Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3136825.3136870acmotherconferencesArticle/Chapter ViewAbstractPublication PagessinConference Proceedingsconference-collections
research-article

Unmasking of source identity, a step beyond in cyber forensic

Published: 13 October 2017 Publication History

Abstract

Increasing number of digital crime raises the need of investigation where the most critical step is to collect the evidences of attack and find the real origin of the attack. However the attacker can easily spoof the source IP address and hence the source IP address information in IP header of the packet cannot be considered as the evidence against the attacker. Traceback based network forensic is the category of techniques which can be used to accurately identify the source of the attack. The up-to-date analysis is required to construct the new methods for finding exact source. The detail issues and challenges in identifying the source has been investigated and discussed in this paper.

References

[1]
Hootsuit. 2017. Digital in 2017 Global Overview. Retrieved from https://wearesocial.com/special-reports/digital-in-2017-global-overview.
[2]
Turker Akyuz and Sogukpinar Ibrahim. 2009. Packet marking with distance based probabilities for IP traceback. In Proceedings of the 1st International Conference on Networks and Communications (NETCOM'09). IEEE, 433--438.
[3]
Hal Burch and Cheswick Bill. 2000. Tracing Anonymous Packets to Their Approximate Source. In Proceedings of the 14th USENIX conference on System administration (LISA '00). USENIX Association, Berkeley, CA, USA, 319--328.
[4]
Stefan Savage, David Wetherall, Karlin Anna and Anderson Tom. 2000. Practical network support for IP traceback. In Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication (SIGCOMM '00). ACM, New York, NY, USA, 295--306.
[5]
Andrey Belenky and Ansari Nirwan. 2003. On IP traceback. IEEE Communications magazine. IEEE, 142--153.
[6]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2013. Deterministic and authenticated flow marking for IP traceback. In Proceedings of the 27th International Conference on Advanced Information Networking and Applications (AINA). IEEE, 397--404
[7]
Masafumi Oe, Kadobayashi Youki and Yamaguchi Suguru. 2003. An implementation of a hierarchical IP traceback architecture. In Proceedings of the Symposium on Applications and the Internet Workshops. IEEE, 250--253
[8]
Chao Gong and Sarac Kamil. 2008. A More Practical Approach for Single-Packet IP Traceback using Packet Logging and Marking. IEEE Transactions on Parallel and Distributed Systems, 1310--1324.
[9]
Alex. C. Snoeren, Partridge C, Sanchez L.A, Jones C.E., Tchakountio F, Schwartz, Kent S.T. and Strayer W.T. 2002. Single-packet IP traceback. IEEE/ACM Transactions on Networking (ToN), 721--734.
[10]
Steven Michael Bellovin, Leech Marcus and Taylor T. 2003. ICMP traceback messages. Retrieved from https://tools.ietf.org/html/draft-ietf-itrace-04.
[11]
Robert Stone. 2000. Centertrack: an IP overlay network for tracking DoS floods. In Proceedings of the USENIX Conference on Security Symposium, 114--114.
[12]
Jangwon Lee and Veciana De G. 2005. Scalable multicast based filtering and tracing framework for defeating distributed DoS attacks. In . International Journal of Network Management, 43--60.
[13]
Yuichi Ohsita, Ata Shingo and Murata Masayuki. 2007. Identification of Attack Nodes from Traffic Matrix Estimation. In IEICE Transactions on Communications, 2854--2864
[14]
Vrizlynn L.L Thing, Sloman Morris and Dulay Naranker. 2007. Non-intrusive IP Traceback for DDoS Attacks. In Proceedings of the ACM Symposium on Information, Computer and Communications Security. ACM, 371--373.
[15]
Basheer Al-Duwairi and Manimaran G. 2004. A novel packet marking scheme for IP traceback. In Proceedings of the 10th International Conference on Parallel and Distributed Systems. IEEE, 195--202.
[16]
Marion Vasseur, Khatoun Rida and Serhrouchni A. 2015. Survey on packet marking fields and information for IP traceback. In Proceedings of International Conference Protocol Engineering (ICPE) and International Conference on New Technologies of Distributed Systems (NTDS). IEEE, 1--8.
[17]
Shui Yu, Zhou Wanlei, Guo Song and Guo Minyi. 2016. A feasible IP traceback framework through dynamic deterministic packet marking. In Transactions on Computers. IEEE, 1418--1427.
[18]
