Characterization of defense mechanisms against distributed denial of service attacks

Computers and Security

Volumn 23, Issue 8, 2004, Pages 665-678

  Chen, Li Chiou ^a,b,c,e   Longstaff, Thomas A ^c,d   Carley, Kathleen M ^a,b,c  

^a Department of Engineering ^*  (United States)

^b Inst for Software Res Intl   (United States)

^c CARNEGIE MELLON UNIVERSITY   (United States)

^d CARNEGIE MELLON UNIVERSITY   (United States)

^e Carnegie Mellon University   (United States)

Author keywords

Characterization; Computer network security; Computer security; Defense mechanisms; Distributed denial of service attacks

Indexed keywords

ALGORITHMS; COMPOSITION; COSTS; INFORMATION ANALYSIS; ONLINE SYSTEMS; PUBLIC POLICY; SECURITY OF DATA; STATISTICS;

COMPUTER NETWORK SECURITY; DEFENCE MECHANISMS; DEPLOYMENT COSTS; DISTRIBUTED DENIAL OF SERVICE ATTACKS;

COMMAND AND CONTROL SYSTEMS;

EID: 10644248262     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2004.06.008     Document Type: Article

References (50)

1. Arbor. PeakFlow, Waltham, MA: Arbor Networks, Inc.; 2002.
2. Asta. Vantage System, Seattle, WA: Asta Networks, Inc.; 2002.
3. Axelsson S. Intrusion detection systems: a survey and taxonomy. Department of Computer Engineering, Chalmers University, Goteborg, Sweden Technical Report 99-15; March 2000.
4. Bellovin SM. ICMP traceback message. Internet Draft: draft-bellovin-itrace-00.txt; March 2000.
5. Burch H, Cheswick B. Tracing anonymous packets to their approximate source. Presented at LINUX System Administration Conference, New Orleans, LA; 2000.
6. Cabrera JBD, Lewis L, Qin X, Lee W, Prasanth RK, Ravichandran B, et al. Proactive detection of distributed denial of service attacks using MIB traffic variables - a feasibility study. Presented at IEEE/IFIP International Symposium on Integrated Network Management; 2001.
7. CERT/CC. Results of the distributed-systems Intruder tools workshop, Pittsburgh, Pennsylvania, USA: CERT Coordination Center, Software Engineering Institute, Carnegie Mellon University; November 2-4. 1999.
8. Cheswick WR, Bellovin SM. Firewalls and internet security: repelling the Wily Hacker: Addison-Wesley Pub Co; 1994.
9. CISCO. Strategies to protect against distributed denial of service. CISCO 2000.
10. Claffy KC, Miller G, Thompson K. The nature of the beast: recent traffic measurements from an Internet backbone. Presented at INET, Geneva, Switzerland; 1998.
11. Debar H, Dacier M, Wespi A. Towards a taxonomy of intrusion detection systems. Computer Networks, vol. 31, 1999.
12. Feldmann A, Muthukrishnan S. Tradeoffs for packet classification. Presented at IEEE Infocom; 2000.
13. Ferguson P, Senie D. Network ingress filtering: defeating denial of service attacks which employ IP source address spoofing. IETF RFC2267 RFC 2267; January 1998.
14. Fraleigh C, Moon S, Diot C, Lyles B, Tobagi F. Packet-level traffic measurement from a Tier-1 IP backbone. Sprint ATL, Burlingame, CA Sprint ATL Technical Report TR01-ATL-110101; 2001.
15. Gil TM, Poletto M. MULTOPS: a data-structure for bandwidth attack detection. Presented at USENIX Security Symposium. Washington, DC; 2001.
16. Huang Y, Pullen JM. Countering denial-of-service attacks using congestion triggered packet sampling and filtering. Presented at 10th International Conference on Computer Communications and Networks; 2001.
17. lannaccone G, Diot C, Graham I, McKeown N. Monitoring very high speed links. Presented at ACM Internet Measurement Workshop. San Francisco; 2001.
18. loannidis J, Bellovin SM. Implementing pushback: router defense against DDoS attacks. Presented at Network and Distributed System Security Symposium; 2002.
19. Karn P, Simpson W. Photuris: session-key management protocol. IETF RFC 2522; March 1999.
20. Kent S, Atkinson R. Security architecture for the Internet protocol. The IP Security Protocol Working Group, Internet Engineering Task Force; 1998a.
21. Kent S, Atkinson R. IP authentication header. The IP Security Protocol Working Group, Internet Engineering Task Force; 1998b.
22. Li J, Mirkovic J, Wang M, Reiher P, Zhang L. SAVE: source address validity enforcement protocol. Presented at IEEE INFOCOM; 2001.
