A taxonomy of internet traceback

International Journal of Security and Networks

Volumn 1, Issue 1-2, 2006, Pages 54-61

  Hamadeh, Ihab ^a   Kesidis, George ^a  

^a The Pennsylvania State University   (United States)

Author keywords

attack attribution; DDoS; forensics; IP traceback; stepping stone; worms

Indexed keywords

EID: 70449498446     PISSN: 17478405     EISSN: 17478413     Source Type: Journal    
DOI: 10.1504/ijsn.2006.010823     Document Type: Article

References (47)

1. Adler, M. (2002) ‘Tradeoffs in probabilistic packet marking for IP traceback’, Proceedings of the 34th ACM Symposium on Theory of Computing (STOC), May.
2. Belenky, A. and Ansari, N. (2003) ‘IP traceback with deterministic packet marking’, IEEE Communication Letters, Vol. 41, No.7, pp.162–164.
3. Bellovin, S.M. (2000) ‘ICMP traceback messages’, IETF Internet Draft: Draft-Dellovin-Itrace-00.txt, March.
4. Bloom, B.H. (1970) ‘Space/time trade-offs in hash coding with allowable errors’, Communications of ACM, Vol. 13, No. 7, pp.422–426.
5. Burch, H. and Cheswick, B. (2000) ‘Tracing anonymous packets to their approximate source’, Proceedings of the USENIX LISA, December.
6. CAIDA: Cooperative Association for Internet Data Analysis, UCSD Network Telescope (1997) Available at: http://www.caida.org/analysis/security/telescope/.
7. Chang, H.Y., Narayan, R., Wu, S.F., Vetter, B.M., Wang, X., Brown, M., Yuill, J.J., Sargor, C., Jou, F. and Gong, F. (1999) ‘DeIdUouS: decentralized source identification for network-based intrusions’, Proceedings of the Sixth IFIP/IEEE International Symposium on Integrated Network Management, May.
8. Cisco Systems, Inc. (2004) ‘IP source tracker’, Available at: http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s21/ipst.pdf.
9. Choi, K.H. and Dai, H.K. (2004) ‘A marking scheme using Huffman codes for IP traceback’, Proceedings of the Seventh International Symposium on Parallel Architectures, Algorithms and Networks (ISPAN), May, pp.421–428.
10. Dean, D., Franklin, M. and Stubblefield, A. (2002) ‘An algebraic approach to IP traceback’, Proceedings of the Network and Distributed System Security (NDSS), Vol. 5, pp.119–137.
11. Goodrich, M. (2001) ‘Efficient packet marking for large-scale IP traceback’, Proceedings of the Ninth ACM Conference on Computer and Communications Security (ACM CCS), November, pp.117–126.
12. Greene, B.R., Morrow, L.C. and Gemberling, B.W. (2001) ‘ISP security – real world techniques’, NANOG23 Meeting, Available at: http://www.nanog.org/mtg-0110/greene.html, October.
13. Hamadeh, I. and Kesidis, G. (2003a) ‘Performance of IP address fragmentation strategies for DDoS traceback’, Proceedings of the IEEE Workshop on IP Operations and Management (IPOM), October.
14. Hamadeh, I. and Kesidis, G. (2003b) ‘Implementing border router packet marking in today’s internet’, Technical Report: CSE-03-014, August.
15. Hamadeh, I. and Kesidis, G. (2003c) ‘Packet marking for traceback of illegal content distribution’, International Conference on Cross-Media Service Delivery (CMSD), May.
16. Hamadeh, I. and Kesidis, G. (2006) ‘Toward a framework for forensic analysis of scanning worms’, Proceedings International Conference on Emerging Trends in Information and Communication Security (ETRICS), June.
17. Ioannidis, J. and Bellovin, S.M. (2002) ‘Implementing pushback: router-based defense against DDoS attacks’, Proceedings of the IEEE Symposium on Network and Distributed Systems Security (NDSS), February.
18. ‘IMS: University of Michigan Internet Motion Sensor’, (2004) Available at: http://ims.eecs.umich.edu/index.htm.
19. Jung, H.T., Kim, H.L., Seo, Y.M., Choe, G., Min, S.L., Kim, C.S. and Koh, K. (1993) ‘Caller identification system in the internet environment’, Proceedings of the Fourth USENIX Security Symposium, October.
20. Kumar, A., Paxson, V. and Weaver, N. (2005) ‘Exploiting underlying structure for detailed reconstruction of an internet-scale event’, Proceedings of the ACM Internet Measurement Conference, October.
21. Lee, T., Wu, W. and Huang, W. (2004) ‘Scalable packet digesting schemes for IP traceback’, Proceedings of the IEEE International Conference on Communications, June.
22. Li, J., Sung, M., Xu, J., Li, L. and Zhao, Q. (2004) ‘Large-scale IP traceback in high-speed internet: practical techniques and theoretical foundation’, Proceedings of the IEEE Symposium on Security and Privacy, May.
23. Mahajan, R., Massey, D., Wu, C., Wu, S., Ioannidis, J., Paxson, V. and Shenker, S. (2002) ‘Controlling high bandwidth aggregates in the network’, Computer Communications Review, July.
