
    proceedings={2nd International ICST Conference on Communications and Networking in China},
    publisher={IEEE},
    proceedings_a={CHINACOM},
    year={2008},
    month={3},
    keywords={Deterministic packet marking  DoS  IP traceback  Internet security},
    doi={10.1109/CHINACOM.2007.4469407}
}
  • Guang Jin
    Jiangang Yang
    Wei Wei
    Yabo Dong
    Year: 2008
    Across-Domain Deterministic Packet Marking for IP Traceback
    CHINACOM
    IEEE
    DOI: 10.1109/CHINACOM.2007.4469407
Guang Jin1,2,*, Jiangang Yang1,*, Wei Wei1,*, Yabo Dong1,*
  • 1: College of Computer Science and Technology, Zhejiang University, Hangzhou, China, 310027
  • 2: College of Information Science and Engineering, Ningbo University, Ningbo, China, 315211
*Contact email: d05jinguang@zju.edu.cn, yangjg@zju.edu.cn, wewei_tc@zju.edu.cn, dongyb@zju.edu.cn

Abstract

Among IP traceback techniques, deterministic packet marking (DPM) can locate the ingress border routers of destination domains with sound effectiveness and robustness. Yet DPM is inefficient to trace to attack origins of remote domains. A novel mechanism, across-domain deterministic packet marking (ADDPM), for IP traceback is proposed. It uses the 30-bit space in IP header reserved for fragmented traffic. Three deterministic markings are recorded into a packet at both the ingress router of source domain and the border router of destination domain respectively. Besides the both routers’ IP addresses, the source AS number is also marked. The victim can trace to the remote attack origin by the markings. Deterministic markings can also be used to differentiate malicious packets. Theoretical analyses, deployment policies and simulation results are provided in detail and show the effectiveness of ADDPM.

Keywords
Deterministic packet marking DoS IP traceback Internet security
Published
2008-03-07
Publisher
IEEE
Modified
2011-07-14
http://dx.doi.org/10.1109/CHINACOM.2007.4469407
Copyright © 2007–2024 IEEE