1. Efficient AS DoS Traceback (Autonomous System) Mohammed Alenezi, Martin J Reed Computer Applications Technology (ICCAT), 2013 張業正 102062638 1

2. Outline Background Traceback (Related work) DPM,PPM,DPPM EAST Performance Conclusion 2

3. Background DoS problem has been divided into three. 1. Prevention 2. Detection 3. Mitigation Traceback which is under Mitigation. 3

4. Traceback (Related work) There are many techniques have been proposed to traceback. 1. Link testing. 4

5. Traceback (Related work) There are many techniques have been proposed to traceback. 1. Link testing. 2. ICMP 1/20,000 5

6. Traceback (Related work) There are many techniques have been proposed to traceback. 1. Link testing. 2. ICMP 3. Logging 4. Packet Marking Deterministic Packet Marking(DPM) Probabilistic Packet Marking(PPM) Dynamic Probabilistic Packet Marking(DPPM) Storage 6

7. Deterministic Packet Marking(DPM) DPM marks every packet at the edge router. Use 16 bits IP Header and 1 bit Flag. 7

8. Probabilistic Packet Marking(PPM) Probability,p=1/25 IP header 16bits=> 8bits IP address, 8bits distance Routers 64Bits fragmentation to 8 x 8bits and victim combine. 8 DPM VS PPM

9. Dynamic Probabilistic Packet Marking(DPPM) Probability,p=1/d d is the traveling distance(by packet’s TTL) Packets to reconstruct the path are reduced. 9 DPPM VS PPM

10. TTL drawbacks 1. Initial TTL value is system dependent and would be changing based on the used system. 2. Attacker can intentionally inject packets with different TTL to confuse the technique. 10

11. EFFICIENT AS TRACEBACK (EAST) AS(Autonomous System),ASBR,BGP AIM: 1. Solve TTL drawbacks. 2. Reducing the required number of packets in the traceback. (Reduce storage at the victim) 11

12. EAST The 25 bits comes from three different fields, namely Type of service (TOS), identification(ID), and reservation flag (RF). 12

13. EAST Probability,p=1/(a-2) a is ASs from attacker to the AS of the victim. performs traceback at the AS level,a can be known in advance.  Solve TTL problem 13 32bits hash to 22bits

14. EAST algorithm 14

15. Performance and Analysis 15

16. Performance and Analysis 16

17. Conclusion DoS Traceback has many way. EAST maybe is better than PPM,DPPM. 17

18. REFERENCES [1] Ping-Hsien Yu, An Application of Proportional Probabilistic Packet Marking Trace in the DDoS Overlay Defense System, Department of Computer Science & Information Engineering 2011 [2] 彭士浩, 張晉銘, 卓信宏, 林宜隆, 趙涵捷, " 基於機率的封包標記選擇 策略改善 IP 回溯效能," 第十六屆臺灣網際網路研討會 (TANET 2011), Ilan, Taiwan, October 24-26, 2011. 18

19. THANK YOU. 19