Singleton Flow Traceback (SFT) Mechanism

In this paper we propose and analyze a loggingbased IP traceback mechanism, referred to as Singleton Flow Traceback(SFT), that can traceback to the source of a flow containing one or more packets. We consider the tuple < S, D > as a flow, where S is the Source IP and D is the destination IP of the flow and all packets with the same < S, D > pair belongs to the same flow. For logging, SFT requires significantly less storage (less than 8% of packet rate) than most of the existing single packet traceback mechanism in the literature. SFT guarantees zero false negative rate, i.e., if there exists a path P = R1, R2….Rk of routers through which the packets of a flow < S, D > has traversed, SFT can always reach R1, i.e., the first router to which the source of the flow < S, D > is connected with. Also, the expected value of false positive rate for a traceback query is very low (< 0.11).