Tracing Anonymous Mobile Attackers in Wireless Network

Transcription

1 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang *1, Shuhpyng Sheh *2 *1 Departent of Inforaton and Coputer Engneerng Chung Yuan Chrstan Unversty Chung L Cty, Taoyuan County 32054, Tawan *2 Departent of Coputer Scence & Inforaton Engneerng atonal Chao Tung Unversty Hsnchu Cty 300, Tawan hyang@cycu.edu.tw, ssp@cse.nctu.edu.tw do: /dcta.vol4.ssue4.16 Abstract In a floodng-based dstrbuted denal-of-servce (DDoS) attac, an adversary attepts to exhaust a target s coputng resource. To detect DDoS attacs n a networ envronent, IP tracebac ethods are deployed to deterne the orgn of attac pacets. Wth the ncrease n bandwdth of wreless networs, attacers ay choose ths edu fro whch to launch attacs. However, tracng the attacers n wreless networs s ore dffcult snce nteredate nodes ay ove or attacers ay change ther locaton to hde theselves. Thus, conventonal tracebac schees for wred networs cannot apply drectly to the wreless networ nfrastructure because the nteredate routers could be coprosed by an adversary. Therefore, we propose a flexble and lghtweght tracebac schee to deterne the source of attac pacets n a oble ad-hoc envronent. We wll deonstrate our ethod s ablty to trac the oveent of an attacer and recognze attac traffc launched by the sae attacer fro dfferent locatons. 1. Introducton Keywords: Wreless tracebac, Dstrbuted Denal of Servce Attac, Moble Wth the decreasng cost of access and ts ncreasng avalablty fro a plethora of devces and edus, the pact of attacs on the networ s becong ore sgnfcant and detrental. In a dstrbuted denal-of-servce (DDoS) attac, an adversary coprses a large nuber of hosts and uses the as zobes to generate large traffc flows aganst a target host. By consung the vct s resources, such as coputatonal power, eory usage, and networ bandwdth, the attacer can severely degrade or copletely deny noral servces [1]. Attac traffc ay coprse of SY pacets, ICMP pacets, or other 1 types of pacets [2][3]. owadays, any well-nown webstes, such as Yahoo! and Aazon, are under the threat of DDoS attac, resultng n llons of dollars n daage. The proble of DDoS stes fro the nature of the IP protocol desgn [4]. Because the IP protocol routes pacets by the destnaton address n the IP header wthout regard to the source address, an adversary ay nsert any address n the source address feld. Dependng upon the requested servce, the vct ay allocate resources for a host that s not expectng any servce. To cobat DDoS attacs, RFC 2827 [5] proposed ngress flters to chec that nbound traffc orgnates fro a vald IP address of an authorzed networ. Researchers have also suggested varous IP tracebac ethods, such as -trace [6], pacet loggng [7][8] and pacet arng [9][10][11], to detect the source of the attacs. In the -trace approach, Bellovn utlzes the ICMP pacet to probablstcally send tracebac nforaton. Unfortunately, routers frequently bloc ICMP essages because of ther securty rss. Pacet loggng requres extra storage overhead n routers along the route path to store tracebac data. In contrast, pacet arng utlzes the 16-bt ID feld of the IP header to save tracebac nforaton. Due to the lted aount of avalable bts n the header, pacet Ths wor was supported n part by atonal Scence Councl under the grants SC E

