Branch label based probabilistic packet marking for IP traceback

Abstract

AbstructDistributed Denial-of-Services (DDoS) attacks have been one of the most serious security issues. DDoS attacks disable legitimate services on victim hosts by flooding packet flows to the hosts from a lot of different compromised hosts. I t i s considered the most effective mitigation to f i l ter the attacking packet flows at the router interfaces closest to the attackers. Precise identilieation of these interfaces i s a key poinL Edge Sample (ES) based Probabilistic Packet Marking (PPM) is an encouraging method to cope with source 1p spoofing, a popular identifieation jamming, which usually accompany DDoS attacks. But its fragmentation of path information leads to inefficiency in terms of necessarv number of oackets. oath calculation h e and _ _ identilicatinn accuracy. We Drowse BranchLahe1 (BL) based PPM to solve the above . . inefficiency pruhlem. I n HI., a single path infurmatinn is marked in a packet without fragmentation in conIra4 tn ES h a d P P M 'The "hole palh inrurmativn in packets hy the HL appruarh i s expressed nilh branch information uf each muler interfaces. This hrin&? the folluuing three he) advantages in the pnrew of detecting the interfaces: quick increaw in (rue-pmilives detected (efficiencyl, quick dcCred.w in false-negatives detrrted (accuracy) and fast convergence (quicknc\s).