English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Recently, Distributed Denial of Service (DDoS) attacks is the highest priority problems on the network security. To solve this problem, the technique called ”IP traceback” is developed. Fragment Marking Scheme (FMS) is a kind of IP traceback technique. In FMS, the overhead is very low. However, the number of packets for identifying attackers is huge because the downstream routers overwrite the link information marked by upstream routers. In this paper, we propose a method called ”attack detection marking scheme (ADMS)” to solve this problem by monitoring the feature of attack traffic and changing the ”marking probability” of the routers. Our scheme is constructed on the system consisting of the routers on attack paths, a tracer with the network intrusion detection system (NIDS) and the victim. In this system, each router has functions of FMS, attack detection and changing the marking probability. Each router detects on attack by monitoring traffic. We call the router which is detects attack as ”attack detection router” (ADR) and denote ADR which is d hops away from the victim as ADR(d). When a router detects an attack, the router changes marking probability of itself from plow to phigh (0 < plow < phigh ≤ 1). The tracer reconstructs attack path after collects packets at regular time intervals. The tracer requests ADR(d0) to change marking probability to ”0” after the tracer reconstructs the attack path for ADR(d0). After this procedure, the packet marked by R(d0 +1) will not be overwritten by downstream routers. Also, if (d > d0 + 1), the arrival rate of packets marked by R(d) increases before ADR(d) has reconstructed. In this paper, we assume that the procedure of changing the marking probability is implemented based on the simple network management protocol (SNMP) (Fig. 1). We evaluate ADMS and FMS by some simulations and conclude that the proposal scheme is suitable for application to large scale attack compared to FMS (Fig. 2). Fig. 1. Procedure of changing the marking probability in the reconstruction phase

A Proposal of an Extended Method of IP Trace-Back for Distributed Denial of Service Attacks Using Dynamic Marking Scheme