Xiao Liu, Dong Mianxiong, Ota Kaoru, Yang L.T. and Liu Anfeng. 2016. Trace malicious source to guarantee cyber security for mass monitor critical infrastructure. In Journal of Computer and System Sciences. Elsevier.
[19]
Long Cheng, Divakaran D.M., Ang A.W.K, Lim W.Y. and Thing V.L. 2017. FACT: A Framework for Authentication in Cloud-Based IP Traceback. In Transactions on Information Forensics and Security. IEEE, 604--616.
[20]
Peppino Fazio, Tropea M, Marano S. and Voznak M. 2016. Meaningful attack graph reconstruction through stochastic marking analysis. In International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS). IEEE, 1--6.
[21]
Xinyuan Wang. 2016. On the feasibility of real-time cyber attack attribution on the Internet. In Proceedings of Military Communications Conference, MILCOM 2016. IEEE, 289--294.
[22]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2015. Probabilistic Flow Marking for IP Traceback (PFM). In 7th International Workshop on Reliable Networks Design and Modeling (RNDM). IEEE, 229--236.
[23]
M Vijayalakshmi, Nithya N and Shalinie S.M. 2015. A novel algorithm on IP traceback to find the real source of spoofed IP packets. In Artificial Intelligence and Evolutionary Algorithms in Engineering Systems. Springer India 79--87.
[24]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2015. Investigating unique flow marking for tracing back DDoS attacks. In Proceedings of International Symposium on Integrated Network Management. IEEE 762--765.
[25]
Hyungseok Kim, Kim E, Kang S. and Kim H.K. 2015. Network Forensic Evidence Generation and Verification Scheme (NFEGVS). In Telecommunication Systems. Springer, 261--273.
[26]
Peter Hillmann, Tietze F and Rodosek G.D. 2015. Tracemax: A novel single packet IP traceback strategy for data-flow analysis. In Proceedings of 40th International Conference on Local Computer Networks (LCN), IEEE, 177--180.
[27]
Mohammed N. Alenezi and Reed M.J. 2014. Uniform DoStraceback. In Computers & Security. Elsevier, 17--26.
[28]
Gaurav D. Barokar and Mahalle V. S. 2014. Identification of the Real Source of DDOS Attack by FDPM in IP Traceback System. In Modelling Symposium (EMS). IEEE, 392--396.
[29]
Ahmed Fadlallah. 2014. Adaptive probabilistic packet marking scheme for IP traceback. In World Congress on Computer Applications and Information Systems (WCCAIS). IEEE, 1--5.
[30]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2014. TDFA: Traceback-based defense against DDoS flooding attacks. In Proceedings of 28th International Conference on Advanced Information Networking and Applications (AINA). IEEE, 597--604.
[31]
Kayoko Iwamoto, Soshi M. and Satoh T. 2014. An Efficient and Adaptive IP Traceback Scheme. In Proceedings of 7th International Conference on Service-Oriented Computing and Applications (SOCA). IEEE, 235--240.
[32]
Ashwani Parashar and Radhakrishnan R. 2014. Improved deterministic packet marking algorithm for ipv6 traceback. In Proceedings of International Conference on Electronics and Communication Systems (ICECS). IEEE, 1--4.
[33]
VK.Soundar Rajam, Selvaram G, Pradeep Kumar M. and Shalinie S.M. 2013. Autonomous system based traceback mechanism for DDoS attack. In 5th International Conference on Advanced Computing (ICoAC). IEEE, 164--171.
[34]
Y. Bhavani, Janaki V. and Sridevi R. 2013. IP traceback through modified probabilistic packet marking algorithm. In Proceedings of Region 10 Conference TENCON. IEEE, 1--5.
[35]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2013. Deterministic and Authenticated Flow Marking for IP Traceback. In Proceedings of International Conference on Advanced Information Networking &Applications. IEEE, 397--404.
[36]
Mohammed Alenezi and Reed M.J. 2013. Efficient AS DoStraceback. In Proceedings of International Conference on Computer Applications Technology. IEEE, 1--5.
[37]
Sangita Roy, Singh Anurag. and Sairam A.S. 2013. IP traceback in star colored networks. In Proceedings of the International Conference on Communication Systems and Networks. IEEE, 1--9.
[38]
Hongcheng Tian, Bi J. and Jiang X. 2013. An adaptive probabilistic marking scheme for fast and secure traceback. In Networking Science. Springer, 42--51.
[39]
Kichang Kim, Kim J. and Hwang J. 2013. IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths. In Cluster Computing. Springer, 229--239.
[40]
Li Ming Chen, Chen M.C, Liao W. and Sun Y.S. 2013. A Scalable Network Forensics Mechanism for Stealthy Self-Propagating Attacks. In Computer Communications. Elsevier, 1471--1484.
[41]
