Monitoring the macroscopic effect of DDoS flooding attacks

IEEE Transactions on Dependable and Secure Computing

Volumn 2, Issue 4, 2005, Pages 324-335

  Yuan, Jian ^a,b   Mills, Kevin ^a,c,d,e  

^a IEEE   (China)

^b TSINGHUA UNIVERSITY   (China)

^c NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY   (United States)

^d DEFENSE ADVANCED RESEARCH PROJECTS AGENCY   (United States)

^e Krasnow Institute for Advanced Study   (United States)

Author keywords

Attack dynamics; DDoS attack; Monitoring; Network traffic; Spatial temporal pattern

Indexed keywords

COMPUTER NETWORKS; DISTRIBUTED COMPUTER SYSTEMS; INFORMATION ANALYSIS; MONITORING; PATTERN RECOGNITION; REAL TIME SYSTEMS; TELECOMMUNICATION TRAFFIC;

ATTACK DYNAMICS; DDOS ATTACK; NETWORK TRAFFIC; SPATIAL-TEMPORAL PATTERN;

SECURITY OF DATA;

EID: 30344436961     PISSN: 15455971     EISSN: None     Source Type: Journal    
DOI: 10.1109/TDSC.2005.50     Document Type: Article

References (43)

1. J. Saltzer, D. Reed, and D. Clark, "End-to-End Arguments in System Design," ACM Trans. Computer System, vol. 2, no. 4, pp. 277-288, Nov. 1984.
2. D. Moore, G. Voelker, and S. Savage, "Inferring Internet Denial of Service Activity," Proc. USENIX Security Symp., Aug. 2001.
3. J. Mirkovic, J. Martin, and P. Reiher, "A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms," Technical Report CSD-TR-020018, Computer Science Dept., Univ. of California, Los Angeles, 2001.
4. J. Mirkovic, G. Prier, and P. Reiher, "Challenges of Source-End DDoS Defense," Proc. Int'l Symp. Network Computing and Applications, 2003.
5. A. Feldmann, A.C. Gilbert, W. Willinger, and T.G. Kurtz, "The Changing Nature of Network Traffic: Scaling Phenomena," ACM SIGCOMM Computer Comm. Rev., vol. 28, no. 2, pp. 5-29, Apr. 1998.
6. Q. Huang, H. Kobayashi, and B. Liu, "Analysis of a New Form of Distributed Denial of Service Attack," Proc. 37th Ann. Conf. Information Science and Systems (CISS'03), Mar. 2003.
7. J. Yuan and K. Mills, "A Cross-Correlation Based Method for Spatial-Temporal Traffic Analysis," J. Performance Evaluation, vol. 61, nos. 2-3, pp. 163-180, 2005.
8. S. Noh, C. Lee, K. Choi, and G. Jung, "Detecting Distributed Denial of Service (DDoS) Attacks through Inductive Learning," Lecture Notes in Computer Science, vol. 2690, pp. 286-295, 2003.
9. R. Basu, K.R. Cunningham, S.E. Webster, and P.R. Lippmann, "Detecting Low-Profile Probes and Novel Denial of Service Attacks," Proc. 2007 IEEE Workshop Information Assurance, 2001.
10. M. Li and C. Chi, Decision Analysis of Statistically Detecting Distributed DoS Flooding Attacks," Int'l J. Information Technology and Decision Making, vol. 2, no. 3, pp. 397-405, 2003.
11. J. loannidis and S.M. Bellovin, "Implementing Pushback: Router Defense against DDoS Attacks," Proc. Network and Distributed Systems Security Symp., Feb. 2002.
12. Y. Huang and J.M. Pullen, "Countering Denial of Service Attacks Using Congestion Triggered Packet Sampling and Filtering," Proc. 10th Int'l Conf. Computer Comm. and Networks, 2001.
13. Y. Xiong, S. Liu, and P. Sun, "On the Defense of the Distributed Denial of Service Attacks: An On-Off Feedback Control Approach," IEEE Trans. Systems, Man, and Cybernetics - PART A: Systems and Humans, vol. 31, no. 4, pp. 282-293, 2001.
14. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the Source," Proc. Int'l Conf. Network Protocols 2002, pp. 312-321, 2002.
15. T.M. Gil and M. Poleto, "MULTOPS: A Data-Structure for Bandwidth Attack Detection," Proc. 10th Usenix Security Symp., pp. 23-38, Aug. 2001.
16. S.S. Kim, A.L. N. Reddy, and M. Vannucci, "Detecting Traffic Anomalies through Aggregate Analysis of Packet Header Data," Proc. Networking 2004, pp. 1047-1059, May 2004.
17. D. Pappalardo, "ISPs Take on DDoS Attacks," Computerworld, Nov. 2003.
18. L.-C. Chen, T.A. Longstaff, and K.M. Carley, "Characterization of Defense Mechanisms against Distributed Denial of Service Attacks," Computers and Security, vol. 23, no. 8, pp. 665-678, 2004.