2 Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh arng schees probablstcally ar pacets wth partal tracebac nforaton. Therefore, the vct ust receve a suffcent aount of pacets to accurately reconstruct the attac path. To succeed n the wreless envronent, however, these schees requre odfcatons to adapt to the oblty of nodes. Wreless networs consst of nfrastructure ode and ad-hoc ode. In the nfrastructure ode, the wreless nodes connect drectly to the access pont (), whch acts as a edator between the wred and wreless networ. Conversely, nodes self-organze n the ad-hoc ode to create routng paths wth neghborng nodes. Dependng upon how ad-hoc routng protocols antan basc routng nforaton, they can be dvded nto proactve routng and reactve routng. Proactve routng protocols perodcally update the routng table even f there s no networ traffc. In contrast, reactve routng protocols only create routng paths as needed. Dynac Source Routng (DSR) [13] s a reactve routng protocol that eeps the full routng path n the header. Thus, nteredate nodes can forward pacets wth the header nforaton. Wth the growth of wreless devce usage and the ncrease n wreless bandwdth, adversares ay opt to generate attacs fro the wreless ad-hoc networ. The ablty to perfor IP tracebac n an adhoc networ wll becoe ore portant. Huang and Lee [14] developed a tracebac schee for adhoc networs based upon the SPIE schee [7]. SPIE aes use of a specal data structure, a bloo flter [15], to reduce the pacet loggng overhead on each router. Slarly, Huang and Lee s schee utlzes a tagged bloo flter, whch decreases the data overhead used to construct the ln graph. Wth the ln graph and neghbor lst, they can detect and locate a hotspot. In desgnng a tracebac schee, we want the ablty to trace an attac pacet to ts source n the adhoc networ. Snce nteredate and alcous nodes wthn the wreless networ can on, leave, or ove around, we would le our schee to be able to contnue tracng the attacer. That s, we would not consder that node as a new attacer. To the best of our nowledge, ths s the frst paper that acheves these goals. We organze the reander of ths paper as follows. In the next secton we elaborate on the networ archtecture and attac odel. ext, we descrbe our proposed schee n Secton 3 and evaluate ts ablty to detect attacers n Secton 4. Fnally, we conclude our fndngs n Secton Prelnares Before we begn, we dscuss our networ archtecture, assuptons, and threats. As depcted n Fgure 1, we focus on the attac odel n whch an adversary wthn an ad-hoc networ executes a DDoS attac aganst a reote server. When the server s Intruson Detecton Syste detects a DDoS attac, t ntates an IP tracebac on the wred networ to fnd the gateway. There exsts nuerous tracebac ethods [7][8][9][10][11] that can deterne the attac route fro the server to the end. To ferret out the adversary, the then perfors a trace on the wreless networ by utlzng our proposed schee. Our ethod eploys a cobnaton of loggng and pacet arng, whch t sends out of band (ICMP) to avod nterference wth tradtonal wred tracebac. To access the nternet n a wreless ad-hoc networ, one node acts as an and forwards pacets on behalf of eber nodes. Thus, ths node, whch we refer to as the, provdes a brdge between the wred and wreless doans. Our ad-hoc networ pleents the Dynac Source Routng (DSR) protocol to route essages aongst eber nodes. 162

3 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 Vct Ad-hoc etwor Attacer Assuptons Fgure 1. Archtecture We ae the followng assuptons: The ust possess enough coputaton, storage, and energy resources to perfor loggng and tracebac servces. The cannot be coprosed. Snce the handles loggng operatons, an under the control of an adversary cannot provde useful tracebac nforaton. Interedate nodes wthn the ad-hoc networ can be coprosed. Adversares ay change locatons wthn the ad-hoc networ or assocate wth other networs Threats An adversary ay attac the networ wth a varety of ethods. In the splest approach, the adversary captures a node and proceeds wth a DDoS attac aganst the server. In addton, the adversary ay nsert randoly generated source IP addresses nto attac pacets. Furtherore, the attacer ay relocate wthn ad-hoc networ to alter the routng path. 3. Wreless IP tracebac Schee We propose an IP tracebac schee (WTrac) to locate oble attacers n an ad-hoc networ. Frst, we descrbe how to create a Route Graph Hstory table. ext we show how an ars pacets. Last, we detal the process of how we tracebac oble adversares Routng Graph Hstory To pnpont attacers n a wreless networ, we need to deal wth the oblty ssues. When an receves a notce fro a vct s IDS, the wreless networ topology changes when a vct s under attac. Thus, we ntroduce Route Graph Hstory (RGH) to log the changes of the networ topology. Wth an s RGH table, we can have a snapshot of the networ topology when alcous pacets nvade the wreless networ. In the followng paragraphs we wll detal how to create a RGH table. In a dstrbuted syste, te synchronzaton s vtal n ensurng the transacton agreeents and events between nodes. However, te synchronzaton of all nodes requres hgher costs. To loosely synchronze te n a dstrbuted syste, we propose a RECORD_ROUTE() schee to collect the records and establsh a vrtual cloc T that represents the th change of the networ topology n an. 163

