Singleton Flow Traceback (SFT) Mechanism

In this paper we propose and analyze a loggingbased IP traceback mechanism, referred to as Singleton Flow Traceback(SFT), that can traceback to the source of a flow containing one or more packets. We consider the tuple <; S, D > as a flow, where S is the Source IP and D is the destination IP of the flow and all packets with the same <; S, D > pair belongs to the same flow. For logging, SFT requires significantly less storage (less than 8% of packet rate) than most of the existing single packet traceback mechanism in the literature. SFT guarantees zero false negative rate, i.e., if there exists a path P = R
₁
, R
₂
....R
_k
of routers through which the packets of a flow <; S, D > has traversed, SFT can always reach R
₁
, i.e., the first router to which the source of the flow <; S, D > is connected with. Also, the expected value of false positive rate for a traceback query is very low (<; 0.11).