The New Jersey Institute of Technology's
Electronic Theses & Dissertations Project

Title:	IP traceback with deterministic packet marking DPM
Author:	Belenky, Andrey
View Online:	njit-etd2003-105 (xiii, 115 pages ~ 5.3 MB pdf)
Department:	Department of Electrical and Computer Engineering
Degree:	Doctor of Philosophy
Program:	Computer Engineering
Document Type:	Dissertation
Advisory Committee:	Ansari, Nirwan (Committee chair) Padmanabhan, Krishnan (Committee member) Rojas-Cessa, Roberto (Committee member) Tekinay, Sirin (Committee member) Zhou, MengChu (Committee member)
Date:	2003-08
Keywords:	Security IP Traceback
Availability:	Unrestricted
Abstract:	In this dissertation, a novel approach to Internet Protocol (IP) Traceback - Deterministic Packet Marking (DPM) is presented. The proposed approach is scalable, simple to implement, and introduces no bandwidth and practically no processing overhead on the network equipment. It is capable of tracing thousands of simultaneous attackers during a Distributed Denial of Service (DDoS) attack. Given sufficient deployment on the Internet, DPM is capable of tracing back to the slaves for DDoS attacks which involve reflectors. Most of the processing is done at the victim. The traceback process can be performed post-mortem, which allows for tracing the attacks that may not have been noticed initially or the attacks which would deny service to the victim, so that traceback is impossible in real time. Deterministic Packet Marking does not introduce the errors for the reassembly errors usually associated with other packet marking schemes. More than 99.99% of fragmented traffic will not be affected by DPM. The involvement of the Internet service providers (ISP) is very limited, and changes to the infrastructure and operation required to deploy DPM are minimal. Deterministic Packet Marking performs the traceback without revealing the internal topology of the provider's network, which is a desirable quality of a traceback scheme.