The week's pick
Random Articles
Reseach Article
Detection and Removal of IP Spoofing through Extended-Inter Domain Packet Filter Architecture
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 49 - Number 17 |
| Year of Publication: 2012 |
| Authors: G. Velmayil, S. Pannirselvam |
10.5120/7723-1126
|
G. Velmayil, S. Pannirselvam . Detection and Removal of IP Spoofing through Extended-Inter Domain Packet Filter Architecture. International Journal of Computer Applications. 49, 17 ( July 2012), 37-43. DOI=10.5120/7723-1126
Abstract
IP spoofing makes use of the basic weakness in the Internet Protocol to launch the DDOS attack. The existing methods become ineffective due to a large number of filters required and they lack in information about where to place the filter. The existing system requires the global routing information to defend IP spoofing effectively. We propose Extended Inter Domain Packet Filters (Ex-IDPF) to overcome this problem. The Ex-IDPF comprises of two functional blocks namely, marking and filtering blocks. In the marking block, each source is labeled with a key. The key is changed continuously for a certain period of time to provide secured system and is validated at border routers. In the filtering block, spoofed packets are filtered at the border router using path history and the feasible route table. This architecture is independent of global routing information and the Ex-IDPFs are constructed on the basis of Border Gateway Protocol (BGP) route updates. The filter placement algorithm clearly put forwards the conditions under which the filter can operate accurately. The accuracy of the proposed systems is validated using Network Simulator (NS-2).
References
- FrankKargl, Joern Maier and Michael Weber 2001. "Protecting Web Servers from Distributed Denial of Service Attacks", ACM proceedings of10th conference on World Wide Web, pp 514-524.
- Michael Walsh, MythiliVutukuru, HariBalakrishnan, David Karger, and Scott Shenkery 2006. "DDoS Defense by Offense", proceedings of SIGCOMM '06 conference on applications, technologies, architectures and protocols for computer communications, Volume 36, Issue 4, pp 303-314.
- David Moore, Colleen Shannon, Douglas J. Brown, Geoffrey M. Voelker and Stefan Savage 2006. "Inferring Internet Denial-of-Service Activity" ACM Transactions on Computer Systems, Volume- 24, Issue- 2, Pp. 115–139.
- S. M. Bellovin1989. "Security Problems in the TCP/IP Protocol Suite" Computer Communication Review, Volume 19, Issue- 2, pp. 32-48.
- L. Todd Heberlein, Matt Bishop 1996. "Attack Class: Address Spoofing", Proceedings of the 19th National Information Systems Security Conference, pp: 371-377.
- V. Paxson 2001. "An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks," ACM SIGCOMM Computer Communications Review, Volume 31, Isssue 3, pp 38-47.
- SupranamayaRanjan, Ram Swaminathan, Mustafa Uysal, Antonio Nucci, and Edward Knightly 2009. "DDoS-Shield: DDoS-Resilient Scheduling to Counter Application Layer Attacks", IEEE/ACM Transactions on Networking, Volume 17, Issue 1, pp 26-39.
- Yu Chen, Kai Hwang, and Wei-Shinn Ku 2007. "Collaborative Detection of DDoS Attacks over Multiple Network Domains" IEEE Transactions on Parallel and Distributed Systems, Volume 18, Issue 12, pp 1649-1662.
- JelenaMirkovic, Nikola Jevtic and Peter Reiher 2006. "A Practical IP Spoofing Defense through Route-Based Fltering" University of Delaware, CIS department, Technical Report, CIS-TR
- ZhenhaiDuan, Xin Yuan and Jaideep Chandrasekhar 2008. "Controlling IP Spoofing through Inter domain Packet Filters" IEEE Transactions on Dependable and Secure Computing, Volume 5, Number 1.
- Qiming Li, Ee-Chien Chang, MunChoon Chan 2005. "On the Effectiveness of DDOS Attacks on Statistical Filtering", proceedings of IEEE INFOCOM, pp 1373-1383.
- Haining Wang, Cheng Jin, and Kang G. Shin 2007. "Defense against Spoofed IP Traffic Using Hop-Count Filtering ",IEEE/ACM Transactions on Networking, Volume 15, Issue 1, pp 40-53.
- Fu-Yuan Lee and ShiuhpyngShieh2005. "Defending against spoofed DDoS attacks with path fingerprint", International Journal on Computers and Security, Volume 24, Issue 7, pp 571- 586,
- RatulMahajan, Steven M. Bellovin, Sally Floyd, John Ioannidis, Vern Paxson, and Scott Shenker 2002. "Controlling High Bandwidth Aggregates in the Network" ACM SIGCOMM Computer Communication Review, Volume 12, Issue 3, pp 62-73.
- Angelos D. Keromytis, Vishal Misra and Dan Rubenstein 2004. "SOS: An Architecture for Mitigating DDoS Attacks" IEEE Journal on Selected Areas in Communications, Volume: 22 , Issue: 1, pp: 176 – 188.
- Stavrou, A. , Keromytis, A. D. , Nieh, J. , Misra, V. , Rubenstein, D. 2005. "MOVE: An End-to-End Solution to Network Denial of Service", In proceeding of: Proceedings of the Network and Distributed System Security Symposium.
- AbrahamYaar Adrian Perrig and Dawn Song 2003. "Pi: A Path Identification Mechanism to Defend against DDoS Attacks" Proceeding of Symposium on Security and Privacy.
- VamsiParuchuri, ArjanDurresi and SriramChellappan 2008. "TTL based Packet Marking for IP Trace back" IEEE Conference on Global Telecommunications.
- JelenaMirkovic and Peter Reiher 2005. "D-WARD: A Source-End Defense against Flooding Denial-of-Service Attacks" IEEE Transactions on Dependable and Secure Computing, Volume 2, Issue 3, pp 216- 232.
- AnatBremler-Barr Hanoch Levy 2005. "Spoofing Prevention Method" 24th IEEE Proceedings of Annual Joint Conference of the Computer and Communications Societies, pp536-547.
- JelenaMirkovic and Ezra Kissel 2011 "Comparative Evaluation of Spoofing Defenses" IEEE transactions on dependable and secure computing, volume 8, issue 2.
Index Terms
Keywords