Hash-based IP traceback

By Alex C. Snoeren, Chris Partridge, Luis Angel Galindo Sánchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, W. Timothy Strayer. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2001

934 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/c1fd86cc47ab3d99f03caedacea398b9dc5a40ef

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Measuring ISP topologies with rocketfuel (2002, background): “Topology influences the dynamics of routing protocols [2, 10], the scalability of multicast [17], the efficacy of proposals for denial-of-service tracing and response [16, 11, 21, 22 ], and other aspects of protocol performance [18].”
Hop-count filtering: an effective defense against spoofed DDoS traffic (2003, background): “Offline IP traceback [2, 34, 36, 39] attempts to establish procedures to track down flooding sources after occurrences of DDoS attacks.”
Low-rate TCP-targeted denial of service attacks and counter strategies (2003, background): “While potentially quite harmful, the high-rate natur e of such attacks presents a statistical anomaly to network monitors such that the attack can potentially be detected, the attacker identi fi d, and the effects of the attack mitigated (see for example, [6, 22, 30]).”
An analysis of using reflectors for distributed denial-of-service attacks (2001, methodology): “Savage and colleagues proposed a different scheme, in which routers with considerably higher probability mark the packets they process with highly compressed information that the victim can decode in order to detect the edges (pairs of packet-marking routers) traversed by the packets, again enabling”
DDoS attacks and defense mechanisms: classification and state-of-the-art (2004, methodology): “Characteristic examples of these mechanisms are WATCHERS [99], traceback [65,73,68,69,74] and pushback [100].”
Defending against flooding-based distributed denial-of-service attacks: a tutorial (2002, background): “One is for routers to record information about packets they have seen for later traceback requests [8].”
LIPSIN: line speed publish/subscribe inter-networking (2009, methodology): “In Icarus [35], a method to detect possible loops in the routing by using in-packet BF is presented.”
Detecting SYN flooding attacks (2002, background): “They have to rely on the expensive IP traceback [2], [21], [25], [28], [29], [34] to locate the flooding sources.”
Compressed bloom filters (2001, background): “Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.”
Automated Worm Fingerprinting (2004, methodology): “both use hashing to match packet observations across a network [38, 7], and both Spring et al.”
Measuring ISP topologies with Rocketfuel (2004, background): “Topology influences the dynamics of routing protocols [3], [11], the scalability of multicast [19], the efficacy of denial-of-service tracing and response [12], [18], [23], [24], and other aspects of protocol performance [20].”
The Bloomier filter: an efficient data structure for static support lookup tables (2004, background): “They have many uses in networks [2]: for collaborating in overlay and peer-to-peer networks [5, 8, 17], resource routing [15, 26], packet routing [12, 30], and measurement infrastructures [9, 29 ].”
A taxonomy of DDoS attack and DDoS defense mechanisms (2004, background): “Agent identification examples include numerous traceback techniques [10, 62, 25, 66, 65].”
A DoS-limiting network architecture (2005, background): “, ingress filtering [8] discards packets with widely spoofed addresses at the edge of the network, and traceback uses routers to create state so that receivers can reconstruct the path of unwanted traffic [20, 21, 22].”
Defense Against Spoofed IP Traffic Using Hop-Count Filtering (2007, background): “The router-based approach installs defense mechanisms inside IP routers to trace the source(s) of attack [4], [30], [43], [45], [46], [49], or detect and block attacking traffic [15], [23], [25], [29], [31], [36], [50], [56].”
Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges (2016, neutral): “input debugging [59], probabilistic packet marking [60], and hash-based IP traceback [61].”
Network Applications of Bloom Filters: A Survey (2004, methodology): “Snoeren et al. suggest this approach, with the addition of using Bloom ﬁ lters in order to reduce the amount of information that needs to be stored in order to summarize the set of packets seen, as part of their Source Path Isolation Engine (SPIE) [Snoeren et al. 01].”