{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T17:32:44Z","timestamp":1791912764633,"version":"4.3.4"},"reference-count":44,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,12,22]],"date-time":"2022-12-22T00:00:00Z","timestamp":1671667200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>In the recent past, Distributed Denial of Service (DDoS) attacks have become more abundant and present one of the most serious security threats. In a DDoS attack, the attacker controls a botnet of daemons residing in vulnerable hosts that send a significant amount of traffic to flood the victim or the network infrastructure. In this paper, a common type of DDoS attacks known as \u201cTCP SYN-Flood\u201d is studied. This type of attack uses spoofed Internet Protocol (IP) addresses for SYN packets by exploiting the weakness in Transmission Control Protocol (TCP) 3-Way handshake used by the TCP\/IP suite of protocols, which make the web servers unreachable for legitimate users or even worse, it might lead to server crash. In this paper, a resilient, efficient, lightweight, and robust IP traceback algorithm is proposed using an IP tracing packet for each attack path. The proposed algorithm suggests that edge routers\u2014where the attack starts from\u2014observe the traffic pattern passing through, and if the observed traffic carries the signature of TCP SYN-Flood DDoS attack and a high percentage of it is destined to a particular web server(s), it starts the tracing process by generating an IP trace packet, which accompanies the attack path recording the routers\u2019 IP addresses on the path between the attacker\/daemon and the victim, which can extract the path and react properly upon receiving it by discarding any SYN packets originating from that attacker\/daemon. To our knowledge, this is the first research that efficiently traces these kinds of attacks while they are running. The proposed solution has low computation and message overhead, efficient detection and tracing time, and converges in near optimal time. The results are validated using extensive simulation runs.<\/jats:p>","DOI":"10.3390\/s23010102","type":"journal-article","created":{"date-parts":[[2022,12,23]],"date-time":"2022-12-23T01:42:13Z","timestamp":1671759733000},"page":"102","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":14,"title":["RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks"],"prefix":"10.3390","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8218-8630","authenticated-orcid":false,"given":"Zakwan","family":"AlArnaout","sequence":"first","affiliation":[{"name":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6339-1502","authenticated-orcid":false,"given":"Nour","family":"Mostafa","sequence":"additional","affiliation":[{"name":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8273-5419","authenticated-orcid":false,"given":"Samer","family":"Alabed","sequence":"additional","affiliation":[{"name":"Biomedical Engineering Department, School of Applied Medical Sciences, German Jordanian University, Amman 11180, Jordan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3802-9445","authenticated-orcid":false,"given":"Wael Hosny Fouad","family":"Aly","sequence":"additional","affiliation":[{"name":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2221-2170","authenticated-orcid":false,"given":"Ahmed","family":"Shdefat","sequence":"additional","affiliation":[{"name":"College of Engineering and Technology, American University of the Middle East, Egaila 54200, Kuwait"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,12,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"97","DOI":"10.1016\/j.cose.2013.04.004","article-title":"From information security to cyber security","volume":"38","year":"2013","journal-title":"Comput. Secur."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1550147717741463","DOI":"10.1177\/1550147717741463","article-title":"A survey of distributed denial-of-service attack, prevention, and mitigation techniques","volume":"13","author":"Mahjabin","year":"2017","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_3","unstructured":"(2022, November 14). NETSCOUT Arbor Confirms 1.7 Tbps DDoS Attack|NETSCOUT. Available online: https:\/\/www.netscout.com\/blog\/asert\/netscout-arbor-confirms-17-tbps-ddos-attack-terabit-attack-era\/."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Maciel, R., Araujo, J., Dantas, J., Melo, C., Guedes, E., and Maciel, P. (2018, January 23\u201326). Impact of a DDoS attack on computer systems: An approach based on an attack tree model. Proceedings of the 2018 Annual IEEE International Systems Conference (SysCon), Vancouver, BC, Canada.","DOI":"10.1109\/SYSCON.2018.8369611"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1109\/COMST.2018.2870658","article-title":"DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications","volume":"21","author":"Praseed","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_6","unstructured":"Tandon, R. (2020). A Survey of Distributed Denial of Service Attacks and Defenses. arXiv."