An IP traceback protocol using a compressed hash table, a sinkhole router and data mining based on network forensics against network attacks

Future Generation Computer Systems

Volumn 33, Issue , 2014, Pages 42-52

  Jeong, Eunhee ^a   Lee, Byungkwan ^b  

^a Kangwon National University   (South Korea)

^b Catholic Kwandong University   (South Korea)

Author keywords

Association rule; Attack packet rule; Attack pattern; Compressed Hash Table; Hash table; IP Traceback Protocol; Sinkhole router

Indexed keywords

APRIORI ALGORITHMS; ATTACK PACKETS; ATTACK PATTERNS; HASH TABLE; IP TRACEBACK; MEMORY EFFICIENCY; NETWORK FORENSICS; SOURCE PATH ISOLATION ENGINE;

ASSOCIATION RULES; DATA MINING; DATA STRUCTURES; ROUTERS;

COMPUTER CRIME;

EID: 84893008558     PISSN: 0167739X     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.future.2013.10.023     Document Type: Article

References (44)

1. A.C. Snoeren, C. Partridge, L.A. Sanchez, C.E. Jones, F. Tchakountio, B. Schwartz, S.T. Kent, and W.T. Strayer Single-packet IP traceback IEEE/ACM Transactions on Networking 10 6 2002 721 734
2. A. John, and T. Sivakumar DDoS: survey of traceback methods International Journal of Recent Trends in Engineering 1 2 2009 241 245
3. U.K. Tupakula, V. Varadharajan, Analysis of traceback techniques, in: Proceeding ACSW Frontiers'06 Proceedings of the 2006 Australasian Workshops on Grid Computing and e-Research, January 16-19, Hobart, Australasia, 2006.
4. N. Meghanathan, S.R. Allam, and L.A. Moore Tools and techniques for network forensics International Journal of Network Security & its Applications (IJNSA) 1 1 2009 14 25
5. T. Kai, A. Hashiguchi, H. Nakatani, Proposal for and evaluation of improved method of hash-based IP traceback system, in: CSA'09, 2nd International Conference, 10-12 December 2009, pp. 1-7.
6. W.T. Strayer, and C.E. Jones SPIE-IPv6: single IPv6 packet traceback http://www.ir.bbn.com/documents/articles/spielcn04.pdf
7. H. Hazeyama, M. Oe, and Y. Kadobayshi A layer-2 extension to hash-based IP traceback IEICE Transactions on Information and Systems E86-D 11 2003 1 9
8. H. Burch, B. Cheswick, Tracing anonymous packets to their approximate source, in: Proceedings of Usenix LISA'00, December 3-8, New Orleans, Louisiana, USA, 2000.
9. S. Savage, D. Wetherall, A. Karlin, T. Anderson, Practical network support for IP traceback, in: Proceedings of ACM SIGCOMM 2000, August 2000, pp. 295-306.
10. M. Adler, Tradeoffs in probabilistic packet marking for IP traceback, in: STOC'02, Montreal, Quebec, Canada, May 19-21, 2002, pp. 407-418. (Pubitemid 35009401)
11. C. Gong, and K. Sarac A more practical approach for single-packet IP traceback using packet logging and marking IEEE Transactions on Parallel and Distributed Systems 19 10 2008 1310 1324
12. B.H. Bloom Space/time trade-offs in Hash coding with allowable errors Communications of the ACM 13 7 1970 422 426
13. J.K. Mullin Optimal semi-joins for distributed database systems IEEE Transactions on Software Engineering 16 5 1990 558 560
14. J. Kubiatowicz, D. Bindel, Y. Chen, S. Czerwinski, P. Eaton, and D. Geels OceanStore: an architecture for global-scale persistent storage ACM SIGPLAN Notices 35 11 2000 190 201 (Pubitemid 32470898)
15. J. Li, J. Taylor, L. Serban, M. Seltzer, Self-organization in peer-to-peer systems, in: Proc. the 10th ACM SIGOPS European Workshop, Saint-Emilion, France, September 2002, pp. 125-132.
16. F.M. Cuena-Acuna, C. Peery, R.P. Martin, T.D. Nguyen, Plantp: using gossiping to build content addressable peer-to-peer information sharing communities, in: Proc. the 12th IEEE International Symposium on High Performance Distributed Computing, Seattle, WA, USA, June 2003, pp. 236-249.
17. S.C. Rhea, J. Kubiatowicz, Probabilistic location and routing, in: Proc. IEEE INFOCOM, New York, NY, United States, June 2004, pp. 1248-1257.
18. T.D. Hodes, S.E. Czerwinski, and B.Y. Zhao An architecture for secure wide-area service discovery Wireless Networks 8 2-3 2002 213 230 (Pubitemid 34168128)
19. P. Reynolds, A. Vahdat, Efficient peer-to-peer keyword searching, in: Proc. ACM International Middleware Conference, Rio de Janeiro, Brazil, June 2003, pp. 21-40.
