Sustaining availability of web services under distributed denial of service attacks

IEEE Transactions on Computers

Volumn 52, Issue 2, 2003, Pages 195-208

  Xu, Jun ^a   Lee, Wooyong ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

Availability; Distributed Denial of Service (DDoS); Game theory; Survivability; World Wide Web

Indexed keywords

COMPUTER SIMULATION; CRYPTOGRAPHY; DOS; ELECTRONIC COMMERCE; GAME THEORY; NETWORK PROTOCOLS; ROUTERS; TELECOMMUNICATION TRAFFIC; WEBSITES;

TRANSMISSION CONTROL PROTOCOLS (TCP);

TELECOMMUNICATION SERVICES;

EID: 0037328484     PISSN: 00189340     EISSN: None     Source Type: Journal    
DOI: 10.1109/TC.2003.1176986     Document Type: Article

References (46)

1. Ucb Network Simulator - ns (version 2), 2001
2. "The Economic Impacts of Unacceptable Web Site Download Speeds,"technical report, Zona Research Inc., http://www.key note.com/solutions/assets/applets/wp_downloadspeed.pdf, 1999.
3. Distributed Denial of Service Attack Tools, 2001
4. S. Bellovin, "Internet Draft: Icmp Traceback Messages," technical report, Network Working Group, Mar. 2000.
5. H. Burch and B. Cheswick, "Tracing Anonymous Packets to Their Approximate Source," Proc. Usenix LISA 2000, Dec. 2000.
6. Z. Cao, Z. Wang, and E. Zegura, "Performance of Hashing-Based Schemes for Internet Load Balancing," Proc. Infocom 2000, Mar. 2000.
7. CERT, "TCP Syn Flooding and IP Spoofing Attacks," Advisory CA-96.21, Sept. 1996.
8. T. Chen and S. Liu, ATM Switching Systems. Boston: Artech House, 1995.
9. H. Choi and J. Limb, "A Behavior Model of a Web Traffic," Proc. Int'l Conf. Network Protocols (ICNP '99), Sept. 1999.
10. D. Dean, M. Franklin, and A. Stubblefield, "An Algebraic Approach to IP Traceback," Proc. Network and Distributed System Security Symp. (NDSS 2001), pp. 3-12, Feb. 2001.
11. T. Doeppner, P. Klein, and A. Koyfman, "Using Router Stamping to Identify the Source of IP Packets," Proc. ACM Conf. Computer and Comm. Security (CCS-7), pp. 184-189, Nov. 2000.
12. R. Ganesan, "Yaksha: Augmenting Kerberos with Public-Key Cryptography," 1995.
13. L. Garber, "Denial-of-Service Attacks Rip the Internet," Computer, vol. 33, no. 4, pp. 12-17, Apr. 2000.
14. T. Gil and M. Poletto, "Multops: A Data-Structure for Bandwidth Attack Detection," Proc. 10th Usenix Security Symp., Aug. 2001.
15. J. Heidemann, K. Obraczka, and J. Touch, "Modeling the Performance of http over Several Transport Protocols," IEEE/ACM Trans. Networking, vol. 5, no. 5, pp. 616-630, Oct. 1997.
16. J. Howard, "An Analysis of Security Incidents on the Internet," PhD thesis, Carnegie Melion Univ., Aug. 1998.
17. IETF, Photuris: Session-Key Management Protocol, Mar. 1999.
18. Checkpoint Inc., "TCP Syn Flooding Attack and the Eirewall-1 Syndefender," http://www.checkpoint.com/products/firewall-1/syndefender.html, 1997
19. Z. Jiang, Y. Ge, and Y. Li, "Max-Utility Wireless Resource Management for Best Effort Traffic," Jan. 2002.
20. A. Jones, Game Theory: Mathematical Models of Conflict. John Wiley & Sons, 1980.
21. A. Juels and J. Brainard, "Client Puzzles: A Cryptographic Countermeasure against Connection Depletion Attacks," Proc. Network and Distributed System Security Symp. (NDSS '99), Mar. 1999.
22. F. Kargl, J. Maier, S. Schlott, and M. Weber, "Protecting Web Servers from Distributed Denial of Service Attacks," WWW-10, May 2001.
