IP trace back can be used to find the origins and paths of attacking traffic. However, so far, no Internet-level IP trace back system has ever been deployed because of deployment difficulties. In this paper, we present a flow-based trace back scheme on an AS-level overlay network (Easy Trace). In Easy Trace, it is not necessary to deploy any dedicated trace back software and hardware at routers, and an AS-level overlay network is built for incremental deployment. We theoretically analyze the quantitative relation among the probability that a flow is successfully traced back various AS-level hop number, independently sampling probability, and the packet number that the attacking flow comprises.
展开▼
