{'fraction_non_alphanumeric': 0.022630962041294743, 'fraction_numerical': 0.0017131007122892436, 'mean_word_length': 4.813417190775682, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Novel IP Traceback Scheme for Spoofing Attack

Internet has been widely applied in various fields, more and more network security issues emerge and catch people's attention. However, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks. For this reason, researchers have proposed a lot of trace back schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking. Others combine packet marking with packet logging and therefore create hybrid IP trace back schemes demanding less storage but requiring a longer search. In this paper, we propose a new hybrid IP trace back scheme with efficient packet logging aiming to have a fixed storage requirement for each router in packet logging without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction.


INTRODUCTION
A great amount of effort in recent years has been directed to the network security issues. In this paper, we address the problem of identifying the source of the attack. We define the source of the attack to be a device from which the flow of packets, constituting the attack, was initiated. This device can be a zombie, reflector, or a final link in a stepping stone chain. While identifying the device, from which the attack was initiated, as well as the person(s), behind the attack is an ultimate challenge, we limit the problem of identifying the source of the offending packets, whose addresses can be spoofed. This problem is called the IP traceback problem [1]. DOS attack scenario is shown in  Several solutions to this problem have been proposed. They can be divided in two groups. One group of the solutions relies on the routers in the network to send their identities to the destinations of certain packets, either encoding this information directly in rarely used bits of the IP header, or by generating a new packet to the same destination. The biggest limitation of this type of solutions is that they are focused only on flood-based (Distributed) Denial of Service [DoS] attacks [2], and cannot handle attacks comprised of a small number of packets. The second type of solutions involves centralized management, and logging of packet information on the network. Solutions of this type introduce a large overhead, and are complex and not scalable. IP traceback [3] is a name given to any method for reliably determining the origin of a packet on the Internet. Due to the trusting nature of the ip protocol, the source IP address of a packet is not authenticated. As a result, the source address in an IP packet can be falsified (IP address spoofing) allowing for Denial Of Service attacks (DoS) or one-way attacks (where the response from the victim host is so well known that return packets need not be received to continue the attack). The problem of finding the source of a packet is called the IP traceback problem. IP Traceback is a critical ability for identifying sources of attacks and instituting protection measures for the Internet. Most existing approaches to this problem have been tailored toward DoS attack detection. Such solutions require high numbers of packets to converge on the attack path(s). During the past decade, a lot of attention has been focused on the security of Internet infrastructure in place as being part of transmission, reception and storage of paramount importance within the increasing ecommerce applications. Yet, with high profile Distributed Denial-of Service (DDOS) attacks, numerous ways have been elaborated to identify the source of these attacks and one methodological approach is using IP traceback. The goal of IP traceback is to trace the path of an IP packet to its origin. The most important usage of IP traceback is to deal with certain denial-of-service (DoS) attacks, where the source IP address is spoofed by attackers. Identifying the sources of attack packets is a significant step in making attackers accountable. In addition, figuring out the network path which the attack traffic follows can improve the efficacy of defense measures such as packet filtering as they can be applied further from the victim and closer to the source. Two main kinds of IP traceback techniques have been proposed in two orthogonal dimensions: packet marking and packet logging. In packet marking, the router marks forwarded IP packets with its identification information. Because of the limited space in packet header, routers probabilistically decide to mark packets so that each marked packet carries only partial path information. The network path can be reconstructed by combining a modest number of packets containing mark. This approach is known as probabilistic packet marking (PPM). The PPM approach incurs little overhead at routers. But it can only trace the traffic composed of a number of packets because of its probabilistic nature [4]. In packet logging, the IP packet is logged at each router through which it passes. Historically, packet logging was thought to be impractical because of enormous storage space for packet logs. Hash-based IP traceback approach records packet digests in a space-efficient data structure, bloom filter, to reduce the storage overhead significantly. Routers are queried in order to reconstruct the network path. The information required to achieve traceback is either stored at different points (mostly on routers) along the path that a packet traverses or that path and usually other incidental paths are analyzed to gain information that will be used in traceback. It is this distinction that we employ to further divide network based schemes into packet logging schemes and network analysis schemes. The IP traceback [1,3] categories is shown in  LITERATURE SURVEY A great amount of effort in recent years has been directed to the network security issues. In this paper, we address the problem of identifying the source of the attack. Snoeren et al. [5] proposed a hash-based IP traceback approach, called Source Path Isolation Engine (SPIE), to realize log-based IP traceback in practice. Their approach reduces the storage overhead significantly through recording packet digests in a space-efficient data structure, a Bloom filter. SPIE has made a significant improvement on the practicality of log-based IP traceback. However, its deployment at high-speed networks has still been a challenging task due to the high storage overhead and access time requirement for recording packet digests.  [6], link testing [7], marking [8] and logging [9] ).We propose a new technique that uses Huffman codes to mark packets with router's information as packets traverse outers during the journeys to reach their destinations. Simulation results and practical issues are also presented.

