Detecting DDoS attacks with passive measurement based heuristics

Proceedings - IEEE Symposium on Computers and Communications

Volumn 1, Issue , 2004, Pages 339-344

  Siaterlis, Christos ^a   Maglaris, Basil ^a  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS   (Greece)

Author keywords

[No Author keywords available]

Indexed keywords

ALGORITHMS; BANDWIDTH; DATA REDUCTION; HEURISTIC METHODS; PARAMETER ESTIMATION; SPAMMING;

DETECTION ALGORITHMS; DISTRIBUTED DENIAL OF SERVICE (DDOS); HEURISTICS; NETWORK TRAFFIC;

TELECOMMUNICATION TRAFFIC;

EID: 10844268824     PISSN: 15301346     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (19)

1. P. Barford and D. Plonka. Characteristics of network traffic flow anomalies. In Proceedings of the 1st ACM SIGCOMM Internet Measurement Workshop, pages 69-74, New York, Nov. 1-2 2001. ACM Press.
2. CERT/CC. CA-2003-20 W32/blaster worm, http://www.cert.org/advisories/CA-2003-20.html.
3. I. Charitakis, D. Pnevmatikatos, E. Markatos, and K. Anagnostakis. S2I: a tool for automatic rule match compilation for the ixp network processor. In Proceedings of SCOPES 2003), Vienna, September 2003.
4. C.-M. Cheng, H. Kung, and K.-S. Tan. Use of spectral analysis in defense against DoS attacks. In Proceedings of IEEE GLOBECOM, 2002.
5. CISCO. Netflow. http://www.cisco.com/go/netflow.
6. CISCO. Remote triggered black hole filtering, ftp://ftp-eng.cisco.com/cons/isp/security/.
7. CISCO. Unicast reverse path forwarding enhancements for the ISP-ISPedge. ftp://ftp-eng.cisco.com/cons/isp/security/URPF-ISP.pdf.
8. CISCO. Using CAR during DoS attacks. http://www.cisco.com/warp/public/63/car_ rate_limit_icmp.html.
9. C. Estan, S. Savage, and G. Varghese. Automatically inferring patterns of resource consumption in network traffic. In Proceedings of the ACM SIGCOMM Conference, Karlsruhe, Germany, August 2003.
10. Ferguson and Senie. RFC2827 network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing, May 2000.
11. T. M. Gil and M. Poletto. MULTOPS: A data-structure for bandwidth attack detection. In USENIX, editor, Proceedings of the 10th USENIX Security Symposium, August 13-17, 2001, Washington, DC, USA
12. J. Ioannidis and S. M. Bellovin. Implementing pushback: Router-based defense against DDoS attacks. In Proceedings of NDSS, San Diego, February 2002. The Internet Society.
13. C. Kotsokalis, D. Kalogeras, and B. Maglaris. Router-based detection of DoS and DDoS attacks, June 2001. 8th Workshop of the HP Open View University Association.
14. J. Mirkovic, G. Prier, and P. Reiher. Attacking DDoS at the source. In Proceedings of ICNP 2002, pages 312-321, Paris, France, November 2002.
15. T. Oetiker. About RRDtool. http://people.ee.ethz.ch/~oetiker/webtools/rrdtool.
16. S. Savage, D. Wetherall, A. Karlin, and T. Anderson. Practical network support for IP traceback. In Proceedings of the 2000 ACM SIGCOMM Conference.
17. C. Siaterlis and B. Maglaris. Towards multisensor data fusion for DoS detection. In Proceedings of ACM SAC'04, Nicosia, Cyprus, 2004.
18. Spamhaus. Virus and DDoS attacks on spamhaus. http://www.spamhaus.org/cyberattacks/.
19. H. Wang, D. Zhang, and K. G. Shin. Detecting SYN flooding attacks. In Proceedings of the INFOCOM 2002, volume 3, pages 1530-1539, Piscataway, NJ, USA, June 23-27 2002. IEEE Computer Society.