Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles

IEEE/ACM Transactions on Networking

Volumn 13, Issue 1, 2005, Pages 29-42

  Yau, David K Y ^a   Lui, John C S ^b   Liang, Feng ^c   Yam, Yeung ^b  

^a Purdue University   (United States)

^b CHINESE UNIVERSITY OF HONG KONG   (Hong Kong)

^c ZHEJIANG UNIVERSITY OF TECHNOLOGY   (China)

Author keywords

Congestion control; Distributed denial of service; Network security; Router throttling

Indexed keywords

ALGORITHMS; COMPUTER SIMULATION; CONGESTION CONTROL (COMMUNICATION); CONVERGENCE OF NUMERICAL METHODS; MATHEMATICAL MODELS; PACKET NETWORKS; ROUTERS; SECURITY OF DATA; SERVERS; TELECOMMUNICATION TRAFFIC;

DISTRIBUTED DENIAL-OF-SERVICE; NETWORK SECURITY; ROUTER THROTTLING;

INTERNET;

EID: 15544363902     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2004.842221     Document Type: Article

References (19)

1. Blackhole Route Server and Tracking Traffic on an IP Network [Online]. Available: http://www.secsup.org/Tracking
2. TCP SYN Flooding and IP Spoofing Attacks. CERT Advisory CA-96.21. Online. Available: http://www.cert.org/
3. (1998) Smurf IP Denial-of-Service Attacks. CERT Advisory CA-1998-01. [Online]. Available: www.cert.org/advisories/CA-98.01.html
4. B. Awerbuch and Y. Shavitt, "Converging to approximated max-min flow fairness in logarithmic time," in Proc. IEEE INFOCOM, San Francisco, CA, Mar. 1998.
5. W. Fang and L. Peterson, "Inter-AS traffic patterns and their implications," in Proc. IEEE Global Internet Symp., Rio de Janeiro, Brazil, Dec. 1999.
6. P. Ferguson and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing," IETF, RFC 2827, 2000.
7. A. Garg and A. L. N. Reddy, "Mitigation of DoS attacks through QoS regulation," in Proc. IEEE IWQoS, Miami Beach, FL, May 2002.
8. M. G. Gouda, E. N. Elnozahy, C. T. Huang, and T. M. McGuire, "Hop integrity in computer networks," in Proc. IEEE ICNP, Osaka, Japan, Nov. 2000.
9. S. C. Han, P. Zaroo, D. K. Y. Yau, P. Gopalan, and J. C. S. Lui, "Quality of Service Provisioning for Composable Routing Elements," Purdue Univ., West Lafayette, IN, Tech. Rep., 2002.
10. S. Kent and R. Atkinson, "Security Architecture for the Internet Protocol," IETF, RFC 2401, 1998.
11. F. Liang, D. K. Y. Yau, and J. C. S. Lui, "On Defending Against Distributed Denial-of-Service Attacks With Server-Centric Router Throttles," Dept of Computer Sciences, Purdue University, West Lafayette, IN, Tech. Rep. TR-01-008, 2001.
12. G. de Vivo, M. de Vivo, and G. Isern, "Internet security attacks at the basic levels," ACM Oper. Syst. Rev., vol. 32, Apr. 1998.
13. R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling High Bandwidth Aggregates in the Network," ACIRI and AT&T Labs Research, Tech. Rep., 2001.
14. A. K. Parekh and R. G. Gallager, "A generalized processor sharing approach to flow control in integrated services networks: The single-node case," IEEE/ACM Trans. Networking, vol. 1, pp. 344-357, Jun. 1993.
15. K. Park and H. Lee, "On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack," in Proc. IEEE INFOCOM, Anchorage, AK, 2001.
16. S. Savage, D Wetherall, A. Karlin, and T. Anderson, "Practical network support for IP traceback," in Proc. ACM SIGCOMM, Stockholm, Sweden, Aug. 2000.
17. D. Song and A. Perrig, "Advanced and authenticated techniques for IP traceback," in Proc. IEEE INFOCOM, Anchorage, AK, 2001.
18. H. Wang, D. Zhang, and K. G. Shin, "Detecting SYN flooding attacks," in Proc. IEEE INFOCOM, New York, NY, Jun. 2002.
19. D. K. Y. Yau and X. Chen, "Resource management in software-programmable router operating systems," IEEE J. Select. Areas Commun., vol. 19, no. 3, pp. 488-500, Mar. 2001.