Zubair Md. Fadlullah

Additionally, the encrypted attack-traffic makes tracing the source of the attack substantially more difficult. We have also addressed these issues and devised a traceback mechanism to track back attackers against encrypted protocols. In our efforts to combat attacks against cryptographic protocols, we have integrated a traceback mechanism at the monitoring stubs (MSs), which we previously introduced in detecting the attacks. While we previously focused on strategically placing monitoring stubs to detect attacks against encrypted protocols, in this work we aim in equipping the MSs with a traceback feature. In our approach, when a MS detects an attack, it starts tracing back to the root of the attack. The traceback mechanism relies on monitoring the extracted features at different MSs, i.e., in different points of the target network. At each MS, the monitored features over time provides a pattern which is compared or correlated with the monitored patterns at the neighboring MSs. A high correlation value in the patterns observed by two MSs indicate that the attack traffic propagated through the network elements covered by these MSs. Based on these correlation values and prior knowledge of the network topology, we can then construct a path back to the attacking hosts.

My next focus is to make a more robust detection and traceback scheme, all integrated into the MSs.