Autonomous system based traceback mechanism for DDoS attack

Distributed denial of service attacks poses a major threat to internet. In order to find out the source of DDoS attack, the network forensic system captures and examines the network traffic completely. The proposed traceback mechanism with an effective optimization algorithm called ACOPID in autonomous system with DPM inflicts two major advantages. They are predicting the complete attack path and efficiently tracing the DDoS attack source. Our contribution is on host IP traceback with DPM (OHDPM) based on autonomous system to traceback the DDoS attack source with the marking information with reduced false positive rate. Our previous work was to produce an analysis model using collective intelligence which determines the attack path by calculating the ant density of all possible paths. The proposed method shows the strategic placement of system on highly connected autonomous systems provides better accuracy for determining the most possible attack path and it reduces the false positive rate.

I. Introduction

Distributed Denial of Service attack impose an alarming threat to the operation of internet services which floods the victim with a tremendous amount of traffic and exhaust the victim's resources thereby making its services unavailable to the user. It is difficult to defend against DDoS attack as it is originated from a large number of compromised attack agents [1] [2]. No effective solution has been devised for this serious threat because the attackers keep changing their attacking patterns and attack source IP address constantly. In this arena of attacks, IP traceback has become one of the major and vital solutions for tracing the attack origin. From the network forensics view, to identify the actual source and the network path used by the packet, IP traceback mechanism is employed [3] [4]