Towards multisensor data fusion for DoS detection

Proceedings of the ACM Symposium on Applied Computing

Volumn 1, Issue , 2004, Pages 439-446

  Siaterlis, Christos ^a   Maglaris, Basil ^a  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS   (Greece)

Author keywords

Anomaly detection; Data fusion; Denial of Service

Indexed keywords

COMPUTER NETWORKS; ELECTRICITY; HEURISTIC METHODS; INFERENCE ENGINES; PROBLEM SOLVING; RANDOM PROCESSES; SENSORS; SERVERS;

ANOMALY DETECTION; DATA FUSION; DENIAL OF SERVICE; MULTISENSORS;

DATA REDUCTION;

EID: 2442505788     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/967900.967992     Document Type: Conference Paper

References (31)

1. B. Ahn and S. Byun and D.B. Choi. Traffic incident detection using evidential reasoning based data fusion. In Proceeding of the 6th World Congress on Intelligent Transport Systems, Toronto, Canada, 1999.
2. P. Barford and D. Plonka. Characteristics of network traffic flow anomalies. In Proceedings of the First ACM SIGCOMM Internet Measurement Workshop, pages 69-74, New York, Nov. 1-2 2001. ACM Press.
3. J. Barlow and W. Thrower. TFN2K - an analysis, March 2000. http://packetstormsecurity.com/diatributed/TFN2k_Analysis-1.3.txt.
4. T. Bass. Intrusion detection systems and multisensor data fusion. Communications of the ACM, 43(4):99-105, Apr. 2000.
5. Broadbandreports.com. Osirusoft MIA? Spammers cripple popular blacklist. http://www.broadbandreports.com/shownews/31856.
6. Snort: The open source network intrusion detection system, http://www.snort.org.
7. CERT/CC advisory w32/blaster worm, Aug. 2003. http://www.cert.org/ advisories/CA-2003-20.html.
8. CISCO. Netflow. http://www.cisco.com/go/netflow.
9. CISCO. Remote triggered black hole filtering. ftp://ftp-eng.Cisco.com/ cons/isp/security/.
10. Unicast reverse path forwarding enhancements for the ISP-ISP edge. ftp://ftp-eng. cisco.com/cons/isp/security/URPF-ISP.pdf.
11. CISCO. Using CAR during DoS attacks. http://www.cisco.com/warp/public/63/ car_rate_ limit_icmp.html.
12. D. A. Curry and H. Debar. Intrusion detection message exchange format data model and extensible markup language (XML) document type definition. Internet Draft, Nov. 2002. Work-in-progress.
13. L. Deri. Passively monitoring networks at gigabit speeds using commodity hardware and open source software. In Passive and Active Measurement Workshop 2003. NLANR/MNA, April 2003.
14. D. Dittrich. The Stacheldraht distributed denial of service attack tool. http://staff.washington.edu/dittrich/misc/stacheldraht. analysis.
15. B. S. Feinstein, G. A. Matthews, and J. C. C. White. The intrusion detection exchange protocol (IDXP). Internet Draft, Oct. 2002. Work-in-progress.
16. Ferguson and Senie. RFC2827 network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing, May 2000.
17. A. Habib, M. Hefeeda, and B. Bhargava. Detecting service violations and DoS attacks. In NDSS Conference Proceedings. Internet Society, 2003.
18. D. Hall. Mathematical Techniques in Multisensor Data Fusion. Artech House, Norwood, Massachusetts, 1992.
19. ISC/UMD/Cogent Events of 21-Oct-2002 http://d.root-servers.org/october21. txt.
20. J. Ioannidis and S. M. Bellovin. Implementing pushback: Router-based defense against DDoS attacks. In Proceedings of NDSS Symposium, San Diego, California, February 2002. The Internet Society.
21. J.Llinas and E. Waltz. Multisensor Data Fusion. Artech House, Norwood, Massachusetts, 1990.
22. J. Kohlas and P. Monney. Theory of evidence - a survey of its mathematical foundations, applications and computational analysis. ZOR- Mathematical Methods of Operations Research, 39:35-68, 1994.
23. J. Mirkovic, J. Martin, and P. Reiher. A taxonomy of DDoS attacks and DDoS defense mechanisms. Technical report 020018.Computer Science Dept., University of California, Los Angeles.
24. J. Mirkovic, G. Prier, and P. Reiher. Attacking DDoS at the source. In Proceedings of ICNP 2002, pages 312-321, Paris, France, November 2002.
25. S. Mohiuddin, S. Hershkop, R. Bhan, and S. J. Stolfo. Defending against a large scale DoS attack. Proceedings of the 3rd Annual IEEE Information Assurance Workshop, June 2002.
26. ITworld. Al-Jazeera hobbled by DDoS attack, http://wvw.itworld.com/Sec/ 3834/030327aljazeera.
27. T. Oetiker. About RRDtool. http://people.ee.ethz.ch/~oetiker/webtools/ rrdtool.
28. S. Savage, D. Wetherall, A. Karlin, and T. Anderson. Practical network support for IP traceback. In Proceedings of the 2000 ACM SIGCOMM Conference.
29. G. Shafer. A Mathematical Theory of Evidence. Princeton University Press, Princeton, 1976.
30. K. Tomsovic and B. Baer. Fuzzy information approaches to equipment condition monitoring and diagnosis. Electric Power Applications of Fuzzy Systems, IEEE Press, pages 59-84, 1998.
31. H. Wu, M. Siegel, R. Stiefelhagen, and J. Yang. Sensor fusion using Dempster-Shafer theory. In Proceedings of IEEE Instrumentation and Measurement Technology Conference, Anchorage, AK, USA, 2002.