IP Traceback presentation by muhammad Ibrahim.pptx

This is my MS computer science presentation in UOB

1. Name : Muhammad Ibrahim Subject : Network Security Session : 2022 – 2024 Deptt : Computer Science University of Balochistan Final Presentation of Network Security

2. IP Traceback DDoS disable the server by flooding invalid requests with invalid or spoofed addresses Due to this the server’s buffer gets overloaded and bandwidth of server get exhausted and server stop its services Some prevention techniques which can detect these types of attack IP Traceback is a DDoS detection technique, which is used to trace the path of an IP packet to its origin so one can find out the true identity of the attacker and can detect the path characteristics.

3. DDoS is the complicated version of DoS. DDoS attacks deny regular Internet services from being accessed by legitimate users Either by blocking service completely or by disturbing it such that users become not interested in the service anymore. Simple but powerful attack An attacker uses spoofed source address Difficult to detect the DDoS attack traffic Because attacker generally hides their identity

4. How DDoS attack Launch The attacker(s) first establishes a network of computers that will be used to generate the huge volume of traffic needed to deny services to legitimate users of the victim. To create this attack network, attackers discover vulnerable hosts on the network. Vulnerable hosts are those that are either running no antivirus or out-of-date antivirus software, or those that have not been properly patched. These are exploited by the attackers who use the vulnerability to gain access to these hosts.

5. The next step for the attacker is to install new programs (known as attack tools) on the compromised hosts of the attack network. The hosts running these attack tools are known as zombies, and they can be used to carry out any attack under the control of the attacker Numerous zombies together form an army or botnet. In a typical DDoS attack, the master computer orders the zombies to run the attack tools to send huge volume of packets to the victim, to exhaust the victim’s resources

6. Three main classes of DDoS attacks Bandwidth/Throughput Attacks Ping Flood Attack (ICMP echo) SYN Flood Attack (DoS attack) UDP Flood Attacks Amplification Attack Smurf Attack Protocol Attacks DNS Name Server Attack Software Vulnerability Attacks Land Attack Ping of Death Attack Fragmentation Attack and Teardrop Attack

7. To prevent these attacks, Different types of IP Traceback techniques are used Link Testing Input Debugging Controlled Flooding: Packet Marking Probabilistic Packet Marking Deterministic Packet Marking ICMP Traceback Hybrid Schemes

8. Link Testing Link testing starts from the victim and traces till the attack source via upstream links with the assumption that the attack remains active until the completion of the trace. It determines the upstream of attacking traffic hop-by-hop while the attack is in progress. Two variants of link testing are Input Debugging Controlled Flooding Packet Marking Probabilistic Packet Marking Deterministic Packet Marking ICMP Traceback Hybrid Schemes