An Enhanced Hybrid Scheme for IP Traceback

Abstract

Internet has become a highly influential medium in recent years and this has led to the arrival of threats like DDoS attacks. DDoS attacks are in rising spree, as attackers are very well resourced. IP spoofing makes the situation further worse by concealing the attacker's identity. The IP Traceback mechanism is effective in identifying the origin of the attack. This paper outlines a hybrid traceback technique with packet marking followed by logging. The proposed scheme utilizes a minimized marking field of 16 bits in an IP header compared to existing techniques. The maximum storage requirement will be around 384 KB (based on CAIDA dataset) for logging on all routers. The path reconstruction has zero false positive and false negative rates. Therefore, the proposed scheme eliminates the packet fragmentation problem by reducing the number of digits for marking with a negligible increase in the storage.