Ashwani Parashar and Radhakrishnan R. 2013. Improved deterministic packet marking algorithm. In Proceedings of 5th International Conference on Advanced Computing Technologies (ICACT). IEEE, 1--4.
[42]
Guang Yao, Bi J. and Vasilakos A.V. 2015. Passive IP traceback: Disclosing the locations of IP spoofers from path backscatter. In Transactions on Information Forensics and Security. IEEE, 471--484.
[43]
Samant Saurabh and Sairam A.S. 2014. ICMP based IP traceback with negligible overhead for highly distributed reflector attack using bloom filters. In Computer Communications. Elsevier, 60--69.
[44]
B.C. Cheng, Liao G.T, Lin C.K., Hsu S.C, Hsu P.H. and Park J.H. MIB-IT race-CP: An Improvement of ICMP-Based Traceback Efficiency in Network Forensic Analysis. In Proceedings of the Network and Parallel Computing. Springer, 101--109.
[45]
H Guerid, A Serhrouchni, M Achemlal and K Mittig. 2011. A Novel Trace back Approach for Direct and Reflected ICMP Attacks. In Proceedings of the Conference on Network and Information Systems Security, 1--5.
[46]
AR Kiremire, MR Brust and VV Phoha. 2012. A prediction based approach to IP trace back. In Proceedings of the IEEE Conference on Local Computer Networks Workshops. IEEE, 1022--1029.
[47]
Guang Yao, Bi Jun and Zhou Z. 2010. Passive IP Traceback: Capturing the Origin of Anonymous Traffic Through Network Telescope. In Proceedings of the ACM SIGCOMM Conference. ACM, 413--414.
[48]
Fang Yu and Lee David. 2008. Internet Attack Traceback-Cross-validation and Pebble Tracing. In Proceedings of the Conference on Technologies for Homeland Security. IEEE, 378--383.
[49]
Cheol J. Chae, Lee S.H. Lee J.S. and Lee J.K. 2007. A Study of Defense DDoS Attacks Using IP Traceback. In Proceedings of the International Conference on Intelligent Pervasive Computing. IEEE, 402--408.
[50]
AIzaddoost, M Othman and MFA Rasid. 2007. Accurate ICMP TraceBack Model under DoS/DDoS Attack. In Proceedings of the International Conference on Advanced Computing and Communications. IEEE, 441--446.
[51]
Fadlallah A and Serhrouchni A. 2006. PSAT: Proactive Signalling Architecture for IP Traceback. In Proceedings of the International Conference on Communication Networks and Services Research. IEEE, 293--299.
[52]
VL Thing, Lee HC, Sloman M and Zhou J. 2005, Enhanced ICMP traceback with cumulative path. In Proceedings of the International Conference on Vehicular Technology. IEEE, 2415--2419.
[53]
Wayne Huang, Cong JL, Wu C, Zhao F and Wu SF. 2005. Design, Implementation, and Evaluation of FRiTrace. In Proceedings of the International Information Security Conference, Springer, 343--358.
[54]
Bao Tung Wang and Schulzrinne H. 2004. A denial-of-service-resistant IP traceback approach. In Proceedings of the Ninth International Symposium on Computers and Communications, IEEE, 351--356.
[55]
Bao Tung Wang, Schulzrinne H. 2004. An IP traceback mechanism for reflective DoS attacks. In Proceedings of the Canadian Conference on Electrical and Computer Engineering. IEEE, 901--904.
[56]
Ping Yan and Lee M.C. 2004. Towards an Adaptive Packet Marking Scheme for IP Traceback. In Proceedings of e-Business and Telecommunication Networks. Springer, 150--157.
[57]
Vahid Aghaei Foroushani and Zincir-Heywood A. Nur. 2016. Autonomous system based flow marking scheme for IP-Traceback. In Network Operations and Management Symposium (NOMS). IEEE, 121--128.
[58]
Mohammed Alenezi, and Reed M.J. 2013. Efficient AS dos traceback. In Proceedings of International Conference on Computer Applications Technology. IEEE, 1--5.
[59]
Hongcheng Tian, Bi J. and Xiao P. 2012. A Flow-Based Traceback Scheme on an AS-Level Overlay Network. In: Proceedings of the International Conference on Distributed Computing Systems Workshops, IEEE, 559--564.
[60]
Hongcheng Tian and Bi J. 2012. An Incrementally Deployable Flow-Based Scheme for IP Traceback. IEEE Communications Letters. 1140--1143.
[61]
Hongcheng Tian, Bi J, Zhang W and Jiang X. 2011. EasyTrace: An easily-deployable light-weight IP traceback on an AS-level overlay network. In Proceedings of the International Conference on Network Protocols. IEEE, 129--130
[62]
Andre Castelucio, Gomes A.T.A. and Ziviani A. 2010. Intra-domain IP traceback using OSPF. In Proceedings of the IEEE Symposium on Network Operations and Management. IEEE, 36--41.
[63]
Andre Castelucio, Ziviani A and Salles RM. 2009. An AS-level overlay network for IP traceback. In IEEE Network: IEEE, 36--41.
[64]
