DDoS attack detection and wavelets

Telecommunication Systems

Volumn 28, Issue 3-4, 2005, Pages 435-451

  Li, Lan ^a   Lee, Gyungho ^a  

^a 1120 Science and Engineering Offices   (United States)

Author keywords

Attack detection; Distributed denial of service; Energy distribution; Traffic characterization; Wavelet analysis

Indexed keywords

CODES (STANDARDS); COMPUTATIONAL COMPLEXITY; CONGESTION CONTROL (COMMUNICATION); INTERNET; TELECOMMUNICATION SERVICES; TELECOMMUNICATION TRAFFIC; WAVELET TRANSFORMS;

ATTACK DETECTION; DISTRIBUTED DENIAL OF SERVICE (DDOS); ENERGY DISTRIBUTION; TRAFFIC CHARACTERIZATION; WAVELET ANALYSIS;

SECURITY SYSTEMS;

EID: 17444397467     PISSN: 10184864     EISSN: None     Source Type: Journal    
DOI: 10.1007/s11235-004-5581-0     Document Type: Conference Paper

References (28)

1. P. Abry and D.Veitch, Wavelet analysis of long range dependent traffic, IEEE Transactions on Information Theory 44(1) (1998) 2-15.
2. P. Abry, D. Veitch and P. Flandrin, Long-range dependence: Revisiting aggregation with wavelets, Journal of Time Series Analysis 19 (May 1998) 253-266.
3. P. Barford and M.E. Crovella, Generating representative Web workloads for network and server performance evaluation, in: ACM SigMetrics (1998) pp. 151-160.
4. P. Barford, J. Kline, D. Plonka and A. Ron, A signal analysis of network traffic anomalies, in: Internet Measurement Workshop (November 2002).
5. CERT, Overview of attack trends, http://www.cert.org/archive/pdf/ attack_trends.pdf (8 April 2002).
6. CERT Advisory CA-2001-23, Continued threat of the Code Red Worm (17 January 2002).
7. R.K.C. Chang, Defending against flooding-based distributed denial-of-service attack: A tutorial, IEEE Communication Magazine 40(10) (2002) 42-51.
8. M.E. Crovella and A. Bestavros, Self-similarity in World Wide Web traffic: Evidence and possible causes, IEEE/ACM Transactions on Networking 5(6) (1997) 835-846.
9. I. Daubechies, The wavelet transform, time-frequency localization and signal analysis, IEEE Transactions on Information Theory 36 (September 1990) 961-1005.
10. P. Ferguson and D. Senie, Network ingress filtering: Defeating denial of service attacks which employ IP address spoofing, Internet draft (January 1998).
11. K. Fox, R. Henning, J. Reed and R. Simonian, A neural network approach towards intrusion detection, Technical Report, Harris Corporation (July 1990).
12. M. LaMonica, Microsoft releases anti-Slammer tools, http://zdnet.com.com/ 2100-1105-983603.html (6 February 2003).
13. W. Leland, M. Taqqu, W. Willinger and D. Wilson, On the self-similar nature of Ethernet traffic, Proc. of ACM SIGCOMM 23(4) (1993) 183-193.
14. W. Leland, M. Taqqu, W. Willinger and D. Wilson, On the self-similar nature of Ethernet traffic (extended version), IEEE/ACM Transactions on Networking 2(1) (1994) 1-15.
15. S. Ma and C. Ji, Modeling heterogeneous network traffic in wavelet domain, IEEE/ACM Transactions on Networking 9(5) (2001) 634-649.
16. D. Moore, C. Shannon and J. Brown, Code-Red: A case study on the spread and victims of an Internet worm, in: Proc. of Internet Measurement Workshop (2002).
17. K. Park and H. Lee, On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack, in: Proc. of IEEE INFOCOM'01 (April 2001) pp. 338-347.
18. V. Paxson and S. Floyd, Wide area traffic: The failure of Poisson modeling, IEEE/ACM Transactions on Networking 3(3) (1995) 226-244.
19. R. Riedi, M.S. Crouse, V. Ribeiro and R.G. Baraniuk, A multifractal wavelet model with application to TCP network traffic, Special Issue on Multiscale Statistical Signal a Nalysis and Its Applications of IEEE Transactions on Information Theory 45 (April 1999) 992-1018.
20. R. Ritke, X. Hong and M. Gerla, Contradictory relationship between Hurst parameter and queueing performance (extended version), Telecommunication Systems 16 (February 2001) 159-175.
21. M. Roghan, D. Veitch and P. Abry, Real-time estimation of the parameters of long-range dependence, IEEE/ACM Transactions on Networking 8 (August 2000) 467-478.
22. S. Sarvotham, R. Riedi and R. Baranuik, Connection-level analysis and modeling of network traffic, in: Proc. of the ACM SIGCOMM IMW (November 2001).
23. S. Staniford, V. Paxson and N. Weaver, How to own the Internet in your spare time, in: Proc. of the 11th USENIX Security Symposium (August 2002).
24. The Internet traffic archive, http://ita.ee.lbl.gov/ (April 2000).
25. The network simulator-ns-2, http://www.isi.edu/nsnam/ns/ (July 2003).
26. X. Tian, J. Wu and C. Ji, A unified framework for understanding network traffic using independent wavelet models, in: Proc. of IEEE INFOCOM (June 2002).
27. N. Ye, A Markov chain model of temporal behavior for anomaly detection, in: Workshop on Information Assurance and Security (June 2000).
28. Z. Zhang, V.J. Ribeiro, S. Moon and C. Diot, Small-time scaling behaviors of Internet backbone traffic: An empirical study, in: Proc. of IEEE INFOCOM (April 2003).