A Low-Storage Precise IP Traceback Technique Based on Packet Marking and Logging.

IP traceback techniques are used to defend against DDoS attacks, and two of the most preferred techniques are packet marking and packet logging. Marking techniques differentiate between attacks and legitimate packets incur little computation overhead while requiring a large flow of packets to build the entire attack path. Logging techniques trace even a single packet; routers record the packet digests locally, so it is considered as a more powerful technique. However, routers require a high storage space for storing packet digests that represents a vital problem in deploying it practically. In this paper, a new hybrid IP traceback framework is presented. This framework is based on both marking and logging techniques. In the marking algorithm, every router is assigned a 12-bit-length ID number; it helps in deploying pushback method to permit legitimate traffic flow smoothly. In the packet logging technique, a logging ratio is managed by changing a value k specified in the traceback system. According to the mathematical analysis and experimental results, >50% of the storage space of routers could be saved as a result of choosing a proper k value. [ABSTRACT FROM AUTHOR]