Robert Stone. 2000. Centertrack: An IP overlay network for tracking DoS floods. In Proceedings of the USENIX Conference on Security Symposium. 15--15.
[65]
Magdy M. Fadel, El-Desoky A.I, Haikel A.Y. and Labib L.M. 2016. A Low-Storage Precise IP Traceback Technique Based on Packet Marking and Logging. In The Computer Journal. Oxford, 1581--1592.
[66]
EunHee Jeong and Lee B. 2014. An IP Traceback Protocol using a Compressed Hash Table, a Sinkhole router and data mining based on network forensics against network attacks. In Future Generation Computer Systems. Elsevier, 42--52.
[67]
Miang H. Yang, Yang M.C, Luo J.N. and Hsu W.C. 2014. High accuracy and low storage hybrid IP traceback. In Proceedings of International Conference on Computer, Information and Telecommunication Systems (CITS). IEEE, 1--5.
[68]
Ming C Yang. 2012. RIHT: A Novel Hybrid IP Traceback Scheme. IEEE Transactions on Information Forensics and Security. IEEE, 789--797.
[69]
Yulong Wang, Su S, Yang Y and Ren J. 2012. A More Efficient Hybrid Approach for Single-Packet IP Traceback. In Proceedings of the Euromicro International Conference on Parallel, Distributed & Network-Based Processing. IEEE, 275--282.
[70]
Ning Lu, Wang Y, Yang F and Xu M. 2012. A Novel Approach for Single-Packet IP Traceback Based on Routing Path. In Proceedings of the Euromicro International Conference on Parallel, Distributed and Network-Based Processing, IEEE, 253--260.
[71]
Tomoyuki Karasawa, Soshi M and Miyaji A. 2012. A Novel Hybrid IP Traceback Scheme with Packet Counters. In Proceedings of the International conference on Internet and Distributed Computing Systems, Springer, 71--84.
[72]
Hyung S. Kim. and Kim H.K. 2011. Network forensic evidence acquisition (NFEA) with packet marking. In Proceedings of 9th IEEE International Symposium on Parallel and Distributed Processing with Applications Workshops IEEE, 388--393.
[73]
Wen C. Kuo, Chen Y.L, Tsai S.C and Li J.S. 2011. Single-Packet IP Traceback with Less Logging. In Proceedings of International Conference on Intelligent Information Hiding and Multimedia Signal Processing. IEEE, 97--100.
[74]
Hongbin Yim, Kim T, Jung J. 2011. Probabilistic Route Selection Algorithm to Trace DDoS Attack Traffic Source. In Proceedings of the International Conference on Information Science and Applications. IEEE, 1--8.
[75]
Hao Shuai, H. Xiaohong and M.A. Yan. 2010. simple packet authentication mechanism based on stateless core approach. In Proceedings of the GLOBECOM Workshops. IEEE, 503--507.
[76]
Li Yonghui, Yulong W, Fangchun Y, Sen S. and Dong Y. 2010. Deterministic packet marking based on the coordination of border gateways. In Proceedings of International Conference on Education Technology & Computer. IEEE, 154--16
[77]
Zeeshan S. Khan, Akram N, Alghathbar K, She M. and Mehmood R. 2010. Secure single packet IP Traceback mechanism to identify the source. In Proceedings of the International Conference for Internet Technology and Secured Transactions. IEEE, 1--5.
[78]
Hong Yim and J. Jung. 2009. Probabilistic Route Selection Algorithm for IP Traceback. In Proceedings of the Security Technology, Disaster Recovery and Business Continuity. Springer, 94--103.
[79]
Xiao Wang and Xiao Y. 2009. IP Traceback Based on Deterministic Packet Marking and Logging. In Proceedings of the International Conference on Scalable Computing and Communications. IEEE, 178--182.
[80]
Ahmad Fadlallah, Serhrouchni A, Begriche Y. and Nait-Abdesselam F. 2008. A Hybrid Messaging-Based Scheme for IP Traceback. In Proceedings of the International Conference on Information and Communication Technologies: From Theory to Applications. IEEE, 1--6.
[81]
Muthusrinivasan Muthuprasanna and Manimaran G. 2008. Distributed Divide-and-Conquer Techniques for Effective DDoS Attack Defenses. In Proceedings of the International Conference on Distributed Computing Systems. IEEE, 93--102.
[82]
S. Malliga and Tamilarasi A. 2008 A Proposal for New Marking Scheme with Its Performance Evaluation for IP Traceback. In WSEAS Transactions on Computer Research, 259--272.
[83]
Ruijuan Zheng, Wu Q and Zhang M. 2008. An Intelligent Packet Marking Algorithm Based on Extended Huffman Coding. In Proceedings of the International Symposium on Intelligent Information Technology Application. IEEE, 60--64.
[84]
L. LI and Shen S. 2008. Packet track and traceback mechanism against denial of service attacks. The Journal of China Universities of Posts and Telecommunications. 51--58.

