You can run, but you can't hide: An effective statistical methodology to trace back DDoS attackers

IEEE Transactions on Parallel and Distributed Systems

Volumn 16, Issue 9, 2005, Pages 799-813

  Law, Terence K T ^a   Lui, John C S ^a   Yau, David K Y ^b  

^a CHINESE UNIVERSITY OF HONG KONG   (Hong Kong)

^b Purdue University   (United States)

Author keywords

Attack traffic filtering; DDoS attack; Minimum stable time; Traceback

Indexed keywords

COMPUTER CRIME; DISTRIBUTED COMPUTER SYSTEMS; INTERNET; PACKET NETWORKS; ROUTERS; STATISTICAL METHODS; TELECOMMUNICATION TRAFFIC; WEBSITES;

ATTACK TRAFFIC FILTERING; ATTACKER TRACEBACK; DDOS ATTACKERS; DISTRIBUTED DENIAL-OF-SERVICE (DDOS); MINIMUM STABLE TIME;

SECURITY OF DATA;

EID: 25844469597     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2005.114     Document Type: Article

References (22)

1. Internet scanning database, http://cin.bell-labs.cont/whoiches/map/dbs/ index.html, 1999.
2. "Computer Emergency Response Team, Cert Advisory ca-2000-01. Denial-of-Service Developments," http://www.cert.org/advisories/ ca-2000-01.html, 2000,
3. S. Bellowin, "Secukity Problems in the TCP/IP Protocol Suite," Computer Comm. Rev., pp. 32-48, 1989.
4. H. Burch and B. Cheswick, "Tracing Anonymous Packets to their Approximate Source," Usenix LISA, Dec. 2000.
5. R.L. Burden and J.D. Faires, Numerical Analysis. Boston: PWS-Kent Publishing Company, 1988
6. D. Dean, M. Franklin, and A. Stubblefield, "An Algebraic Approach to IP Traceback," Proc. Network and Distributed System Security Symp. (NDSS 'O1), Feb. 2001.
7. P. Ferguson and D. Senie, "RFC 2267: Network Ingress Filtering: Defeating Denial of Service Attacks which Employ IP Source Address Spoofing," The Internet Society, Jan. 1998.
8. J. Howard, "An Analysis of Security Incidents on the Internet," PhD Thesis, Carnegie Mellon Univ., Aug. 1998.
9. K.T. Law, J.C.S. Lui, and D.K.Y. Yau, "You Can Run, But You Can't Hide: An Effective Methodology to Traceback DDOS Attackers," Technical Report CS-TR-2002-06, Computer Science Eng. Dept., Chinese Univ. Hong Kong, 2002.
10. A. Mankin, D. Massey, C.-L. Wu, S.F. Wu, and L. Zhang, "On Design and Evaluation of Intention-Driven ICMP Traceback," Proc. IEEE Int'l Conf. Computer Comm. and Networks, 2001.
11. R. Nelson, Probability, Stochastic Processes, and Queueing Theory: The Mathematics of Computer Performance Modeling. Springer-Verlag, 1995.
12. T. Peng, C. Leckie, and R. Kotagiri, "Adjusted Probabilistic Packet Marking for IP Traceback," Proc. Conf. Networking, May 2002.
13. S.M. Ross, Stochastic Processes. John Wiley, 1996.
14. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. 2000 ACM SIGCOMM Conf., pp. 295-306, Aug. 2000.
15. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Network Support for IP Traceback," ACM/IEEE Trans. Networking, vol. 9, no. 3, June 2001.
16. A.C. Snoeren, C. Partridge, L.A. Sanchez, C.E. Jones, F. Tchakountio, S.T. Kent, and W.T. Strayer, "Hash-Based IP Traceback," Proc. ACM SIGCOMM 2001 Conf. Applications, Technologies, Architectures, and Protocols for Computer Comm., Aug. 2001.
17. D.X. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IP Traceback," Proc. IEEE INFOCOM Conf., Apr. 2001.
18. E. Steven and M. Bellovin, "ICMP Traceback Messages," draft-bellovin-itrace-00.txt, Mar. 2000.
19. R. Stone, "Centertrack: An IP Overlay Network for Tracking DOS Floods," Proc. Ninth LISENIX Security Symp., Aug. 2000.
20. S.F. Wu, L. Zhang, D. Massey, and A. Mankin, "Intention-Driven ICMP Trace-Back, Internet Draft," draft-wu-itrace-intention-00.txt, Feb. 2001.
21. D.K.Y. Yau, J.C.S. Lui, and F. Liang, "Defending against Distributed Denial-of-Service Attacks with Max-Min Fair Server-Centric Router Throttles," Proc. IEEE Int'l Workshop Quality of Service (IWQoS), May 2002.
22. D.K.Y. Yau, J.C.S. Lui, F. Liang, and Y. Yeung, "Defending against Distributed Denial-of-Service Attacks with Max-Min Fair Server-Centric Router Throttles," Proc. 10th IEEE Int'l Workshop Quality of Service, 2002.