Spitri: Single Packet ICMP Traceback Using Router Interface - Suganya, S; Subramaniam, P (International Journal of Computer Sciences and Engineering, 2018)
Securing the Internet and its services is recognized as one of the most challenging research problems. Amongst the threats imposed on the Internet, Distributed Denial of Service (DDoS) attack has occurred recurrently with a severe impact on the economy of the organization. Regardless of the fact that security experts propose plentiful stupendous solutions to mitigate DDoS attack, it has continued to prevail over a decade. This convolutes the forensic inspection and countermeasures against DDoS offensive. Identifying the origin of the attack is an important and essential step towards deterrence and countermeasures against these attacks. However, they either require huge storage at the routers or require numerous packets to traceback the attack path. Further, most of the marking based traceback schemes are not backward compatible. This proposed system focuses on scrutinize these issues and proposes a feasible solution to identify the origin of Direct Distributed DDoS attack. Backward compatible Single Packet ICMP Traceback scheme using Router Interface (SPITRI) is proposed. It also uses an out-of-band ICMP message to track the attack path. It identifies the origin of an attack packet with a single ICMP message whereas the existing ICMP based traceback scheme requires more number of ICMP packets. Subsequently, SPITRI has undoubtedly reduced the bandwidth overhead provoke by the existing ICMP based traceback scheme. It traces back the attacker with minimal computation overhead and negligible storage at the routers. According to CAIDA dataset, SPITRI tracebacks 13000 attackers with an accuracy of 95.98%.