Tracing Single-Packet Attacks to Their Sources

摘要

The design of the IP protocol makes it difficult to reliably identify the originator of an IP packet, attackers often use incorrect, or spoofed, source IP addresses. In this paper, We propose a new method for IP traceback that collects audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past. We demonstrate that the method is effective. We present both analytic and simulation results showing the method's effectiveness by contrasting with SPIE and Scheme J. We believe that the key contribution of our method is to demonstrate that constructing attack graph is not necessary for tracing.