A monitoring system for mitigating fast propagating worms in the network infrastructure

Canadian Conference on Electrical and Computer Engineering

Volumn 2005, Issue , 2005, Pages 1419-1422

  Martin, Miguel Vargas ^a  

^a UNIVERSITY OF ONTARIO INSTITUTE OF TECHNOLOGY   (Canada)

Author keywords

Denial of service; Flash crowds; Network security; Worms

Indexed keywords

BANDWIDTH; COMPUTER CRIME; MONITORING; PACKET NETWORKS; QUEUEING NETWORKS; ROUTERS;

DENIAL-OF-SERVICE; FLASH CROWDS; NETWORK SECURITY; WORMS;

COMPUTER VIRUSES;

EID: 33751313620     PISSN: 08407789     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CCECE.2005.1557246     Document Type: Conference Paper

References (29)

1. L. Fan, P. Cao, J. Almeida, and A.Z. Broder, "Summary cache: A scalable wide-area Web cache sharing protocol," IEEE/ACM Trans. on Networking, vol. 8, no. 3, pp. 281-293, June 2000.
2. M. Vargas Martin, J.-M. Robert, P.C. Van Oorschot, "A monitoring system for detecting repeated packets with applications to computer worms," Technical Report TR-04-02, School of Computer Science, Carleton Univ., June 2004. URL: http://www.scs.carleton.ca/research/tech_reports/2004/TR-04-02.1.pdf [Accessed: January 4 2005].
3. W. Almesberger, "Linux traffic control - implementation overview," Technical Report SSC/1998/037, EPFL, November 1998.URL: ftp://lroftp.epfl.ch/pub/people/_almesber/pub/tcio-current.ps.gz [Accessed: February 12, 2004].
4. th Int'l Linux System Technology Conference (Linux-Kongress 2002), Ottawa, Canada, September 2002.
5. J. Nagle, "On packet switches with infinite storage," IETF RFC 970, 1985.
6. J. Nagle, "On packet switches with infinite storage," IEEE Trans. on Communications, vol. 35, pp. 435-438, 1987.
7. A. Demers, S. Keshav, and S. Shenker, "Analysis and simulation of a fair queuing algorithm," Proc. Special Interest Group on Data Communication (SIGCOMM), Austin, USA, September 19-22 1989.
8. S. Floyd and V. Jacobson, "Random early detection gateways for congestion avoidance," IEEE/ACM Trans. on Networking, vol. 1, no. 4, pp. 397-413, 1993.
9. D. Lin and R. Morris, "Dynamics of Random Early Detection," Proc. Special Interest Group on Data Communication (SIGCOMM), pages 127-137, Cannes, France, September 14-181997.
10. F. Ertemalp, D.R. Cheriton, and A. Bechtolsheim, "Using dynamic buffer limiting to protect against belligerent flows in high-speed networks," Int 7 Conf. on Network Protocols (ICNP), pages 230-240, Riverside, USA, November 11-14 2001.
11. D.K.Y. Yau, J.C.S. Lui, and F. Liang, "Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles," Proc. of the IEEE Int'l Workshop on Quality of Service, Miami Beach, USA, May 2002.
12. R. Mahajan, S.M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling high-bandwidth aggregates in the network," ACM SIGCOMM Computer Communication Review, vol. 32, no. 3, pp. 62-73, 2002.
13. J. Ioannidis and S.M. Bellovin, "Router-based defense against DDoS attacks," Proc. of Network and Distributed System Security Symp. (NDSS), San Diego, USA, February 2002.
14. A. Hussain, J. Heidemann and C. Papadopoulos, "A framework for classifying denial of service attacks," Proc. of the Special Interest Group on Data Communication (SIGCOMM), pages 99-110, Karlsruhe, Germany, August 25-29 2003.
15. H. Wang and K.G. Shin, "Transport-aware IP routers: A built-in protection mechanism to counter DDoS attacks," IEEE Trans. on Parallel and Distributed Systems, vol. 14, no. 9, pp. 873-884, September 2003.
16. S. Tanachaiwiwat and K. Hwang, "Differential packet filtering against DDoS flood attacks," May 19 2003. URL: http://gridsec.usc.edu/ papers/ACMSecurity509pdf.pdf [Accessed: March 1, 2004].
17. th Int'l Symp. on Recent Advances in Intrusion Detection (RAID 2004), Sophia Antipolis, France, September 15-17 2004.
18. th Int'l World Wide Web Conf., pages 293-304, Honolulu, USA, May 7-11 2002.
19. X. Chen and J. Heidemann, "Flash crowd mitigation via adaptive admission control based on application-level measurement," Technical Report ISI-TR-557, Univ. Southern California, May 2002. URL: http://www.isi.edu/ ~johnh/PAPERS/Chen02a.html [Accessed: April 1 2004].
20. B.H. Bloom, "Space/time trade-offs in hash coding with allowable errors," Comm. of the ACM, vol. 13, no. 17, pp. 422-426 , July 1970.
21. S. Dharmapurikar, P. Krishnamurthy, and D. Taylor, "Longest prefix matching using Bloom filters," Proc. of the Special Interest Group on Data Communication (SIGCOMM), pages 201-212, Karlsruhe, Germany, August 25-29 2003.
22. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood, "Deep packet inspection using parallel Bloom filters," Symp. on High Performance Interconnects (HotI), pages 44-51, Stanford, USA, August 2003.
23. E.-J. Goh, "Secure indexes," Cryptology ePrint Archive, Report 2003/216, 2003. URL:http://eprint.iacr.org/2003/216 / [Accessed: January 7, 2004].
24. A. Kumar, J. Xu, L. Li, and J. Wang, "Space-code Bloom filter for efficient traffic flow measurement," Proc. of IMC, Miami Beach, USA, October 27-29 2003.
25. A.C. Snoeren, C. Partridge, L.A. Sanchez, C.E. Jones, F. Tchakountio, S.T. Kent, and W.T. Strayer, "Hash-based IP traceback," Proc. of the Special Interest Group on Data Communication (SIGCOMM), San Diego, USA, August 27-31 2001.
26. C. Nachenberg, "Computer virus-antivirus coevolution," Comm. of the ACM, 40(1):46-51, January 1997.
27. C. Shannon and D. Moore, "The spread of the Witty worm," 2004. URL:http://www.caida.org/analysis/security/witty/ [Accessed: June 18, 2004].
28. th Symp. on Operating Systems Design and Implementation (OSDI 2004), San Francisco, USA, December 6-8 2004.
29. th Usenix Securiy symposium (Security 2004), San Diego, USA, August 9-13 2004.