A DoS-limiting network architecture

Computer Communication Review

Volumn 35, Issue 4, 2005, Pages 241-252

  Yang, Xiaowei ^a   Wetherall, David ^b   Anderson, Thomas ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b UNIVERSITY OF WASHINGTON   (United States)

Author keywords

Denial of service; Internet

Indexed keywords

AUTHORIZATIONS; DENIAL OF SERVICE (DOS); LINUX KERNEL IMPLEMENTATION; ROUTER STATE EXHAUSTION; ATTACK TRAFFIC; DENIAL OF SERVICE; DESIGN AND EVALUATIONS; INCREMENTAL DEPLOYMENT; LINUX KERNEL; OFF-THE-SHELF HARDWARES; PACKET FLOODS; SHORT TERM;

COMPUTER SIMULATION; INTERNET; PACKET NETWORKS; ROUTERS; SIGNAL RECEIVERS; TELECOMMUNICATION TRAFFIC; COMPUTER ARCHITECTURE; COMPUTER OPERATING SYSTEMS; DENIAL-OF-SERVICE ATTACK; FLOODS; INTERNET PROTOCOLS;

TELECOMMUNICATION SERVICES; NETWORK ARCHITECTURE;

EID: 33750308365     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1090191.1080120     Document Type: Conference Paper

References (25)

1. D. Andersen. Mayday: Distributed Filtering for Internet Services. In 3rd Usenix USITS, 2003.
2. T. Anderson, T. Roscoe, and D. Wetherall. Preventing Internet Denial of Service with Capabilities. In Proc. HotNets-II, Nov. 2003.
3. K. Argyraki and D. Cheriton. Active Internet Traffic Filtering: Real-Time Response to Denial-of-Service Attacks. In USENIX 2005, 2005.
4. DDoS attacks still pose threat to Internet. BizReport, 11/4/03.
5. Extortion via DDoS on the rise. Network World, 5/16/05.
6. A. Demers, S. Keshav, and S. Shenker. Analysis and Simulation of a Fair Queueing Algorithm. In ACM SIGCOMM, 1989.
7. P. Druschel and G. Banga. Lazy Receiver Processing (LRP): A Network Subsystem Architecture for Server Systems. In 2nd OSDI, 1996.
8. P. Ferguson and D. Senie. Network Ingress Filtering: Defeating Denial of Service Attacks that Employ IP Source Address Spoofing. Internet RFC 2827, 2000.
9. M. Handley and A. Greenhalgh. Steps Towards a DoS-Resistant Internet Architecture. In ACM SIGCOMM Workshop on Future Directions in Network Architecture (FDNA), 2004.
10. J. Ioannidis and S. Bellovin. Implementing Pushback: Router-Based Defense Against DoS Attacks. In NDSS, 2002.
11. S. Kandula, D. Katabi, M. Jacob, and A. Berger. Botz-4-sale: Surviving organized DDoS attacks that mimic flash crowds. In 2nd NSDI, May 2005.
12. A. Keromytis, V. Misra, and D. Rubenstein. SOS: Secure Overlay Services. In ACM SIGCOMM, 2002.
13. E. Kohler, R. Morris, B. Chen, J. Jannotti, and M. F. Kaashoek. The Click Modular Router. ACM Transactions on Computer Systems, 18(3):263-297, Aug. 2000.
14. K. Lakshminarayanan, D. Adkins, A. Perrig, and I. Stoica. Taming IP Packet Flooding Attacks. In Proc. HotNets-II, 2003.
15. S. Machiraju, M. Seshadri, and I. Stoica. A Scalable and Robust Solution for Bandwidth Allocation. In IWQoS'02, 2002.
16. R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker. Controlling High Bandwidth Aggregates in the Network. Computer Communications Review, 32(3), July 2002.
17. A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone. Handbook of applied cryptography, chapter 9. CRC Pres, 1997.
18. D. Moore, G. Voelker, and S. Savage. Inferring Internet Denial of Service Activity. In Usenix Security Symposium 2001, 2001.
19. http://www.netfilter.org/.
20. S. Savage, D. Wetherall, A. Karlin, and T. Anderson. Practical Network Support for IP Traceback. In ACM SIGCOMM, 2000.
21. A. Snoeren, C. Partridge, L. Sanchez, C. Jones, F. Tchakountio, S. Kent, and W. Strayer. Hash-Based IP Traceback. In ACM SIGCOMM, 2001.
22. D. Song and A. Perrig. Advance and Authenticated Marking Schemes for IP Traceback. In Proc. IEEE Infocom, 2001.
23. I. Stoica, S. Shenker, and H. Zhang. Core-Stateless Fair Queueing: Achieving Approximately Fair Bandwidth Allocations in High Speed Networks. In ACM SIGCOMM, 1998.
24. A. Yaar, A. Perrig, and D. Song. Pi: A Path Identification Mechanism to Defend Against DDoS Attacks. In IEEE Symposium on Security and Privacy, 2003.
25. A. Yaar, A. Perrig, and D. Song. SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks. In IEEE Symposium on Security and Privacy, 2004.