Real Time IP Traceback with Adaptive Probabilistic Packet Marking
Liang Feng · 2003
Probabilistic packet marking (PPM) is a practical and effective method for IP traceback of denial-of-service(DoS) attack.In this paper,an adaptive PPM algorithm is presented:a router marks a passing packet with a probability which is adaptive to the distance that the packet has traversed,so that a minimum convergence time for an attacking path can be achieved in the victim.With a new IP header overloading scheme,the labeled fragment encoding scheme,a real-time reconstruction is provided,so that thousands of paths can be traced simultaneously.Compared with previous PPM schemes,a 50% decrease in convergence time is achieved,while the computation overhead and false positives in reconstruction are greatly reduced