A Marking/Traceback System for Detecting the Source of Dos/Ddos Attacks

Distributed Denial of Service (DDoS) attack is a significant threat in today's world. Attackers hide their identity by spoofing and defending. To quickly detect a spoofed Internet Protocol (IP) during a DDoS attack the number of time-to-live hops in the network can be evaluated. While using time-to-live, if the routers gets compromised it may lead to the wrong detection of spoofed IP when both the source and attacker are at same distance. To identify an attacker, this system proposes an enhanced packet marking and traceback algorithm for IP traceback that helps the traceback of the spoofed packet to its source. A number of IP traceback techniques exist, but they have limitations like the number of packets required or storage and computational overheads incurred at routers. The technique proposed reduces marking and storage overhead..