4 Te Sta p Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh Algorth RECORD_ROU TE() : Assuethe Current Testap at thes T P(, LR ) RGH(, LT ) CT T IF ( P(, LR ) or P(, LR ) P(, R ) ){ CT T 1 } IF(RGH(, CT) ){ RGH(, CT) P(, R )} Our ad-hoc networ odel contans n nodes, 2,, n wth access to the nternet through a gateway. LR ={LT 1, LT 2,,LT n } represents a lst of last updated testaps for node. P(,R ) sybolze the routng path startng fro th node that goes through route R to the, where R conssts of an ordered set of nodes. When the receves a pacet orgnatng fro at T, t checs whether the last updated path of node dffers fro the new pacet s path. If P(,R ) changes or does not exst, then the ncreases the vrtual cloc T to T +1 and records the new path P(,R ) wth the odfed testap T +1 n RGH(, T +1 ), where RGH(, T +1 ) eans -th colun and +1-th row n RGH table; otherwse, the cloc antans the sae value and the adds the unchanged path wth the current cloc P(,R ) to the RGH(, T ). ote that actual te ntervals between testaps are not necessarly the sae. That s, testap changes only when a route changes. T 4 T 3 P( 1,R 1) P( 2,R 2) P( 3,R 3) P( 2,R 2) T 3 P( 1,R 4) P( 2,R 2) P( 3,R 3) T 4 T 2 T 2 T 1 T 1 T 0 T Physcal Te(sec ) Fgure 2. Elapse of Testap on an Fgure 2 shows an exaple of antanng testap on an. Intally, testap s set to T 0. As Fgure 3(a) shows, when receves the frst pacet orgnatng fro at 2sec, t ncreases the testap to T 1 and records the path P(,R 1 )={,,, }on RGH table (Frst row of Table 1). Snce the node dd not sends any pacets to ths before recevng pacet P(,R 1 ). As Fgure 3(b) shows, the receves second pacet P( 2, R 1 ) at 4.5sec. Although the route fro 2 s sae wth the prevous route fro, the needs to ncrease the vrtual cloc to T 2 and records the path P( 2,R 1 )={ 2,,, } on RGH table. Snce the s RGH does not contan a prevous route for 2. It follows the sae procedure for the thrd pacet fro node 3 respectvely. For the fourth pacet fro node 2, the deternes the path of ths pacet s equvalent to the last updated path P( 2,R 2 ). Thus, t does not ncrease the vrtual cloc at T 3 ; however, the ust log ths path P( 2,R 2 ) snce ths route does not exst n the RGH table at te T 3. As Fgure 3(d) shows, when the receves the ffth pacet fro, t ncreases the testap to T 4 because the last updated 164

5 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 route of node,.e. R 1 ={,, }, s dfferent fro route R 4 ={, }, and records the path P(,R 4 ) on RGH table. Fnally, the log of pacets receved by ths s llustrated n Table 1. Table 1. Exaple RGH table ode Te 2 3 T 1 P(,R 1) T 2 P( 2,R 2) T 3 P( 2,R 2) P( 3,R 3) T 4 P(,R 4) P( 2,R 2) P( 3,R 3) We defne the graph G as the set of all routng paths durng te T. Thus, G { RGH ( 1, T ) RGH ( 2, T ) RGH ( n, T )} s the networ topology at te T. Fgure 3 shows exaples of networ topology constructed by usng the records of RGH table. On the thrd row of the table, two dsont paths are recorded at T. And the networ topology s drawn accordngly as Fgure 3(c) shows. At T 4, node follows dfferent route to send a pacet to the, and nodes 2 and 3 follow dentcal routes as before to route pacet to the. Then, the networ topology on the at T 4 wll loo le Fgure 3(d). Intally, the networ wll experence ore updates and changes to the global cloc as the populates the epty RGH table wth routng paths. When the networ stablzes, there should be fewer updates. odes whose routng paths rean null for an extended perod of te ay have left the networ. Durng an attac, however, the wll have to go through any updates as the adversary oves on the networ or spoofs any source routes. If we try to trace DDoS attacers fro vct to, we need to ar the pacet on an (a) (b) Fgure 3. Hstory etwor Topology n an (a) At testap T 1 (b) At testap T 2 (c) At testap T 3 (d) At testap T Pacet Marng Snce the extracts the source route fro each pacet s DSR header, t has a coplete vew of the ad-hoc networ s topology. However, forwardng a coplete source route to the server durng noral operatons s neffcent. To reduce networ bandwdth, the generates a hash to ar a pacet. The sends the pacet s ared data (MD) to the server wth the orgnal pacet out of band. The reason we send the MD out of band s to prevent the MD fro beng erased by wred tracebac ars. (c) (d) 165

