On Improving an Algebraic Marking Scheme for Detecting DDoS Attacks

Abstract: Distributed Denial of Service (DDoS) attacks could be considered as one of the most serious security problems to the Internet today. To locate the sources of the attack packets, we usually need to find the paths through which the attack packets traversed from the sources to the victim. In this paper, we identify the weaknesses of an existing algebraic marking scheme for detecting DDoS attacks, and propose an improved version of the marking scheme. Simulation experiment results show that the proposed marking scheme could achieve a high success rate in identifying the attack sources. When compared with other marking schemes, it requires fewer packets for attack paths reconstruction. Further, it is characterized by generating no false positives, creating no additional traffic to the network, having a relatively low packet marking and attack path reconstruction overhead, and being backward compatible