Practical network support for IP traceback

By Stefan Savage, David Wetherall, Anna R. Karlin, T. Anderson. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2000

1,445 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/472bb7074d088185f08cb0112dbc1026b5e05498

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Detecting SYN flooding attacks (2002, background): “They have to rely on the expensive IP traceback [2], [21], [25], [28], [29], [34] to locate the flooding sources.”
Anomaly detection in IP networks (2003, background): “In case of network intrusions, the malicious entity could hijack network bandwidth by flooding the network with unnecessary traffic, thus starving other legitimate users [6], [17].”
Global Intrusion Detection in the DOMINO Overlay System (2004, methodology): “We also evaluate how to configure DOMINO in order to maximize performance gains from the perspectives of blacklist length, blacklist freshness and IP proximity.”
SAVE: source address validity enforcement protocol (2002, neutral): “Probabilistic packet marking encodes the path information in the ID field of an IP header [23].”
Bohatei: Flexible and Elastic DDoS Defense (2015, background): “DDoS-resilient Internet architectures: These include the use of capabilities [58], better inter-domain routing (e.g., [60]), inter-AS collaboration (e.g., [39]), packet marking and unforgeable identiﬁers (e.g., [26]), and traceback (e.g., [51]).”
Controlling high bandwidth aggregates in the network (2002, background): “Two common mechanisms to counter DoS attacks are ingress filtering [7] and traceback [1, 24, 26].”
On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack (2001, background): “If all ISPs were to implement mechanisms for preventing IP source address spoofing—which is, technically, easy to do—then source identification (also called IP traceback in [9]), would be solved.”
A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks (2013, background): “The ﬁrst category is packet marking mechanisms [64]–[66].”
Efficient Peer-to-Peer Keyword Searching (2003, background): “However, a distributed denial of service attack [17] against the site’s DNS server or an inopportune network failure can potentially leave the entire service unavailable.”
Hop-count filtering: an effective defense against spoofed DDoS traffic (2003, background): “Off-line IP traceback [4, 36, 37, 38, 41] attempts to establi sh procedures to track down flooding sources after occurrences of DDoS attacks.”
Defending against flooding-based distributed denial-of-service attacks: a tutorial (2002, background): “Another is for routers to send additional information about the packets they have seen to the packets' destinations via either the packets [9] or another channel , such as ICMP messages.”
Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds (2005, background): “Furthermore, in contrast to ba ndwidth attacks [48, 36], it is difficult to detect big resource consu mers when the attack targets higher-layer bottlenecks such as CPU, da tabase, and disk because commodity operating systems do not support fine -grained resource monitoring [13, 12, 57].”
Preventing Internet denial-of-service with capabilities (2004, methodology): “Several sophisticated methods have been proposed for tracing attacks back through the network toward their source [3] [18] [19].”