A global marking scheme for tracing cyber attacks

ABSTRACT

Tracing complex attacks is among the research topics that are currently under development. Limiting tracing to network traffic has allowed the reconstruction of the attack paths of a few attacks, but appears to be insufficient to trace complex attacks. In this paper, we propose a new tracing scheme that extends marking to additional malicious activities related to system running processes and modification actions operated at the host level, making use of compromise independent disk based components. These components are involved in the marking and the tracing process. The behavior of the new scheme for marking and tracing is illustrated against a sample attack scenario that integrates several techniques in order to increase the complexity of the attack. Our scheme plays an important role in investigation and provides evidences that help an investigator determining the attacker and the actions he performed.

REFERENCES

• 1: Belenky, A., and Ansari, N. IP Traceback with Deterministic Packet Marking. In IEEE COMMUNICATIONS LETTERS (2003), vol. 7.
• 2: Djemaiel, Y., Rekhis, S., and Boudriga, N. Cooperative Intrusion Detection and Tolerance System. In Proceedings of 12th IEEE International Conference on Electronics, Circuits and Systems (ICECS 2005). (Tunis, Tunisia, December 2005), pp. 279--283.
• 3: Djemaiel, Y., Rekhis, S., and Boudriga, N. Marking and investigating communication traffic: an adaptive and selective scheme. In WSEAS TRANSACTIONS on COMMUNICATIONS journal (Athens, Greece, July 2005), vol. 4, pp. 469--477.
• 4: Jin, G., and Yang, J. Deterministic packet marking based on redundant decomposition for ip traceback. In IEEE COMMUNICATIONS LETTERS (March 2006), vol. 10, pp. 204--206.
• 5: Yi-Nan Jing , Peng Tu , Xue-Ping Wang , Gen-Du Zhang, Distributed-Log-based Scheme for IP Traceback, Proceedings of the The Fifth International Conference on Computer and Information Technology, p.711-715, September 21-23, 2005 [doi>10.1109/CIT.2005.99]
• 6: Stefan Savage , David Wetherall , Anna Karlin , Tom Anderson, Network support for IP traceback, IEEE/ACM Transactions on Networking (TON), v.9 n.3, p.226-237, June 2001 [doi>10.1109/90.929847]
• 7: Alex C. Snoeren, Hash-based IP traceback, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.3-14, August 2001, San Diego, California, United States

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)
      C.2.3 Network Operations

General Terms:
Algorithms, Security

Keywords:
digital investigation, global marking, malicious activity, security attack