23. S. Kent and R. Atkinson, Security Architecture for the Internet Protocol. IPSEC Working Group, May 1998.
24. B. Mah, "An Empirical Model of http Network Traffic," Proc. Infocom '97, Apr. 1997.
25. R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling High Bandwidth Aggregates in the Network," technical report, ACIRI and AT&T Labs Research, Feb. 2001.
26. C. Meadows, "A Formal Framework and Evaluation Method for Network Denial of Service," Proc. 1999 IEEE Computer Security Foundations Workshop, June 1999.
27. C. Neuman and T. Ts'o, "Kerberos: An Authentication Service for Computer Networks," IEEE Comm. Magazine, Sept. 1994, W. Stallings, Practical Cryptography for Data Internetworks, IEEE CS Press, 1996.
28. C. Neuman and T. Ts'o, "Kerberos: An Authentication Service for Computer Networks," IEEE Comm. Magazine, Sept. 1994, W. Stallings, Practical Cryptography for Data Internetworks, IEEE CS Press, 1996.
29. V. Padmanabhan, J. Mogul, "Improving http Latency," Computer Networks and ISDN Systems, vol. 28, nos. 1-2, Dec. 1995.
30. K. Park and H. Lee, "On the Effectiveness of Probabilistic Packet Marking for IP Traceback under Denial of Service Attack," Proc. IEEE Infocom 2001, Apr. 2000.
31. K. Park and H. Lee, "On the Effectiveness of Route-Based Packet Filtering for Distributed DOS Attack Prevention in Power-Law Internets," Proc. ACM Sigcomm 2001, Aug. 2001.
32. C. Partridge et al., "A 50-gb/s IP Router," IEEE/ACM Trans. Networking, vol. 6, no. 3, pp. 237-248, June 1998.
33. J. Postel, "Rfc 793: Transmission Control Protocol," technical report, Internet Soc., Sept. 1980.
34. M.K. Reiter, M.K. Franklin, J.B. Lacy, and R.N. Wright, "The Omega Key Management Service," Proc. ACM Conf. Computer and Comm. Security, pp. 38-47, 1996.
35. A. Rice, "Defending Networks from Syn Flooding in Depth," technical report, Sans Inst., Dec. 2000.
36. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. ACM SIGCOMM 2000, pp. 295-306, Aug. 2000.
37. C. Schuba et al., "Analysis of a Denial of Service Attack on TCP," Proc. 1997 IEEE Symp. Security and Privacy, 1997.
38. M. Shreedhar and G. Varghese, "Efficient Fair Queuing Using Deficit Round Robin," Proc. ACM SIGCOMM '95, pp. 231-242, Aug. 1995.
39. A. Snoeren et al., "Hash-Based IP Traceback," Proc. ACM SIGCOMM 2001, Aug. 2001.
40. D. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IF Traceback," Proc. Infocom 2001, Apr. 2001.
41. O. Spatcheck and L. Peterson, "Defending against Denial of Service Attacks in Scout," Proc. 1999 USENIX/ACM Symp. Operating System Design and Implementation, pp. 59-72, Feb. 1999.
42. W. Stevens, TCP/IP Illustrated Volume 1, The Protocols. Addison-Wesley, 1994.
43. B. Suter, T. Lakshman, D. Stiliadis, and A. Choudhury, "Design Considerations for Supporting TCP with Per-Flow Queueing," Proc. IEEE INFOCOM '98, Mar. 1998.
44. J. Xu, "Sustaining Availability of Web Services under Severe Denial of Service Attacks," technical report, Georgia Inst. of Technology, May 2001.
45. L. Zhang, S. Deering, and D. Estrin, "RSVP: A New Resource ReSerVation Protocol," IEEE Network, vol. 7, no. 5, pp. 8-18, Sept. 1993.
46. L. Zhou, F. Schneider, and R. Renesse, "Coca: A Secure Distributed On-Line Certification Authority," technical report, Dept. of Computer Science, Cornell Univ., Dec. 2000.