Fast and secure probabilistic marking technology for IP traceback
Wei Zhang · Journal of Tsinghua University(Science and Technology) · 2011
Probabilistic packet marking(PPM),TTL-based packet marking(TPM) and dynamic probabilistic packet marking(DPPM),regarded as representatives of conventional probabilistic marking technologies for IP traceback,cannot fast reconstruct attack paths and efficiently defend against dummy marks.The adaptive probabilistic marking scheme(APMS) was developed in which the TTL value of each packet is set to a uniform number in the first-hop router with each router deducing the distance that each receiving packet has already traveled,and then adaptively marking the packet with the probability inversely proportional to the distance.In APMS,the victim requires the fewest packets for a successful traceback in average,with the effect of dummy marks being completely eliminated.NS2 experiments show that the time for the victim to collect all the obligatory marks for the path reconstruction is reduced by more than 20% using APMS,compared with using conventional schemes,with forged marks failing to reach the victim without affecting the attack path reconstruction process.