19. R.R. Talpade, G. Kim, S. Khurana, "NOMAD: Traffic-Based Network Monitoring Framework For Anomaly Detection," Proc. Fourth IEEE Symp. Computers and Comm., 1998.
20. A. Akella, A. Bharambe, M. Reiter, and S. Seshan, "Detecting DDoS Attacks on ISP Networks," Proc. ACM SIGMOD/PODS Workshop Management and Processing of Data Streams (MPDS) FCRC 2003, 2003.
21. A. Lakhina, M. Crovella, and C. Diot, "Characterization of Network-Wide Anomalies in Traffic Flows," Proc. ACM/SIGCOMM Internet Measurement Conf., 2004.
22. S. Staniford, V. Paxson, and N. Weaver, "How to Own the Internet in Your Spare Time," Proc. USENIX Security Symp., pp. 149-167, Aug. 2002.
23. R.K. C. Chang, "Defending against Flooding-Based Distributed Denial of Service Attacks: A Tutorial," IEEE Comm. Magazine, vol. 40, no. 10, pp. 42-51, 2002.
24. J.O. Ramsay and B.W. Silverman, Functional Data Analysis, Springer. New York, 1997.
25. J. Yuan and K. Mills, "Macroscopic Dynamics of Large-Scale Data Networks," Complex Dynamics in Comm. Networks, pp. 191-212, 2005.
26. J. Yuan and K. Mills, "Exploring Collective Dynamics in Communication Networks," J. Research of the Nat'l Inst. of Standards and Technology, vol. 107, no. 2, pp. 179-191, 2002.
27. V. Paxson and S. Floyd, "Wide-Area Traffic: The Failure of Poisson Modeling," Proc. ACM SIGCOMM '94 Conf., pp. 257-268, 1994.
28. M. Crovella and A. Bestavros, "Self-Similarity in World Wide Web Traffic: Evidence and Possible Causes," Proc. 1996 ACM SIGMETRICS Int'l Conf. Measurement and Modeling of Computer Systems, May 1996.
29. A. Feldmann, A.C. Gilbert, P. Huang, and W. Willinger, "Dynamics of IP Traffic: A Study of the Role of Variability and the Impact of Control," Proc. ACM SIGCOMM '99 Conf., pp. 301-313, 1999.
30. W. Willinger, M.S. Taqqu, R. Sherman, and D.V. Wilson, "Self-Similarity through High-Variability: Statistical Analysis of Ethernet Lan Traffic at the Source Level," Proc. ACM SIGCOMM '95 Conf., pp. 100-113, 1995.
31. T. Karagiannis, M. Molle, and M. Faloutsos, "Long-Range Dependence: Ten Years of Internet Traffic Modeling," IEEE Internet Computing, pp. 57-64, Sept.-Oct. 2004.
32. M. Barthelemy, B. Gondran, and E. Guichard, "Large-Scale Cross-Correlations in Internet Traffic," Physical Rev. E 66, 2002.
33. Z. Bai, J. Demmel, J. Dongarra, A. Ruhe, and H. van der Vorst, Templates for the Solution of Algebraic Eigenvalue Problems: A Practical Guide. Philadelphia, Penn.: Soc. for Industrial and Applied Math., 2000.
34. MATLAB User's Guide, The MathWorks, Inc., Natick, Mass., 1998.
35. K.I. Goh, B. Kahng, and D. Kim, "Spectra and Eigenvectors of Scale-Free Networks," Physical Rev. E 64, 2001.
36. M. Crovella and E. Kolaczyk, "Graph Wavelets for Spatial Traffic Analysis," Proc. IEEE Infocom 2003, Apr. 2003.
37. M. Claypool, R. Kinicki, M. Li, J. Nichols, and H. Wu, "Inferring Queue Sizes in Access Networks by Active Measurement," Proc. PAM (Passive and Active Measurement) Workshop, Apr. 2004.
38. M. Weigle, K. Jeffay, and F.D. Smith, "Quantifying the Effects of Recent Protocol Improvements to Standards-Track TCP," Proc. 11th IEEE/ACM Int'l Symp. Modeling, Analysis, and Simulation of Computer and Telecomm., 2003.
39. P. Barford and D. Plonka, "Characteristics of Network Traffic Flow Anomalies," Proc. ACM SIGCOMM Internet Measurement Workshop, Nov. 2001.
40. A. Kuzmanovic and E.W. Knightly, "Low-Rate TCP-Targeted Denial of Service Attacks," Proc. ACM SIGCOMM 2003 Conf., Aug. 2003.
41. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. ACM SIGCOMM'2000 Conf., 2000.
42. A.C. Shoeten, C. Partridge, L.A. Sanchez, C.e.E. Jones, F. Tchakountio, S.T. Kent, and W.T. Strayer, "Hash-Based IP Traceback," Proc. 2001 ACM SIGCOMM Conf., Aug. 2001.
43. R. Mahajan, S.M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling High Bandwidth Aggregates in the Network," technical report, AT&T Center for Internet Research at ICSI (ACIRI) and AT&T Labs Research, Feb. 2001.