A New Intruder Traceback Mechanism based on System Process Structure

摘要

In this paper, we describe a defense mechanism to be able to handle detoured attacks in high-speed networks. We aimed at developing a mechanism that can trace an origin system which attacks a victim system via stepping stones. There are two kinds of traceback technologies: IP packet traceback and connection traceback. We focused on connection traceback in this paper and proposed a new host-based traceback Mechanism to distinguish between origin system of attack and stepping stones using process structures of operating systems.