Detection of Spoofing Attacks Using Intrusive Filters for DDoS

Internet hosts are threatened by large-scale Distributed Denial-of-Service (DDoS) attacks. The Path Identification DDoS defense scheme has recently been proposed as a deterministic packet marking scheme that allows a DDoS victim to filter out attack packets on a per packet basis with high accuracy after only a few attack packets are received. This paper proposes the Stack Path identification marking, a new packet marking scheme based on path identification, and new filtering mechanisms. The Stack Path Identification marking scheme consists of two new marking methods that substantially improve Path identifier's incremental deployment performance i.e., Stack-based marking and Write-ahead marking.