23. Lipson H. Tracking and tracing cyber-attacks: technical challenges and global policy issues, Pittsburgh: CERT Coordination Center, Software Engineering Institute; November 2002. Available from: 〈http://www.cert.org/archive/pdf/02sr009.pdf〉.
24. Mahajan R, Bellovin SM, Floyd S, loannidis J, Paxson V, Shenker S. Controlling high bandwidth aggregate in the network. Computer Communications Review 2001.
25. May J, Peterson J, Bauman J. Attack detection in large networks. Presented at DARPA Information Surviviability Conference and Exposition. Anaheim, CA; 2001.
26. Mirkovic J, Martin J, Reiher P. A taxonomy of DDoS attacks and DDoS defense mechanisms. Computer Science Department, University of California, Los Angeles Technical report #020018; 2002a.
27. Mirkovic J, Prier G, Reiher P. Attacking DDoS at the source. Presented at Proceedings of ICNP. Paris, France; 2002b.
28. Mukherjee B, Heberlein LT, Levitt KN. Network intrusion detection. IEEE Network 1994;8:26-41.
29. Park K, Lee H. On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack. Presented at Proceedings of IEEE INFOCOM; 2001 a.
30. Park K, Lee H. On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internet. Presented at ACM SIGCOMM'01. San Diego, CA; 2001 b.
31. Paxson V. End-to-end routing behavior in the Internet. Presented at ACM SIGCOMM '96; 1996.
32. Recourse. ManHunt, Redwood City, CA: Recourse Technologies, Inc; 2002.
33. Savage S, Wetherall D, Karlin A, Anderson T. Practical network support for IP traceback. ACM/IEEE Transactions on Networking 2001;9:226-37.
34. Schnackenberg D, Djahandari K. Infrastructure for intrusion detection and response. Presented at DARPA Information Survivability Conference and Exposition (DISCEX); 2000.
35. Schuba CL, Krsul IV, Kuhn MG, Spafford EH, Sundaram A, Zamboni D. Analysis of a denial of service attack on TCP. Presented at IEEE Symposium on Security and Privacy; 1997.
36. Snoeren AC, Partridge C, Sanchez LA, Jones CE, Tchakountio F, Kent ST, et al. Hash-based IP traceback. Presented at ACM SIGCOMM; 2001.
37. Snoeren AC, Patridge C, Sanchez LA, Jones CE, Tchakountio F, Schwartz B, et al. Single-packet IP traceback. IEEE Transaction on Networking 2002;10:721-34.
38. Song DX, Perrig A. Advanced and authenticated marking schemes for IP traceback. Presented at IEEE Inforcom; 2001.
39. Spatscheck O, Peterson LL. Defending against denial of service in Scout. Operating Systems Review 1998.
40. Staniford-Chen S, Tung B, Schnackenberg D. The common intrusion detection framework (CIDF). Presented at DARPA Information Survivability Workshop. Orlando FL; 1998.
41. Sterne D, Schnackenberg D, Babson B, Holliday H, Djahandari K, Reid T, et al. Autonomic response to distributed denial of service attacks. Presented at Recent Advances in Intrusion Detection conference; 2001.
42. Sterne D, Schnackenberg D, Balupari R, Cholter WL, Babson B, Wilson B, et al. Active network based DDoS defense. Presented at DARPA Active Networks Conference and Exposition; 2002.
43. Sung M, Xu J. IP traceback-based intelligent packet filtering: a novel technique for detecting against Internet DDos attacks. Presented at IEEE International Conference on Network Protocols; 2002.
44. Tran KTL. Hackers attack major Internet sites, temporarily shutting Buy.com, Ebay. Wall Street Journal 2000:3.
45. Xiong Y, Liu S, Sun P. On the defense of the distributed denial of service attacks: an on-off feedback control approach. IEEE Transaction on Systems, Man, and Cybernetics - Part A: Systems and Humans 2001;31:282-93.
46. Xu J, Lee W. Sustaining availability of web servers under server denial of service attacks. IEEE Transaction on Computers, special issue on Reliable Distributed Systems 2003;52(2): 195-207.
47. Yaar A, Perrig A, Song D. Pi: a path identification mechanism to defend against DDos attack. Presented at IEEE conference on security and privacy; 2003.
48. Van J, Early S, Anderson R. The XenoService - a distributed defeat for distributed denial of service. Presented at Information Survivability Workshop; 2000.
49. Yankee. $1.2 billion impact seen as a result of recent attacks launched by Internet hackers. The Yankee Group, Research Notes February 2000.
50. Zwicky ED, Cooper S, Chapman DB, Russell D. Building internet firewalls. 2nd ed.: O'Reilly & Associates; 2000.