Implementation of Stack-PI, A Defense Mechanism for DDOS Attack and IP-Spoofing

Internet has become a very important tool in today’s world. It has become the key for all interactions in every field. But unfortunately, evolution to the use of internet to its full extent has been compromise due to the threats to security. In particular, one of the major threat to the Internet is composed of Denial of Service Attacks. A Distributed Denial of Service attack uses many computers to launch a coordinated Denial of Service attack against one or more targets. Therefore a new packet marking scheme, Stack-Pi, has been proposed. In Pi (Path Identifier) approach, a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the same paths through the Internet on a per packet basis, regardless of source IP address spoofing. This allows the victim to take a proactive role in defending against a DDoS attack by using the Pi mark to alter out packets matching the attackers identifiers on a per packet basis. In Stack-Pi a new packet marking scheme based on Pi, and new filtering mechanisms is used. The Stack-Pi marking scheme consists of two new marking methods that substantially improve Pi’s incremental deployment performance: Stack-based marking and Write-ahead marking. This scheme almost eliminates the effect of a few legacy routers on a path, and performs 24 times better than the original Pi scheme in a sparse deployment of Pi-enabled routers. The project aims at proposing the implementation details and basic algorithms for stack-pi, a defense mechanism for DDoS attack under the presence of few Legacy routers on the path. The attack is modeled in two phases as Training phase and Defense phase.