Paper Details

ABSTRACT

Disclosing the IP of spoofer or attacker traceback is an open and challenging issue.Deterministic Packet Marking (DPM) is a simple and efficient traceback mechanism,but the current DPM based traceback schemes are not practical due to their scalability constraint.After all,due to the objection of distribution, there has been not a widely accept IP traceback solution, at least at the Internet level.As a result, the mist on the locations of spoofers has never been dissipated till now. FIT investigates Internet Control Message Protocol (ICMP) error messages (named path backscatter) triggered by spoofing traffic, and tracks the spoofers based on public available information (e.g., topology). In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. This system proposes feasible IP (FIT) traceback that bypasses the deployment difficulties of IP traceback techniques. FIT investigates Internet Control Message Protocol (ICMP) error messages (named path-backscatter) cause by spoofing traffic, and tracks the spoofers based on public available information (e.g., topology). In order to traceback to confusing attack source, what we need to do is to mark these convoluted ingress routers using the traditional DPM strategy.These results can help further reveal IP spoofing, which has been studied for long but never well understood. Though FIT cannot work in all the spoofing attacks, it may be the most useful mechanism to trace spoofers before an Internet-level traceback system has been deployed in real.