a packet logging technique which means have no detectable impacts on the network. that it involves storing packet digests at Thus, an audit option is used in SPIE. some crucial routers. The main issue is that SPIE is also called hash-based IP traceback the storage of saved packet data requires a because a hash of the invariant fields in the lot of memory. SPIE is of high storage IP header is stored in each router as a 32-bit efficiency and thus reduces the memory digest. It remains stored only for a limited requirement (0.5% of the link capacity per duration of time because of space unit time in storage). In fact, instead of constraint. storing the packets, it uses auditing techniques. It computes and stores 32-bit Packet digests are created by Data packet digest. Moreover, an efficient data Generation Agent (DGA) at each router. structure to store packet digest is Before a traceback begins, an attack packet mandatory. SPIE uses Bloom filter structure. must be detected. To determine it, an intrusion detection system (IDS) is used. IDS Another important issue of packet logs is the provides a packet, the last hop router, the risk of eavesdropping. Storing only packet time of attack, to the SPIE Traceback digests and not the entire packet prevents Manager (STM) which will verify its SPIE from being misused by attackers. authenticity and integrity. Upon successful Therefore, the network is protected from verification, STM will send the signature eavesdropping which is one of the criteria of information to the SPIE Collection and an effective IP traceback system. Reducing Agent (SCAR) responsible for the are two options to determine the route victim’s network area. If any match is found, of a packet flow. The first one is to audit the the SCAR returns a partial attack graph of flow while it passes through the network the involving routers. Then STM will then and the second is to attempt to infer the send new queries to another SCAR region. route based on its impact on the state of the This process continues until the attack path network. The difficulty of using them is constructed. Finally, the STM sends the increases as the size of the packet flow result back to the IDS. decreases. Especially, the second one becomes impossible because small flows
a packet logging technique which means that it involves storing packet digests at some crucial routers. The main issue is that the storage of saved packet data requires a lot of memory. SPIE is of high storage efficiency and thus reduces the memory requirement (0.5% of the link capacity per unit time in storage). In fact, instead of storing the packets, it uses auditing techniques. It computes and stores 32-bit packet digest. Moreover, an efficient data structure to store packet digest is mandatory. SPIE uses Bloom filter structure. Another important issue of packet logs is the risk of eavesdropping. Storing only packet digests and not the entire packet prevents SPIE from being misused by attackers. Therefore, the network is protected from eavesdropping which is one of the criteria of an effective IP traceback system. are two options to determine the route of a packet flow. The first one is to audit the flow while it passes through the network and the second is to attempt to infer the route based on its impact on the state of the network. The difficulty of using them increases as the size of the packet flow decreases. Especially, the second one becomes impossible because small flows have no detectable impacts on the network. Thus, an audit option is used in SPIE. SPIE is also called hash-based IP traceback because a hash of the invariant fields in the IP header is stored in each router as a 32-bit digest. It remains stored only for a limited duration of time because of space constraint. Packet digests are created by Data Generation Agent (DGA) at each router. Before a traceback begins, an attack packet must be detected. To determine it, an intrusion detection system (IDS) is used. IDS provides a packet, the last hop router, the time of attack, to the SPIE Traceback Manager (STM) which will verify its authenticity and integrity. Upon successful verification, STM will send the signature information to the SPIE Collection and Reducing Agent (SCAR) responsible for the victim’s network area. If any match is found, the SCAR returns a partial attack graph of the involving routers. Then STM will then send new queries to another SCAR region. This process continues until the attack path is constructed. Finally, the STM sends the result back to the IDS.
IP-Traceback.docx