Research on a Common Scheme for Large Scale DDoS Attack Source Traceback
OU Xin-liang · Journal of Chinese Computer Systems · 2007
This paper presents a common marking scheme for large scale DDoS attack source traceback based on PPM. Compared to other schemes, this scheme can be applied to direct and reflected DDoS attack source traceback by using Reflection Relay Algorithm. Furthermore, this scheme encodes the router's IP using techniques from algebraic coding theory, encodes and authenticates the edge information with HMAC method whose secret key is updated periodically, and can decode the information and reconstruct the attack paths effectively, even without the ISP's router map. Through an analysis, this scheme is robust and compatible with IPv4 protocol. In our emulation result, our scheme had a better performance in astringency and false positive test than FMS and CHEN's scheme.