20. D. Bauer, P. Hurley, R. Pletka, M. Waldvogel, Bringing efficient advanced queries to distributed hash tables, in: Proc. IEEE Conference on Local Computer Networks, Tampa, FL, United States, November 2004, pp. 6-14. (Pubitemid 40845188)
21. L. Fan, P. Cao, J. Almeida, and A. Broder Summary Cache: a scalable wide-area web cache sharing protocol IEEE/ACM Transactions on Networking 8 3 2000 281 293
22. C. Jin, W. Qian, and A. Zhou Analysis and management of streaming data: a survey Journal of Software 15 8 2004 1172 1181
23. C.D. Peter, M. Panagiotis, Bloom filters in probabilistic verification, in: Proc. the 5th International Conference on Formal Methods in Computer-Aided Design, Austin, Texas, USA, November 2004, pp. 367-381.
24. M. Mitzenmacher Compressed bloom filters IEEE/ACM Transactions on Networking 10 5 2002 604 612 (Pubitemid 35312139)
25. A. Kirsch, M. Mitzenmacher, Distance-sensitive bloom filters, January 2006. http://www.eecs.harvard.edu/michaelm/postscripts/lsbf.ps.
26. A. Kirsch, M. Mitzenmacher, Building a better bloom filter, January 2006. http://www.eecs.harvard.edu/michaelm/postscripts/tr-02-05.pdf.
27. A. Kumar, J. Xu, J. Wang, O. Spatschek, L. Li, Space-code bloom filter for efficient per-flow traffic measurement, in: Proc. IEEE INFOCOM, Hongkong, China, March 2004, pp. 1762-1773.
28. S. Cohen, Y. Matias, Spectral bloom filters, in: Proc. ACM International Conference on Management of Data, SIGMOD, San Diego, CA, United States, June 2003, pp. 241-252.
29. A. Broder, and M. Mitzenmacher Network applications of bloom filters: a survey Internet Mathematics 1 4 2005 485 509
30. E.H. Jeong, B.K. Lee, I.N. Jung, A forensic based IITN(Improved IP traceback against network attacks) Protocol, IST, in: Proceedings International Conference, IST2012, Shanghai, China, 2012, pp. 361-364.
31. M. Hegland, The Apriori algorithm - a tutorial, March 30, 2005. http://www2.ims.nus.edu.sg/preprints/2005-29.pdf.
32. R. Agrawal, R. Srikant, Fast algorithms for mining association rules, in: Proceedings of the 20th VLDB Conference, Santiago, Chile, 1994. http://rakesh.agrawal-family.com/papers/vldb94apriori.pdf.
33. J.S. Park, M.S. Chen, and P.S. Yu Using a Hash-based method with transaction trimming for mining association rules The IEEE Transactions on Knowledge and Data Engineering 9 5 1997 813 825 (Pubitemid 127773161)
34. R. Srikant, and R. Agrawal Mining generalized association rule Future Generation Computer Systems 13 2-3 1997 161 180
35. Y. Liu, Study on application of apriori algorithm in data mining, in: Computer Modeling and Simulation, ICCMS'10, January 22-24, 2010, pp. 111-114.
36. D.M.D. Angeline, and I.S.P. James Association rule generation using apriori Mend algorithm for student's placement International Journal of Emerging Sciences 2 1 2012 78 86
37. A. Said, Introduction to arithmetic coding - theory and practice, Imaging Systems Laboratory, HP Laboratories Palo Alto HPL-2004-76, April 21, 2004.
38. A. Shahbahrami, R. Bahrampour, M.S. Rostami, and M.A. Mobarhan Evaluation of Huffman and arithmetic algorithms for multimedia compression standards International Journal of Computer Science, Engineering and Applications (IJCSEA) 1 4 2011 34 47
39. DARPA Intrusion Detection Data Set, http://www.ll.mit.edu/mission/ communications/ist/corpora/ideval/data/index.html.
40. T. Huirong, R. Brackney, H.Y. Youm, Draft text of Rec. X.tb-ucr: traceback use cases and capabilities, TD4158, ITU-T SG17, 2008.
41. H.B. Yim, Probabilistic route selection algorithm to trace DDoS Attack Traffic Source, Hanyang University, Korea, 2011.
42. S. Savage, D. Wetherall, A. Karlin, and T. Anderson Practical network support for IP traceback ACM SIGCOMM Computer Communication Review 30 4 2000 295 306
43. Network Simulator (ns-2). http://www.isi.edu/nsnam/ns.
44. Henry C.J. Lee, Vrizlynn L.L. Thing, Y. Xu, M. Ma, ICMP traceback with cumulative path, an efficient solution for IP trace back, https://users.cs.jmu. edu/aboutams/Public/IP%20TraceBack/ICMP%20Traceback%20with%20Cumulative%20Path. pdf.