6 Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh MD relates a pacet wth ts routng path and testap. It contans the pacet s testap, a hash of ts routng path, and a hash of the pacet s payload. That s, MD T HASH( RGH (, T ) ) HASH( Payload ), where s a strea concatenaton operator. The ar ncludes three parts and the frst s a testap, whch helps the recever now when the receves ths pacet. The second s the hash value of the wreless routng path, helpng the vct trace fro the to the attacer. The thrd part of the pacet ncludes ts hash value. Snce the ar s sent out of band, the hash value s used to connect attac pacet and the ar. As we assue the attac to be DDoS, the false postve can be elnated as ore and ore pacets coe n. We, therefore, recoend the dgest of pacet use the pacet header and soe bytes of payload as the nput of a unversal hash table. When the server receves the MD, t should retan the nforaton for a lted aount of te. For edate loo-up, the server puts the MD n a hash table, usng the payload hash as the ndex, and the testap and routng path hash as the value. Once detectng a DDoS attac, the server returns the MD to the, so that t can hunt down the attacer accordngly Moble Attacer Tracebac Schee When an adversary ntates a DoS attac on a server fro wreless ad-hoc networ, the adversary ay nsert randoly generated source IP addresses nto the attac pacets and then relocate wthn adhoc networ to alter the routng path. Therefore, the attac traffc that coes fro dfferent places could be launched by the sae attacer. If a tracng algorth cannot recognze the attac traffc whch probably coes fro the sae attacer, a nuber of attacers wll be recorded on a server. Also, t wll be dffcult for a vct to dentfy the current locaton of an attacer. However, the conventonal tracng algorths that are desgned for wred networ cannot trace oble attacers. Hence, an algorth MERGE_PATH s ntroduced to trace oble attacers and dentfy two attac traffc that coes fro two dfferent places but ght be launched by sae attacer l Attacers Fgure 4. Attac graph of Spoofed IP address attac. Gray nodes are attac nodes notfed by vcts When the receves an attac notce, t utlzes the algorth MERGE_PATH() to verfy whether the attacer s new or has ust sply oved; therefore, t can reduce the nuber of suspected attacers because soe of the do coe fro the sae source. After recevng an attac notce, an extracts fro the notce the MD wth P(,R ) and T, and checs f t atches the entry n ts RGH table. Snce an adversary ay spoof the address of the last hop along the wred networ, a satch s possble. As a result, the sply dscards ths attac notce. On the contrary, f the MD has ever appeared n the RGH table, t eans the server has successfully located the orgnatng. Therefore, the coences a search for the attacer wthn ts networ. When the tracs down the attacer, t adds ths node to the Attacer Lst (AL), a log of all alcous nodes at each nterval. The antans and 166

