Outline n n n Background TracebackRelated work DPM

Outline n n n Background Traceback(Related work) DPM, PPM, DPPM EAST Performance Conclusion 2

Background n Do. S problem has been divided into three. 1. Prevention 2. Detection 3. Mitigation n Traceback which is under Mitigation. 3

Traceback(Related work) n 1. There are many techniques have been proposed to traceback. Link testing. 4

Traceback(Related work) n 1. 2. There are many techniques have been proposed to traceback. Link testing. ICMP 1/20, 000 5

Traceback(Related work) n 1. 2. 3. 4. There are many techniques have been proposed to traceback. Link testing. Storage ICMP Logging Storage Packet Marking ü ü ü Deterministic Packet Marking(DPM) Probabilistic Packet Marking(PPM) Storage Dynamic Probabilistic Packet Marking(DPPM) 6

Deterministic Packet Marking(DPM) n n DPM marks every packet at the edge router. Use 16 bits IP Header and 1 bit Flag. 7

Probabilistic Packet Marking(PPM) n n n Probability, p=1/25 IP header 16 bits=> 8 bits IP address, 8 bits distance Routers 64 Bits fragmentation to 8 x 8 bits and victim combine. DPM VS PPM 8

Dynamic Probabilistic Packet Marking(DPPM) n n n Probability, p=1/d d is the traveling distance(by packet’s TTL) Packets to reconstruct the path are reduced. DPPM VS PPM 9

TTL drawbacks n n 1. Initial TTL value is system dependent and would be changing based on the used system. 2. Attacker can intentionally inject packets with different TTL to confuse the technique. 10

EFFICIENT AS TRACEBACK (EAST) n n AS(Autonomous System), ASBR, BGP AIM: 1. Solve TTL drawbacks. 2. Reducing the required number of packets in the traceback. (Reduce storage at the victim) 11

EAST n The 25 bits comes from three different fields, namely Type of service (TOS), identification(ID), and reservation flag (RF). 12

EAST Probability, p=1/(a-2) n a is ASs from attacker to the AS of the victim. n performs traceback at the AS level, a can be known in advance. § Solve TTL problem n 32 bits hash to 22 bits 13

EAST algorithm 14

Performance and Analysis 15

Performance and Analysis 16

Conclusion n n Do. S Traceback has many way. EAST maybe is better than PPM, DPPM. 17

REFERENCES n [1] Ping-Hsien Yu, An Application of Proportional Probabilistic Packet Marking Trace in the DDo. S Overlay Defense System, Department of Computer Science & Information Engineering 2011 n [2] 彭士浩, 張晉銘, 卓信宏, 林宜隆, 趙涵捷, "基於機率的封包標記選擇 策略改善IP回溯效能, " 第十六屆臺灣網際網路研討會 (TANET 2011), Ilan, Taiwan, October 24 -26, 2011. 18

n. THANK YOU. 19