Extended deterministic edge router marking. (1st January 2014)

• Record Type: Journal Article
• Authors: Saurabh, Samant; Roy, Sangita; Sairam, Ashok Singh
• Is Part Of: International journal of communication networks and distributed systems. Volume 13:Number 2(2014)
• Page Start: 169
• Page End: 186
• Publication Date: 2014-01-01
• Subjects: packet marking -- denial of service -- DoS -- distributed denial of service -- DDoS -- hashing -- attack signature -- edge routers -- IP fragmentation -- hash chains and filtering -- computer networks -- distributed systems; Computer networks -- Periodicals; Telecommunication systems -- Periodicals; Electronic data processing -- Distributed processing -- Periodicals; 004.6
• Languages: English
• ISSNs: 1754-3916

Abstract

In this paper, a novel deterministic edge router marking scheme to mitigate denial of service (DoS) attacks and perform traceback is proposed. The scheme is compatible to packet fragmentation and at the same time does not add space overhead. The proposed technique produces low false positive as well as adds very low processing and storage overhead at the edge router. An issue with existing filtering scheme for DoS attacks is that they suffer from heavy collateral damage. Our proposed scheme minimises collateral damage using signature pushback and allows legitimate traffic to be served smoothly. We optimise pushback by using Lamport hash chain and filtering time by sorting the attack feature based on its entropy. Empirical results confirm that our system is fast, accurate, scalable and greatly reduces blocking of legitimate traffic during the filtering phase.