Singleton Flow Traceback (SFT) Mechanism
Ram Charan Baishya, Dhruba K. Bhattacharyya · 2020
In this paper we propose and analyze a loggingbased IP traceback mechanism, referred to as Singleton Flow Traceback(SFT), that can traceback to the source of a flow containing one or more packets. We consider the tupleas a flow, where S is the Source IP and D is the destination IP of the flow and all packets with the samepair belongs to the same flow. For logging, SFT requires significantly less storage (less than 8% of packet rate) than most of the existing single packet traceback mechanism in the literature. SFT guarantees zero false negative rate, i.e., if there exists a path P = R1, R2....Rkof routers through which the packets of a flowhas traversed, SFT can always reach R1, i.e., the first router to which the source of the flowis connected with. Also, the expected value of false positive rate for a traceback query is very low (<; 0.11).