Perimeter-based defense against high bandwidth DDoS attacks

IEEE Transactions on Parallel and Distributed Systems

Volumn 16, Issue 6, 2005, Pages 526-537

  Chen, Shigang ^a   Song, Qingguo ^a  

^a University of Florida   (United States)

Author keywords

Network level security and protection

Indexed keywords

BANDWIDTH; COMPUTER SIMULATION; ELECTRIC FILTERS; NETWORK PROTOCOLS; ROUTERS; SECURITY OF DATA; TELECOMMUNICATION SERVICES; TELECOMMUNICATION TRAFFIC; THEOREM PROVING;

DISTRIBUTED DENIAL OF SERVICE (DDOS); INTERNET SERVICE PROVIDERS; RATE LIMIT FILTERS;

INTERNET;

EID: 21244446746     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2005.74     Document Type: Article

References (21)

1. C. Schuba, I. Krsul, M. Kuhn, E. Spafford, A. Sundaram, and D. Zamboni, "Analysis of a Denial of Service Attack on TCP," Proc. IEEE Symp. Security and Privacy, 1997
2. J. Lemon, "Resisting SYN Flood DoS Attacks with a SYN Cache," Proc. USENIX BSDCON 2002, Feb. 2002.
3. H. Wang, D. Zhang, and K.G. Shin, "SYN-dog: Sniffing SYN Flooding Sources," Proc. 22nd Int'l Conf. Distributed Computing Systems (ICDCS '02), July 2002.
4. D. Moore, G. Voelker, and S. Savage, "Inferring Internet Denial of Service Activity," Proc. USENIX Security Symp. 2001, Aug. 2001.
5. P. Ferguson and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which Employ IP Source Address Spoofing," IETF, RFC 2267, Jan. 1998.
6. K. Park and H. Lee, "On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets," Proc. ACM SIGCOMM 2001, Aug. 2001.
7. H. Burch and B. Cheswick, "Tracing Anonymous Packets to Their Approximate Source," Proc. USENIX LISA '00, Dec. 2000.
8. D. Schnackenberg, K. Djahandari, and D. Sterne, "Infrastructure for Intrusion Detection and Response," Proc. First DARPA Information Survivability Conf. and Exposition, Jan. 2000.
9. R. Stone, "CenterTrack: An IP Overlay Network for Tracking DoS Floods," Proc. USENIX Security Symp. '00, Aug. 2000.
10. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. ACM SIGCOMM 2000, Aug. 2000.
11. D. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IP Traceback," Proc. IEEE INFOCOM 2001, Mar. 2001.
12. A.C. Snoren, C. Partridge, L.A. Sanchez, C.E. Jones, F. Tchakountio, S.T. Kent, and W.T. Strayer, "Single-Packet IP Traceback," IEEE/ACM Trans. Networking, Dec. 2002.
13. K. Park and H. Lee, "On the Effectiveness of Probabilistic Packet Marking for IP Traceback under Denial of Service Attacks," Proc. IEEE INFOCOM 2001, Mar. 2001.
14. M. Song and J. Xu, "IP Traceback-Based Intelligent Packet Filtering: A Novel Technique for Defending against Internet DDoS Attacks," Proc. 10th IEEE Int'l Conf. Network Protocols (ICNP 2002), Nov. 2002.
15. P. Mahajan, S.M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling, High Bandwidth Aggregates in the Network," Computer Comm. Rev., vol. 32, no. 3, pp. 62-73, July 2002.
16. A. Yaar, A. Perrig, and D. Song, "Pi: A Path Identification Mechanism to Defend against DDoS Attacks," Proc. IEEE Symp. Security and Privacy, May 2003.
17. S.M. Bellovin, "ICMP Traceback Messages," Internet Draft: draft-bellovin-itrace-00.txt, Mar. 2000.
18. S. Gibson, "The Strange Tale of the Denial of Service Attacks against GRC.COM," http://grc.com/dos/grcdos.htm, 2002.
19. G.W. Gordon, "SYN Cookies, An Exploration," http://www.giac.org/ practical/Gerald_Gordon_GSEC.doc, 2005.
20. A.D. Keromytis, V. Misra, and D. Rubenstein, "SOS: Secure Overlay Services," Proc. ACM SIGCOMM 2002, Aug. 2002.
21. S. Ratnasamy, S. Shenker, and I. Stoica, "Routing Algorithms for DHTs: Some Open Questions," Proc. First Int'l Workshop Peer-to-Peer Systems (IPTPS '02), Mar. 2002.