24. Mankin, A., Massey, D., Wu, C.L., Wu, S.F. and Zhang, L. (2001) ‘On design and evaluation of intention-driven ICMP traceback’, Internet Draft, IETF: draft-wu-itrace-intention-00.txt, October.
25. Peng, T., Leckie, C. and Ramamohanarao, K. (2002) ‘Adjusted probabilistic packet marking for IP traceback’, Networking 2002, May.
26. Sanchez, L.A., Milliken, W.C., Snoeren, A.C., Tchakountio, F., Jones, C.E., Kent, S.T. and Partridge, C. (2001) ‘Hardware support for a hash-based IP traceback’, Proceedings of the Second DARPA Information Survivability Conference and Exposition (DISCEX II), June.
27. Savage, S., Wetherall, D., Karlin, A. and Anderson, T. (2000) ‘Practical network support for IP traceback’, Proceedings of the ACM SIGCOMM, August, pp.295–306.
28. Schnackenberg, D., Djahandari, K. and Sterne, D. (2000) ‘Infrastructure for intrusion detection and response’, Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX), January.
29. Schnackenberg, D., Holliday, H., Smith, R., Djahandari, K. and Sterne, D. (2001) ‘Cooperative intrusion traceback and response architecture (CITRA)’, Proceedings of the Second DARPA Information Survivability Conference and Exposition (DISCEX II), June.
30. Snapp, S.R., Brentano, J., Dias, G.V., Heberlein, L.T., Ho, C., Levitt, K.N. and Mukherjee, B. (1991) ‘DIDS – motivation, architecture, and an early prototype’, Proceedings of the 14th National Computer Security Conference, pp.167–176.
31. Snoeren, A.C., Partridge, C., Sanchez, L.A., Jones, C.E., Tchakountio, F., Kent, S.T. and Strayer, W.T. (2001) ‘Hash-based IP traceback’, Proceedings of the ACM SIGCOMM, August.
32. Snoeren, A.C., Partridge, C., Sanchez, L.A., Jones, C.E., Tchakountio, F., Kent, S.T. and Strayer, W.T. (2002) ‘Single-packet IP traceback’, IEEE/ACM Transactions on Networking, December.
33. Song, D.X. and Perrig, A. (2001) ‘Advanced and authenticated marking schemes for IP traceback’, Proceedings of the IEEE INFOCOM, April.
34. Staniford-Chen, S. and Heberlein, L.T. (1995) ‘Holding intruders accountable on the internet’, Proceedings of the IEEE Symposium on Security and Privacy, May, pp.39–49.
35. Staniford-Chen, S., Cheung, S., Crawford, R., Dilger, M., Frank, J., Hoagland, J., Levitt, K., Wee, C., Yip, R. and Zerkle, D. (1996) ‘GrIDS – a graph based intrustion detection system for large networks’, Proceedings of the 19th National Information Systems Security Conference, October.
36. Stone, R. (2000) ‘An IP overlay network for tracing DoS floods’, Proceedings of the USENIX Security Symposium, July.
37. ‘WAIL: University of Wisconsin-Madison Advanced Internet Laboratory’ (2001) Available at: http://wail.cs.wisc.edu/.
38. Wang, X., Reeves, D.S., Wu, S.F. and Yuill, J. (2001) ‘Sleepy watermark tracing: an active network-based intrusion response framework’, Proceedings of the International Conference on Information Security, June, pp.369–384.
39. Wang, X., Reeves, D.S. and Wu, S.F. (2002) ‘Inter-packet delay based correlation for tracing encrypted connections through stepping stones’, Proceedings of the Seventh European Symposium on Research in Computer Security (ESORICS), October, pp.244–263.
40. Wang, B. and Schulzrinne, H. (2003) ‘A denial-of-service-resistant IP traceback approach’, Proceedings of the Third New York Metro Area Networking Workshop (NYMAN), September.
41. Wu, C.L., Zhang, L., Massey, D. and Mankin, A. (2001) ‘Intention driven ICMP traceback’, Proceedings of the IEEE International Conference on Computer Communication and Networks (ICCCN), February, pp.159–165.
42. Xie, Y., Sekar, V., Maltz, D., Reiter, M. and Zhang, H. (2005) ‘Worm origin identification using random moonwalks’, Proceedings of the IEEE Symposium on Security and Privacy, May.
43. Yaar, A., Song, D.X. and Perrig, A. (2005) ‘FIT: fast internet traceback’, Proceedings of the IEEE INFOCOM, March.
44. Yoda, K. and Etoh, H. (2000) ‘Finding a connection chain for tracing intruders’, Proceedings of the Sixth European Symposium on Research in Computer Security (ESORICS), October, pp.191–205.
45. Zhang, Y. and Paxson, V. (2000) ‘Detecting stepping stones’, Proceedings of the Ninth USENIX Security Symposium, August, pp.171–184.
46. A border gateway router is an ISP backbone router that is adjacent to one or more backbone routers that could belong to a customer or another ISP.
47. A tracking node is a sophisticated device that could perform routing, analysis and filtering. It can examine datagrams, drop them or forward them to other routers.