A Feasible IP Trace back Framework through Dynamic Deterministic Packet Marking
Abstract: DDoS attack source trace back is an open and challenging problem. Deterministic Packet Marking (DPM) is a simple and effective trace back mechanism, but the current DPM based trace back schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for trace back purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on Demand (MOD) trace back scheme based on the DPM mechanism. In order to trace back to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request an unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from
attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based trace back schemes. We establish a mathematical model for the proposed trace back scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed trace back method is feasible and effective. Existing system: The massive connectivity with sporadic traffic pattern, however, makes traditional scheduling challenging. This inspires the recent grant-free non-orthogonal user access scheme, where each device is pre-assigned with a unique non-orthogonal pilot sequence and the access point determines which devices are active by jointly detecting the received pilot sequences. As only a small portion of the massive potential devices are active, the activity detection by nature is a large-scale sparsity constrained problem. To overcome this challenge, user activity detection was firstly considered by assuming that the channel of each user is known. Later jointly performed user detection and channel estimation. In, non-coherent user detection was proposed so that channel estimation can be avoided. Proposed system: Mathematical point-of-view, the nonlinear coupling between the frequency offsets and channels further introduces non-convexity to the already challenging largescale sparsity constrained problem. This extra non-convexity makes ADMM and the approximate message passing algorithm in not applicable in the current scenario. In this paper, activity detection is performed under unknown frequency offsets and channels. Two methods are proposed, both of which do not involve Hessian computation, making their complexity orders linear with respect to the variable number. For the first method, after adopting the Lasso based regularization, the resultant large-scale nonconvex problem is decomposed into a sequence of small-scale sub problems. Advantages: The massive connectivity with sporadic traffic pattern, however, makes traditional scheduling challenging. This inspires the recent grant-free non-orthogonal user
access scheme, where each device is pre-assigned with a unique non-orthogonal pilot sequence and the access point determines which devices are active by jointly detecting the received pilot sequences. As only a small portion of the massive potential devices are active, the activity detection by nature is a large-scale sparsity constrained problem. To overcome this challenge, user activity detection was firstly considered by assuming that the channel of each user is known. Disadvantages: Recently, adopt Lasso based regularization to induce the sparsity and then apply alternating direction method of multipliers (ADMM) algorithms to solve the resultant large-scale convex problems. On the other hand, adopts a Bayesian approach where the sparsity is modeled as the prior distribution of the channel and then an approximate message passing algorithm is applied. Interestingly, both ADMM and approximate message passing algorithms are first order methods, which are Hessian-free. Modules: Alternating direction method of multiplier: Jointly performed user detection and channel estimation. In, non-coherent user detection were proposed so that channel estimation can be avoided. Recently, adopt Lasso based regularization to induce the sparsity and then apply alternating direction method of multipliers (ADMM) algorithms to solve the resultant largescale convex problems. On the other hand, adopts a Bayesian approach where the sparsity is modeled as the prior distribution of the channel and then an approximate message passing algorithm is applied. Interestingly, both ADMM and approximate message passing algorithms are first order methods, which are Hessian-free. But this should not come as a surprise since computing the Hessian and its inverse is a major hurdle for large-scale problems, and should be avoided. Block coordinates: The block coordinate descent (BCD) framework, and the activity of each device is detected sequentially. While Lasso is a standard approximation to tackle sparsity
constrained problems, its detection performance loss compared to directly solving the original sparsity constrained problem is still unknown. Moreover, the sequential nature due to the BCD framework may limit the potential of leveraging the modern multi-core architecture for parallel computation. To this end, as the second method, a parallel algorithm that directly solves the original sparsity constrained problem is proposed. Specifically, we construct a sequence of separable upper bound problems for the original problem and then solve these upper bound problems in the majorization-minimization (MM) framework. Due to the judicious construction of each separable upper bound problem, activities of all devices are detected in parallel.
Space – alternating generalized expectation – maximation: Therefore, by updating sequentially, the Lasso based method is obtained and summarized Algorithm. Since the cost function of problem is continuously differentiable over the separable, compact, and convex constraints, and in each update the optimal solution to the k-th sub problem (7) is given by (9) and (8), every limit point of the sequence of solutions generated by Algorithm 1 is a stationary point of problem (6). Since Algorithm 1 involves only first-order differentiation, and the K groups of variables are decoupled in the BCD framework, its complexity order is dominated by O(KMLQ), which is due to the search of frequency offset in line 5 of Algorithm 1, with Q being the onedimensional search size. Furthermore, notice that when, Algorithm 1 reduces to the space-alternating generalized expectation-maximization (SAGE) for the conventional frequency offset and channel estimation. Therefore, not only does Algorithm 1 represent a generalization of SAGE algorithm to include sparsity property, but also the derivation using the BCD framework is much simpler than that of the original SAGE. Hierarchical lasso: Since the activity detection problem can be transformed Into a two-layer sparsity problem as shown in, we further provide the simulation results of Hierarchical
Block Orthogonal Matching Pursuit (HBOMP) and Hierarchical Lasso (HiLasso) for tackling the two layers of sparsity illustrates the probability of detection (PD) versus the number of devices K, where the probability of false alarm (PF) is fixed as 0.03. It can be seen that while the PD of different schemes in general decreases as K increases, the proposed Algorithm 3 achieves the highest PD, which is above 95% for a wide range of device numbers. Furthermore, HBOMP performs well (close to Algorithm 3) when the number of devices K _ 300. However, as K further increases, the performance gap between HBOMP and Algorithm 3 is dramatically enlarged, since HBOMP belongs to the class of greedy algorithms, which are in general less accurate than optimization based algorithms.