NET-Tracker: A Service Oriented IP State Traceback for Inter Autonomous Systems

IP state traceback is a necessary emergency incident response technology, which can help Internet Service Providers (ISPs) to capture the footprint of any traveled IP flow at the Autonomous System (AS) level and reconstruct inter-AS routing path to locate the source. To do this, it requires each AS to establish the routing state fingerprints for as many flows as possible. However, when taking the autonomy of AS, its limited flow processing capability and routing state privacy into consideration, existing schemes suffer the following drawbacks: lack of economic incentives for adoption, lower traceback accuracy and routing fingerprint leakage. For this, we propose NET-Tracker, a service oriented IP state traceback. In NET-Tracker, we adopt blockchain oracle technique to build an inter-AS traceback service trading platform, which can allows the requester to automatically and securely complete fingerprint transaction with participating ASes. And this well addresses the economic issue for its practical deployment. Moreover, with the restriction of fingerprint generation capacity on routers, we devise an AS-level fingerprint establishment optimization algorithm to maximize the fingerprints established in each AS, and thus improve the overall traceback accuracy. Furthermore, considering that the attackers may exploit the blockchain feature of open and transparent transaction to initiate variety of strategic attacks, we devise a privacy-preserving protocol for NET-Tracker. We have conducted the rigorous theoretical analysis and the extensive simulation experiments based on real-world topology to evaluate the performance. The results show that its traceback accuracy could be well anchored at levels close to 97%.