Paper review: Hash-Based IP Traceback

Reviewer: Mike Liu

  1. State the problem the paper is trying to solve.
  2. The main problem the paper is trying to solve is how to reliably identify the originator of an IP packet.
  3. State the main contribution of the paper: solving a new problem, proposing a new algorithm, or presenting a new evaluation (analysis). If a new problem, why was the problem important? Is the problem still important today? Will the problem be important tomorrow?  If a new algorithm or new evaluation (analysis), what are the improvements over previous algorithms or evaluations? How do they come up with the new algorithm or evaluation? 
  4. The main contribution of this paper is that it proposes an efficient and scalable hash-based technique for IP traceback. This is a solution to a relatively new problem and it is rather important in the present day because as the Internet becomes more and more ubiquitous, a myriad of new safety concerns arises. Today's Internet infrastructure is extremely vulnerable to motivated and well-equipped attackers. The problem will continue to be important as the Internet becomes more widespread and offers more and more services.
  5. Summarize the (at most) 3 key main ideas (each in 1 sentence.) 
  6. The three 3 key main ideas are: (1) The authors have developed a Source Path Isolation Engine (SPIE) to enable IP traceback, the ability to identify the source of a particular IP packet given a copy of the packet to be traced, and its destination, and an approximate time or receipt, and have also enabled it to trace packets through valid transformations, either from packet encapsulation or packet generation. (2) Historically, tracing individual packets has required prohibitive amounts of memory; one of SPIE's key innovations is to reduce the memory requirement (down to 0.5% of link bandwidth per unit time) through the use of Bloom Filters. (3) To determine the optimum amount of resources to dedicate to SPIE on an individual router or the network as a whole, you work with resource requirements given by the number of packet digest functions and the amount of memory used to store packet digests, to get the performance is measured by the length of time for which packets digests are kept and the accuracy of the candidate attack graphs; the more memory available for storing packet digests, the long the time queries can be issued; digest table with lower false-positive rates yield more accurate attack graphs.
  7. Critique the main contribution
  8. What lessons should researchers and builders take away from this work. What (if any) questions does this work leave open?
  9. The lessons that researchers should take away from this work are that it is possible to build an efficient, scalable, and implementable system for IP traceback and it has been done despite the seeminly large memory requirements. The potential memory requirent roadblock can be overcome using Bloom Filters and this system can continue to be effective for tracing packets, even those that undergo transformations.