Trace-back of Active Attack Flows
In this type of solution, an observer tracks an existing attack flow by examining incoming and outgoing ports on routers starting from the host under attack. Thus, such a solution requires having privileged access to routers along the attack path.
To bypass this restriction and automate this process, Stone proposes routing suspicious packets on an overlay network using ISP edge routers. By simplifying the topology, suspicious packets can easily be re-routed to a specialized network for further analysis.
This is an interesting approach. By nature of DoS, any such attack will be sufficiently long lived for tracking in such a fashion to be possible. Layer-three topology changes, while hard to mask to a determined attacker, have the possibility of alleviating the DoS until the routing change is discovered and subsequently adapted to. Once the attacker has adapted, the re-routing scheme can once again adapt and re-route; causing an oscillation in the DoS attack; granting some ability to absorb the impact of such an attack.
Read more about this topic: IP Traceback
Famous quotes containing the words active, attack and/or flows:
“So hills and valleys into singing break;
And though poor stones have neither speech nor tongue,
While active winds and streams both run and speak,
Yet stones are deep in admiration.
Thus praise and prayer here beneath the Sun
Make lesser mornings when the great are done.”
—Henry Vaughan (1622–1695)
“The small perplexities of small minds eddy and boil about you. Confident from the experience that has led you out of these same dangers, you attack each problem as it appears, unafraid.”
—Alice Foote MacDougall (1867–1945)
“The blood of Abraham, God’s father of the chosen, still flows in the veins of Arab, Jew, and Christian, and too much of it has been spilled in grasping for the inheritance of the revered patriarch in the Middle East. The spilled blood in the Holy Land still cries out to God—an anguished cry for peace.”
—Jimmy Carter (James Earl Carter, Jr.)