A Dynamic Method to Detect IP Spoofing on Data Network Using Ant Algorithm

–A data packet is typically forwarded from one router to another through networks that constitute the internetwork until it gets to its destination node. At the same time routers in the Internet do not perform any security verification of the source IP address contained in the packets. The lack of such verification opens the door for a variety of network security vulnerabilities like denial-of-service (DoS) attacks, man-in-the-middle attacks etc. One of the major threats to the Internet is source IP address spoofing. To avoid the IP spoofing a number of prevention approaches are proposed by the research community. In this paper an ant-based traceback is proposed to detect the IP spoofing. The proposed traceback approach uses flow level information to identify the spoofing request. To validate the detection method further, this paper considers the number of hop needs to reach the destination end. Using a mapping between IP addresses and their flow level with hopcounts, the server can distinguish spoofed IP packets from legitimate ones. The simulations results show that this approach discards almost 90% of spoofed IP request. Keywords––IP spoofing, IP trace back, Ant algorithm, hop count, pheromone intensity, flow level