7 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 forwards the lst to the server. AL={AL 1, AL 2, AL 3,, AL n }, where AL =(,T n ) s -th attac node and testap receved and recorded n the. The notaton AL _= represents the attac node of the record AL, and AL _T= T n represents the testap of the record AL. Furtherore, the MERGE_PATH() erges attacers by tracng oveent n the attac graph. An attac graph at te T, denoted AG, represents a partal graph of G. That s, AG RGH (, T ), RGH (, T ),, RGH (, T )}, where AL. { 1 2 n The constructed graph AG s loop free because DSR s a loop free routng algorth. If a spoofng tool nserts a randoly generated source IP address nto attac pacets, as depcted n Fgure 4, lots of attac nodes route ther traffc through the sae nteredate node. The proposed schee MERGE_PATH() erges any two alcous nodes fro te T and fro te T n f the two nodes have the sae parent n a tree structure, so as to verfy whether the attacs are launched by the sae adversary. Three attac odels and ther tracng exaples wll be detaled below. If an adversary does not spoof the source address of ts attac pacets, the can trace the adversary by followng the attac graph. Even though the attacer changes locatons, he ust execute DSR s route dscovery to fnd a vald path to the. Snce any change of routes fro the attac source s recorded on the RGH table, attacers can be located because of attac graph tracng. As prevous attacng notces are generated for the sae attacer, the can reove all those notces fro AL to reduce the lst s sze. For exaple, as Fgure 5(a) shows, when the receves a new attac notce fro a vct (Fgure 5(b)), we erge the orgnal attac graph AG wth the new attac path nto a new attac graph. Snce the ovng adversary s attacng a vct, the erged attac graph, see Fgure 5(c), shows the attac traffc s launched by the source node 1, whch oves fro ts neghborng node 0 to node. Then, the old 1 s no longer needed and wll be reoved fro the attac graph. After reovng the duplcated nodes, the attac graph s shown as Fgure 5(d). n (a) (b) (c) (d) Fgure 5. Exaple of erged attac graphs, the gray nodes are dentfed attacers. (a) The attac graph before new attac notce. (b) recevng an attac notce. (c) The attac graph after the attac notce. (d) Attac graph after the ergng of two attacers

8 Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh As for those attacers who spoof ther source addresses, the ust generate an attac graph (AG) after gettng an attac notce because attac traffc that coes fro dfferent sources ay be launched by the sae attacer. AG conssts of the erged set of all MD that the receves,.e. AG { AG1, AG2,..., AGn }. Snce the routng path ay change as nteredate nodes on, ove, or leave the networ, a routng loop ay happen when ergng attac graphs fro dfferent te ntervals. If there s a loop n an attac graph, a tracng algorth ay fall nto the loop and ae t dffcult for the algorth to trace the source of the attac traffc. In order to reove a loop fro a graph, a path has to be reoved fro the graph to eep the graph loop free. We wll defne the to-bereoved path n the followng. We assue two attac graphs AG at T and AG at T, where T <T. If a sequence of nodes { s, p, q,, r, e } exsts n the graph AG=AG AG, where nodes s and e exst n the attac graphs AG and AG. SubP (AG,AG )={ p, q,, r } s a set of nodes n AG, not n AG. SubP (AG,AG )={ p, q,, r } s a set of nodes not n AG but n AG. The nodes { s, p, q,, r, e } wll be a loop n the erged graph AG (a) (b) (c) Fgure 6. Exaple of reovng loops fro an attac graph. (a) The attac graph before new attac notce. (b) recevng an attac notce. (c) The attac graph after the ergng of two attac graphs. (d) The attac graph after reovng a loop fro the graph. 1 (d) Snce the traffc oves fro node e to node s, t wll not choose the route SubP (AG,AG ) at T ; nstead, t uses the alternatve path SubP (AG,AG ) to route pacets. Therefore, MERGE_PATH() reoves the path SubP (AG,AG ) fro the erged graph AG so as to reove the loop fro the graph AG AG. Thus, the MERGE_PATH() traces an attacer fro the root of a tree to leaf nodes to locate 168