Cited By

View all
  • (2024)Proactive cyber defense through a comprehensive forensic layer for cybercrime attributionInternational Journal of Information Technology10.1007/s41870-024-01947-216:6(3555-3572)Online publication date: 5-Jun-2024
  • (2022)Secure Data Sharing in Medical Cyber-Physical system—a ReviewFuturistic Trends in Networks and Computing Technologies10.1007/978-981-19-5037-7_71(993-1005)Online publication date: 16-Nov-2022
  • (2022)A Questionnaire-Based Analysis of Network Forensic ToolsCongress on Intelligent Systems10.1007/978-981-16-9416-5_47(645-652)Online publication date: 1-Jul-2022
  • Show More Cited By

Index Terms

  1. Unmasking of source identity, a step beyond in cyber forensic

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Other conferences
    SIN '17: Proceedings of the 10th International Conference on Security of Information and Networks
    October 2017
    321 pages
    ISBN:9781450353038
    DOI:10.1145/3136825
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 13 October 2017

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. cyber crime
    2. forensic
    3. packet marking
    4. traceback

    Qualifiers

    • Research-article

    Conference

    SIN '17
    SIN '17: Security of Information and Networks
    October 13 - 15, 2017
    Jaipur, India

    Acceptance Rates

    Overall Acceptance Rate 102 of 289 submissions, 35%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)7
    • Downloads (Last 6 weeks)0
    Reflects downloads up to 26 Jan 2025

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Proactive cyber defense through a comprehensive forensic layer for cybercrime attributionInternational Journal of Information Technology10.1007/s41870-024-01947-216:6(3555-3572)Online publication date: 5-Jun-2024
    • (2022)Secure Data Sharing in Medical Cyber-Physical system—a ReviewFuturistic Trends in Networks and Computing Technologies10.1007/978-981-19-5037-7_71(993-1005)Online publication date: 16-Nov-2022
    • (2022)A Questionnaire-Based Analysis of Network Forensic ToolsCongress on Intelligent Systems10.1007/978-981-16-9416-5_47(645-652)Online publication date: 1-Jul-2022
    • (2022)EHR-Sec: A Blockchain Based Security System for Electronic HealthSoft Computing and Signal Processing10.1007/978-981-16-7088-6_26(295-303)Online publication date: 15-Feb-2022
    • (2022)Management of Digital Evidence for Cybercrime Investigation—A ReviewSoft Computing and Signal Processing10.1007/978-981-16-7088-6_11(133-143)Online publication date: 15-Feb-2022
    • (2021)A New Network Forensic Investigation Process ModelMobile Computing and Sustainable Informatics10.1007/978-981-16-1866-6_9(139-146)Online publication date: 23-Jul-2021
    • (2021)Review on Applications of Blockchain for Electronic Health Records SystemsSecond International Conference on Image Processing and Capsule Networks10.1007/978-3-030-84760-9_52(609-616)Online publication date: 10-Sep-2021
    • (2020)Backtracking Tool Root-Tracker to Identify True Source of Cyber CrimeProcedia Computer Science10.1016/j.procs.2020.04.120171(1120-1128)Online publication date: 2020
    • (2018)Primordial Fingerprinting Techniques from the Perspective of Digital Forensic Requirements2018 9th International Conference on Computing, Communication and Networking Technologies (ICCCNT)10.1109/ICCCNT.2018.8494064(1-6)Online publication date: Jul-2018

    View Options

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Figures

    Tables

    Media

    Share

    Share

    Share this Publication link

    Share on social media