Optimal Path Identification to Defend Against Ddos Attacks

Guang JIN

.

DOI:                 

Abstract

A novel packet marking scheme, optimal path identification (OPi), was proposed to defend against DDoS at­tacks. Instead of using fixed 1 or 2 bit in previous schemes, in OPi a router deduces the traveling distance of an arrived packet by its TTL value and inserts a variable-length marking of 1~16 bit into the packet. The marking field is filled completely even the path is very short and the distinguishability is improved. OPi outperforms previous schemes, espe­cially when attacker paths adjoin user paths seriously. To obtain better performance, an OPi+TTL filtering strategy was proposed to frustrate attackers’ tries with spoofed initial TTL values. Theoretical analyses and simulations with actual Internet topologies show OPi performs excellently.

Keywords

internet security, DDoS attack, packet marking, path identification

Conflicts of Interest

The authors declare no conflicts of interest.

References