IP Traceback Problem: How do we determine where malicious packet came from ? It’s a problem because attacker can spoof source IP address If we know where packet comes from: May be able to determine attacker May be able to determine bot participating in a DDoS attack Another approach: get rid of spoofed packets with ingress filtering (see “Attack” slides) Introduction

Methods for finding source Manual methods using current IP routing Link testing Logging Marking algorithms Routers mark packets Introduction

Link testing Victim recognizes attack signature Common feature in all attack packets, eg, same source IP address Victim informs network operator Operator installs filter on upstream router Router “input debugging” feature determines responsible ingress link, leading to an upstream router Apply procedure again, until get to border of ISP Result: router at border filters out malicious traffic before reaching target Cons To go beyond an ISP, ISPs need to coordinate Considerable management overhead Introduction

Logging: Forensics Key routers log packets Use data mining to find path Pros Post mortem – works after attack stops Cons High resource demand: need to store and process tons of data Introduction

Marking Algorithms Overview mark packets with router addresses deterministically or probabilistically trace attack using marked packets strengths independent of ISP management little network overhead, traffic trace distributed attacks, attacks post-mortem drawback: need to get routers to mark IP packets Introduction

Marking: Assumptions Assumptions Most routers remain uncompromised Attacker sends many packets Route from attacker to victim remains relatively stable A1 A2 A3 A4 A5 R6 R7 R8 R9 R10 R12 V Introduction

Marking Algorithms marking procedure path reconstruction procedure by routers add information to packet path reconstruction procedure by victim use information in marked packets convergence time # of packets to reconstruct the attack path Introduction

Node Append original packet router list append address of each router to the end of the packet complete, ordered list of routers in attack path Problem: Requires space in packet Path can be long No extra fields in current IP format: Changes to packet format are not practical original packet router list Introduction

Node Sampling (1) reserve a field in packet header for marking router writes its address in packet with prob p R1 R1 R2 R3 Introduction

Node Sampling (2) R1 R1 R2 R3 reserve node field in packet header router writes its address in node field with probability p R1 R1 R2 R3 Introduction

Node Sampling (3) R3 R1 R2 R3 reserve node field in packet header router writes its address in node field with probability p R3 R1 R2 R3 Introduction

Node Sampling (4) Router: additional write, checksum update Victim receives many attack packets, many with marking Victim attempts to reconstruct path from unordered samples. Observe the router IPs in the marking field Probability that received packet has been marked by router d hops away: p(1-p)d-1 Rank each router IP by the number of marks it has received; router with most marks is likely the closest router Introduction

Node sampling (5) Problems Large number of packets are needed to get markings from upstream routers Multiple attack sources Introduction

Edge Sampling store edges instead of router Arriving packet contains start and end addresses distance from edge to victim Arriving packet contains Address of last marked edge Number of hops edge is from destination Choose edge for marking with prob p If chosen, set counter to 0 Otherwise, increment counter Introduction

Edge Sampling: picture Packet received R1 receives packet from source or another router Packet contains space for start, end, distance packet s e d R1 R2 R3 Introduction

Edge Sampling: picture Begin writing edge R1 chooses to write start of edge Sets distance to 0 packet R1 R1 R2 R3 Introduction

Edge Sampling Finish writing edge R2 chooses not to overwrite edge Distance is 0 Write end of edge, increment distance to 1 packet R1 R2 1 R1 R2 R3 Introduction

Edge Sampling Increment distance R3 chooses not to overwrite edge Increment distance to 2 packet R1 R2 2 R1 R2 R3 Introduction

Path reconstruction Extract identifiers from attack packets Build graph rooted at victim Each (start,end,distance) tuple is an edge Traverse edges from root to find attack paths # packets needed to reconstruct path E(X) < where p is marking probability, d is length of path p = 1/d optimal ln(d) p(1-p)d-1 Introduction

Experimental convergence time Introduction

Summary of marking Can determine attack path with a relatively small number of attack packets Need to include addresses, counter in IP datagram Suggestion: compress to 16 bits, include in fragmentation fields (see paper) See “Practical Network Support for IP Traceback” by Savage et al. Introduction