TRACK: A Novel Approach for Defending Against Distributed Denial-of-Service Attacks

摘要: This paper presents a novel countermeasure against Distributed Denial-of-Service (DDoS) attacks that we call the rouTer poRt mArking and paCKet filtering (TRACK), which includes functions of both IP traceback packet filtering. TRACK is comprehensive solution composed two components: router port marking module module. The former scheme for latter utilizes information gathered from component. marks packets by probabilistically writing interface's number, locally unique 6-digit identifier, to it transmits. After collecting marked each in an attacking path, victim machine can use contained those trace attack back its source (i.e., solve "IP traceback" problem). In component, same are used filter malicious at upstream routers located direction towards attackers), thus effectively mitigating attacks. Because very little space required mark allows us include signature along with number within single packet's header. resulting advantage three fold: (1) significantly less need be collected compared previous schemes, (2) computation overhead process, (3) scalability: large attackers zombies) traced efficiently. uses interface instead entire as "atomic unit" filtering, accomplish these tasks much finer granularity, helps lower false positives. paper, also show supports gradual deployment .