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Feng, Y., Li, J., and Nguyen, T. (2020, January 15\u201317). Application-Layer DDoS Defense with Reinforcement Learning. Proceedings of the 2020 IEEE\/ACM 28th International Symposium on Quality of Service (IWQoS), Hang Zhou, China.","DOI":"10.1109\/IWQoS49365.2020.9213026"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Guo, W., Xu, J., Pei, Y., Yin, L., and Jiang, C. (2021, January 14\u201323). LDBT: A Lightweight DDoS Attack Tracing Scheme Based on Blockchain. Proceedings of the 2021 IEEE International Conference on Communications Workshops (ICC Workshops), Montreal, QC, Canada.","DOI":"10.1109\/ICCWorkshops50388.2021.9473586"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Ranjan, S., Swaminathan, R., Uysal, M., and Knightly, E. (2006, January 23\u201329). DDoS-Resilient Scheduling to Counter Application Layer Attacks Under Imperfect Detection. Proceedings of the IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications, Barcelona, Spain.","DOI":"10.1109\/INFOCOM.2006.127"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Yatagai, T., Isohara, T., and Sasase, I. (2007, January 22\u201324). Detection of HTTP-GET flood Attack Based on Analysis of Page Access Behavior. Proceedings of the 2007 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing, Victoria, BC, Canada.","DOI":"10.1109\/PACRIM.2007.4313218"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Seufert, S., and O\u2019Brien, D. (2007, January 24\u201328). Machine Learning for Automatic Defence Against Distributed Denial of Service Attacks. Proceedings of the 2007 IEEE International Conference on Communications, Glasgow, Scotland.","DOI":"10.1109\/ICC.2007.206"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Yadav, S., and Subramanian, S. (2016, January 11\u201313). Detection of Application Layer DDoS attack by feature learning using Stacked AutoEncoder. Proceedings of the 2016 International Conference on Computational Techniques in Information and Communication Technologies (ICCTICT), New Delhi, India.","DOI":"10.1109\/ICCTICT.2016.7514608"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1","DOI":"10.17485\/ijst\/2016\/v9i27\/87872","article-title":"Anomaly based Real Time Prevention of under Rated App-DDOS Attacks on Web: An Experiential Metrics based Machine Learning Approach","volume":"9","author":"Prasad","year":"2016","journal-title":"Indian J. Sci. Technol."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Gagniuc, P.A. (2017). Markov chains: From Theory to Implementation and Experimentation, John Wiley & Sons.","DOI":"10.1002\/9781119387596"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Xu, C., Zhao, G., Xie, G., and Yu, S. (2014, January 10\u201314). Detection on application layer DDoS using random walk model. Proceedings of the 2014 IEEE International Conference on Communications (ICC), Sydney, Australia.","DOI":"10.1109\/ICC.2014.6883402"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1109\/TNET.2008.925628","article-title":"Monitoring the Application-Layer DDoS Attacks for Popular Websites","volume":"17","author":"Xie","year":"2009","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1109\/TNET.2008.923716","article-title":"A Large-Scale Hidden Semi-Markov Model for Anomaly Detection on User Browsing Behaviors","volume":"17","author":"Xie","year":"2009","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Xie, Y., and Yu, S.Z. (2006, January 20\u201324). A Novel Model for Detecting Application Layer DDoS Attacks. Proceedings of the First International Multi-Symposiums on Computer and Computational Sciences (IMSCCS\u201906), Hangzhou, Zhejiang.","DOI":"10.1109\/IMSCCS.2006.159"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Savage, S., Wetherall, D., Karlin, A., and Anderson, T. (2000, January 28). Practical Network Support for IP Traceback. Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, New York, NY, USA. SIGCOMM \u201900.","DOI":"10.1145\/347059.347560"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1109\/90.929847","article-title":"Network Support for IP Traceback","volume":"9","author":"Savage","year":"2001","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Liu, M., Liu, Y., Xu, K., He, L., Wang, X., Guo, Y., and Jiang, W. (2021, January 13\u201315). TAP: A Traffic-Aware Probabilistic Packet Marking for Collaborative DDoS Mitigation. Proceedings of the 2021 17th International Conference on Mobility, Sensing and Networking (MSN), Exeter, UK.","DOI":"10.1109\/MSN53354.2021.00076"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"2470","DOI":"10.1109\/TIFS.2019.2899247","article-title":"Reliable Detection of Interest Flooding Attack in Real Deployment of Named Data Networking","volume":"14","author":"Nguyen","year":"2019","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Ouffoue, G., Ortiz, A.M., Cavalli, A.R., Mallouli, W., Domingo-Ferrer, J., Sanchez, D., and Zaidi, F. (2016, January 27\u201330). Intrusion Detection and Attack Tolerance for Cloud Environments: The CLARUS Approach. Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems Workshops (ICDCSW), Nara, Japan.","DOI":"10.1109\/ICDCSW.2016.27"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Yin, Z., Li, K., and Bi, H. (2022). Trusted Multi-Domain DDoS Detection Based on Federated Learning. Sensors, 22.","DOI":"10.3390\/s22207753"},{"key":"ref_25","first-page":"94","article-title":"Certain improvements to location aided packet marking and ddos attacks in internet","volume":"15","author":"Satheesh","year":"2020","journal-title":"J. Eng. Sci. Technol."