Dynamic probabilistic packet marking for efficient IP traceback


Recently, denial-of-service (DoS) attack has become a pressing problem due to the lack of an efficient method to locate the real attackers and ease of launching an attack with readily available source codes on the Internet. Traceback is a subtle scheme to tackle DoS attacks. Probabilistic packet marking (PPM) is a new way for practical IP traceback. Although PPM enables a victim to pinpoint the attacker’s origin to within 2–5 equally possible sites, it has been shown that PPM suffers from uncertainty under spoofed marking attack. Furthermore, the uncertainty factor can be amplified significantly under distributed DoS attack, which may diminish the effectiveness of PPM. In this work, we present a new approach, called dynamic probabilistic packet marking (DPPM), to further improve the effectiveness of PPM. Instead of using a fixed marking probability, we propose to deduce the traveling distance of a packet and then choose a proper marking probability. DPPM may completely remove uncertainty and enable victims to precisely pinpoint the attacking origin even under spoofed marking DoS attacks. DPPM supports incremental deployment. Formal analysis indicates that DPPM outperforms PPM in most aspects. 2006 Elsevier B.V. All rights reserved.

DOI: 10.1016/j.comnet.2006.06.009

Extracted Key Phrases

16 Figures and Tables

Citations per Year

134 Citations

Semantic Scholar estimates that this publication has 134 citations based on the available data.

See our FAQ for additional information.

Cite this paper

@article{Liu2007DynamicPP, title={Dynamic probabilistic packet marking for efficient IP traceback}, author={Jen-Shiuh Liu and Zhi-Jian Lee and Yeh-Ching Chung}, journal={Computer Networks}, year={2007}, volume={51}, pages={866-882} }