III. METHODOLOGY 3.1. Current System
Most of current single packet traceback schemes tend to log packets' information on routers. Most current tracing schemes that are designed for software exploits can be categorized into three groups: single packet, packet logging and hybrid IP traceback . The basic idea of packet logging is to log a packet's information on routers.
The methods used in the existing systems include Huffman Code, Modulo/ Reverse modulo Technique (MRT) and MOdulo/REverse modulo (MORE). These methods use interface numbers of routers, instead of partial IP or link information, to mark a packet's route information. Each of these methods marks routers' interface numbers on a packet's IP header along a route. However, a packet's IP header has rather limited space for marking and therefore cannot always afford to record the full route information. So, they integrate packet logging into their marking schemes by allowing a packet's marking field temporarily logged on routers.
From this, it is found that these tracing methods still require high storage on logged routers. Apart from this, also found that, exhaustive searching is quite inefficient in path reconstruction. Drawbacks  In the existing system, adversaries often hide themselves by spoofing their own IP addresses and then launch attacks.  There is a lot of traceback schemes to trace the source of these attacks. Some use only one packet in their packet logging schemes to achieve IP tracking.  Others combine packet marking with packet logging and therefore create hybrid IP traceback schemes demanding less storage but requiring a longer search.  Taking longer search time and false positives is the main drawback of the existing system.

Proposed System and structure
In the proposed system, we provide a new hybrid IP traceback scheme with efficient packet logging aiming to have a fixed storage requirement for each router (under 320 KB, according to CAIDA's skitter data set) in packet logging without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction. The system structure is shown in Fig 3. Advantages  In the proposed system, a new hybrid IP traceback scheme is provided with efficient packet logging  The aim of packet logging is to have a fixed storage requirement for each router without the need to refresh the logged tracking information and to achieve zero false positive and false negative rates in attack-path reconstruction.  Packet's marking field is used to censor attack traffic on its upstream routers.  Possible extension is to explore an alternative approach to packet marking and logging for IP trace back.  with local area networks. Thus, a router can either receive data from the nearer router or from the local area network. A border router receives packets from its local network. A core router receives packets from other routers. The number routers connected to a single router is called as the degree of a router. This is calculated and stored in a table. The Upstream interfaces of each router also have to be found and stored in the interface table. This is shown in Fig 4.

Fig.4: Network topology construction Path Selection
The path is said to be the way in which the selected packet or file has to be sent from the source to the destination. The Upstream interfaces of each router have to be found and it is stored in the interface table. With the help of that interface table, the desired path between the selected source and destination can be defined. This is shown in  V. CONCLUSIONS In this paper, we propose a new hybrid IP traceback scheme (RIHT) for efficient packet logging aiming to have a fixed storage requirement in packet logging without the need to refresh the logged tracking information. Also, the proposed scheme has zero false positive and false negative rates in an attack-path reconstruction. Apart from these properties, our scheme can also deploy a marking field as a packet identity to filter malicious traffic and secure against DoS/DDoS attacks. Consequently, with high accuracy, a low storage requirement, and fast computation, RIHT can serve as an efficient and secure scheme for hybrid IP traceback.