Tracing the Source of Network Attack: A Technical, Legal and Societal Problem

In the field of network defense, very little research is directed toward locating the source of network attacks. This paper models the technical aspects of attack traceback. By analyzing the model of attack traceback, two fundamental technical problems can be identified: determining the immediate source of packets (which may be disguised through IP spoofing) and determining causality for packets arriving at and issuing from a host. The past and on-going research efforts that either directly address or are applicable to attack traceback are tied to the traceback technical model, to show the extent to which they address the problem, and to highlight research gaps. The paper also discusses some of the legal and societal roadblocks to a technical solution