9 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 the attacer. Fgure 6 exeplfes the reovng of a loop fro a erged attac graph. When an receves an attac notce, ts rout s shown n Fgure 6(b). Because the ovng of nteredate nodes, the routng path wll begn to change fro the last transsson. We fnd the erged graph has a loop {, 9, 20, 0, } as Fgure 6(c) shows. Also, the nodes that send essages through node 0 do not follow the routng sequence (0,, ). Instead, the essage wll follow the route (0, 20,9, ). Because the pacets do not route through nodes (0,, ), we can reove the unwanted path (0,, ) fro the graph. Besdes, the tracng algorth can trace the attacer on the new loop-free attac graph. Algorth MERGE_PATH : Let IF ( ( IF AL { uberofattacers uberofattacers 1 Dff IF ( AL AL ( uberofattacers 1} ELSE { AG be an attacng nodesent fro a vct AG, T P( P(, T uberofattacers uberofattacers 1 Whle ( IF (( AL ) RGH ){ ) AL (( Dff (( Dff (( Dff, R _, T uberofattacers uberofattacers 1 AL AL AL }} AL AL ( } dscard the notce AG, R, T ) ) ) ( P( AL and no atch){ n 1) and ( AL 1) and ( AL 2) and ( AL, T )} P(, R, R ) AL and ( n ) AG) SubP ( AG, P( _ - parent _ - parent- parent _ - parent- parent - parent- parent)))){ ) SubP ( AG P(, R )), R )) - parent))or n - parent)) or Snce the nodes n an ad-hoc networ can be coprosed by an adversary, these coprosed nodes wll be steppng stone for attacers. Soetes an attacer coproses a host n the ddle of ts routng path and uses the coprosed nodes to reove all tracng clues fro the transtted pacets. When MERGE_PATH() traces the source of attac traffc, t wll dentfy the attac node as alcous users steppng stone, and the attac node wll not be a leaf of the attac graph. If the routng path fro the real attacer to the steppng stone s steady, the attacer can hde hself behnd the steppng stone and our schee cannot locate h. Then, he wll be logged on the and dentfed as another attacer,.e. hs steppng stone actually, n the attac graph. n Fgure 6(a) exeplfes a steppng stone n an attac graph. In the prevous Moble Attacer Tracng Schee, we focus on sngle access pont tracebac. However, t s possble for a oble attacer to roa fro one to another. When an attacer roas between two s, they should exchange ther RGH records wth each other to antan the correctness of pacet transsson, le regstraton nforaton n Moble IP. That s to say the s able to now the address of the roang nodes. When an attacer tres to generate attac pacets fro one to another, the two s RGH should be cobned to trace the attacer. 169

10 Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh For nstance, when an attacer roas fro 1 to 2, the vct can get RGH 1 and RGH 2 fro the traced. However, the proble of dstrbuted RGH s that the two RGHs are not synchronzed. That s to say, when RGHs are not synchronzed, the only way to erge two attacers s to scan all the tables for nown attacers and te slces. Hence, when we exchange RGH 1 and RGH 2, the two s can synchronze the two RGHs by atchng the two tables T ax. Wth regular exchange of RGH 1 and RGH 2, we can create the appng of T ax for 1 and 2 respectvely. Then, we can lt the scan sze of the table and synchronze the two RGHs. Fgure 7 llustrates how two RGHs eep ther own counters and synchronze each other. Fgure 7. Two Route Graph Hstory and synchronzaton To trace an attacer, we can use the orgnal approach, but the scan range wll have to extend fro a table to two and the testaps for the two tables need to be reapped. For nstance, as llustrated n Fgure 7, after the reappng, we fnd: T 1 on RGH 1 T 2 on RGH 2 ; T 4 on RGH 1 T 4 on RGH 2 ; T 6 and T 8 on RGH 1 T 7 on RGH Sulaton We use the ns2 sulator [17] to test our schee s ablty n locatng an adversary. In general, we setup the sulatons wth the default wreless envronent confguraton for channel, propagaton, ln layer type, nterface queue type, Meda Access Control, and antenna. For the DSR agent, we confgure the flow state and send buffer. ext, we center the n our test grd and enable t to forward pacets to the. Then, we generate 50 oble nodes usng the ns2 s ndep-utls/cu-scengen/setdest and log DSR pacets wth CMUTrace. Every node s able to send vald UDP pacets to. Malcous nodes ay ove through the networ at a faster but reasonable rate. Interedate nodes ay ove along a routng path. In the frst sulaton, we deonstrate our schee s ablty to dentfy a oble DoS attac by ergng attac graphs even though nteredate nodes oves durng attacs. In Fgure 8, we fnd that the networ sze does not affect the accuracy of our schee when we verfy that the attac traffc sent fro dfferent locatons s, n fact, generated fro the sae source. Then, we dentfy those attacs as one and erge the nto one. By consderng networ of up to 50 nodes, we are able to erge 90% of all attac traffc launched by the sae attacers. 170

11 Probablty Probablty Probablty Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July nodes 4 nodes 3 nodes 2 nodes etwor Sze Fgure 8. Effect of networ sze We fnd that exanng a larger nuber of oved nteredate nodes yelds hgher ergng rate. Snce the ovng of nteredate nodes ae the change of networ topology, t provdes ore nforaton for us to analyze the oveent of an attacer nodes 30 nodes 40 nodes 50 nodes uer of Movng Interedate odes Fgure 9. Effect of ovng routers ext, we wll prove that our schee s able to detect spoofed source IP addresses. As llustrated n Fgure 10, we fnd that our schee can successfully trace over 99% of all randoly generated source IP addresses etwor Sze Fgure 10. Spoofed IP address detecton rate 171