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Suresh, S., Ram, N.S., and Mohan, M. (2019, January 14\u201315). An Optimistic Approach to Interpret the DDoS Attacks By Wielding Deterministic Packet Marking. Proceedings of the 2019 International Conference on Smart Structures and Systems (ICSSS), Chennai, India.","DOI":"10.1109\/ICSSS.2019.8882851"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"4232","DOI":"10.1007\/s11227-018-2323-8","article-title":"Feasible DDoS Attack Source Traceback Scheme by Deterministic Multiple Packet Marking Mechanism","volume":"76","author":"Suresh","year":"2020","journal-title":"J. Supercomput."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Yeh, L.Y., Huang, J.L., Yen, T.Y., and Hu, J.W. (2019, January 5\u20138). A Collaborative DDoS Defense Platform Based on Blockchain Technology. Proceedings of the 2019 Twelfth International Conference on Ubi-Media Computing (Ubi-Media), Bali, Indonesia.","DOI":"10.1109\/Ubi-Media.2019.00010"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Sivabalan, S., and Radcliffe, P.J. (2013, January 17\u201319). A novel framework to detect and block DDoS attack at the application layer. Proceedings of the IEEE 2013 Tencon-Spring, Sydney, Australia.","DOI":"10.1109\/TENCONSpring.2013.6584511"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zhang, H., Taha, A., Trapero, R., Luna, J., and Suri, N. (2016, January 23\u201326). SENTRY: A Novel Approach for Mitigating Application Layer DDoS Threats. Proceedings of the 2016 IEEE Trustcom\/BigDataSE\/ISPA, Tianjin, China.","DOI":"10.1109\/TrustCom.2016.0098"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Moustis, D., and Kotzanikolaou, P. (2013, January 10\u201312). Evaluating security controls against HTTP-based DDoS attacks. Proceedings of the IISA 2013, Piraeus, Greece.","DOI":"10.1109\/IISA.2013.6623707"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Smith, J.M., and Schuchard, M. (2018, January 21\u201323). Routing Around Congestion: Defeating DDoS Attacks and Adverse Network Conditions via Reactive BGP Routing. Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2018.00032"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"425","DOI":"10.1007\/s13369-017-2414-5","article-title":"DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions","volume":"42","author":"Bawany","year":"2017","journal-title":"Arab. J. Sci. Eng."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Bhattacharyya, D.K., and Kalita, J.K. (2016). DDoS Attacks: Evolution, Detection, Prevention, Reaction, and Tolerance, Chapman & Hall\/CRC.","DOI":"10.1201\/b20614"},{"key":"ref_35","unstructured":"Imperva (2019). Imperva, Global DDoS Threat Landscape, 2019 Report, Imperva. Technical Report."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Li, P., Feng, Y., Kawamoto, J., and Sakurai, K. (2016, January 6\u20138). A Proposal for Cyber-Attack Trace-Back Using Packet Marking and Logging. Proceedings of the 2016 10th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS), Fukuoka, Japan.","DOI":"10.1109\/IMIS.2016.89"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Sanap, S.M., and Pawar, P. (2015, January 19\u201320). sOverview of IP tracebacking using packet marking techniques. Proceedings of the 2015 International Conference on Advances in Computer Engineering and Applications, Ghaziabad, India.","DOI":"10.1109\/ICACEA.2015.7164816"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1145\/1328690.1328716","article-title":"End-to-End vs. Hop-by-Hop Transport","volume":"35","author":"Heimlicher","year":"2007","journal-title":"SIGMETRICS Perform. Eval. Rev."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Varga, A., and Hornig, R. (2008, January 3\u20137). An overview of the OMNeT++ simulation environment. Proceedings of the Simutools \u201908: Proceedings of the 1st International Conference on Simulation Tools and Techniques for Communications, Networks and Systems & Workshops; ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering): ICST, Brussels, Belgium.","DOI":"10.4108\/ICST.SIMUTOOLS2008.3027"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1145\/1132952.1132954","article-title":"Graph Mining: Laws, Generators, and Algorithms","volume":"38","author":"Chakrabarti","year":"2006","journal-title":"ACM Comput. Surv."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Bollob\u00e1s, B. (2001). Random Graphs, Cambridge University Press.","DOI":"10.1017\/CBO9780511814068"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.jnca.2016.05.011","article-title":"Towards next-generation routing protocols for pocket switched networks","volume":"70","author":"Amah","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1145\/571697.571724","article-title":"Controlling High Bandwidth Aggregates in the Network","volume":"32","author":"Mahajan","year":"2002","journal-title":"SIGCOMM Comput. Commun. Rev."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Frankel, S., and Krishnan, S. (2011). IP Security (IPsec) and Internet Key Exchange (IKE) Document Roadmap, Internet Engineering Task Force (IETF). RFC 6071.","DOI":"10.17487\/rfc6071"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/1\/102\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:48:14Z","timestamp":1760147294000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/1\/102"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,22]]},"references-count":44,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["s23010102"],"URL":"https:\/\/doi.org\/10.3390\/s23010102","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,22]]}}}