Design and implementation of a real-time decentralized source identification system for untrusted IP packets

DECIDUOUS is a security management framework for identifying the "true" sources of network-based intrusions. As in IPv4, normally the source IP address field of an IP packet is untrusted. Therefore, DECIDUOUS utilizes the IPSec security associations as "trapdoors" to derive possible network paths that an attack packet has traveled to reach the target victim. In (Chang et al., 1999), we illustrated the architecture and design of the DECIDUOUS framework. In this paper, we describe our prototype implementation and experimental results.