A Novel Two-Step Traceback Scheme for DDoS Attacks

The defense against Distributed Denial of Service (DDoS) attacks is one of the primary concerns on the Internet today. IP spoofing makes it difficult for the victim to determine the packet's true origin. There is a need for a mechanism that could rapidly trace back to the attacks' origins for the victim. This paper presents a two-step traceback scheme to track DDoS attack source by dividing the tracing process into two steps. In the first step, packet marking method based on autonomous system (ASPMM) is adopted to determine the attack-originating autonomous system (AS). In the second step, non-repeated probabilistic packet marking (NRPPM) is used to identify the exact origin of the attacks in the specific AS. Compared with previous algorithms, the two-step traceback scheme has the benefits of low bandwidth consumption, quick convergence speed, light computational overhead of address recombination, it can decrease the number of packets the path reconstruction needs, and improve the efficiency of path reconstruction, hence making it possible to trace the DDoS attack source rapidly.