12 Probablty Tracng Anonyous Moble Attacers n Wreless etwor Mng Hour Yang, Shuhpyng Sheh Fnally, we test f our schee yelds the correct nuber of attacers between te ntervals. That s, our schee wll not double count a ovng adversary even though t tres to spoof ts source address. Fgure 11 llustrates that our schee can successfully hunt down adversares wth 99% accuracy Spoof Rate 5. Concluson Fgure 11. True postve rate In ths paper, we ntroduce a tracebac schee for wreless networs runnng Dynac Source Routng. Copared to exstng tracebac schees, our ethod can trace an adversary to ts source, even f he changes locatons. Furtherore, our schee can deterne f a set of attac pacets orgnate fro the adversary. Our sulatons show that our schee can detect duplcate attacers wth 99% effectveness. 6. References [1] Vern Paxson, "An analyss of usng reflectors for dstrbuted denal-of-servce attacs," ACM Cop. Co. Revew, vol. 31, no. 3, 2001.Author1_ae, Author2_ae, Web Cachng and Replcaton, Addson-Wesley(Publcaton_ ae), USA, 2014 [2] Davd Moore, GeoRrey M. Voeler, and Stefan Savage, "Inferrng nternet Denal-of-Servce actvty," n In proceedngs of the 2001 USEIX Securty Syposu, 2001, pp [3] Mcrosoft Corporaton, "Stop 0A n tcpp.sys when recevng out of band(oob) data," [4] J. Postel, "Ineternet Protocol," RFC 791, IETF, Spe [5] Paul Ferguson and Danel Sene, "etwor ngress flterng: Defeatng denal of servce attacs whch eploy IP source address spoofng," RFC 2827, IETF, May [6] Steven M. Bellovn, "Icp tracebac essages," IETF Draft, 2000, [7] Alex C. Snoeren, Crag Partrdge, Lus A. Sanchez, Chrstne E. Jones, Fabrce Tchaounto, Beverly Schwartz, Stephen T. Kent, and W. Tothy Strayers, "Hash-Based IP Tracebac," n ACM SIGCOMM '01, August [8] Alex C. Snoeren, Crag Partrdge, Lus A. Sanchez, Chrstne E. Jones, Fabrce Tchaounto, Beverly Schwartz, Stephen T. Kent, and W. Tothy Strayers, "Sngle-Pacet IP Tracebac," IEEE/ACM Transactons on etworng, vol. 10, no. 6, pp , Deceber [9] Stefan Savage, DavdWetherall, Anna Karln, and To Anderson, "etwor Support for IP Tracebac," IEEE/ACM Transactons on etworng, vol. 9, no. 3, pp , June [10] Hal Burch and Bll Cheswc, "Tracng anonyous pacets to ther approxate source," In Proc. USEIX LISA '00, Deceber [11] D. X. Song and A. Perrg, "Advanced and Authentcated Marng Schees for IP Tracebac Messages," n Proc. IEEE Infoco '01, Aprl [12] C. Perns, "Ad hoc on deand dstance vector (aodv) routng,"

13 Internatonal Journal of Dgtal Content Technology and ts Applcatons Volue 4, uber 4, July 2010 [13] Davd B. Johnson, Davd A. Maltz, and Yh-Chun Hu, "The Dynac Source Routng Protocol for Moble Ad Hoc etwors (DSR)," IETF Draft, 2004, [14] Y and Huang and Wene Lee, "Hotspot-based tracebac for oble ad hoc networs," n WSe '05: Proceedngs of the 4th ACM worshop on Wreless securty, ew Yor, Y, USA, 2005, pp , ACM Press. [15] Burton H. Bloo, "Space/Te Trade-ORs n Hash Codng wth Allowable Errors," Councaton of ACM, vol. 13, no. 7, pp , July [16] J. Reynolds J. Postel, "TELET PROTOCOL SPECIFICATIO," RFC 854, IETF, May [17] Steven McCanne and Sally Floyd, "ns etwor Sulator," 173