Filtering of shrew DDoS attacks in frequency domain

Proceedings - Conference on Local Computer Networks, LCN

Volumn 2005, Issue , 2005, Pages 786-793

  Chen, Yu ^a   Hwang, Kai ^a   Kwok, Yu Kwong ^b  

^a University of Southern California   (United States)

^b UNIVERSITY OF HONG KONG   (Hong Kong)

Author keywords

Digital signal processing (DSP); Distributed denial of service (DDoS); Internet traffic analysis; Network security; Reduction of quality (RoQ)

Indexed keywords

COMPUTER SOFTWARE; DIGITAL SIGNAL PROCESSING; ELECTRONIC COMMERCE; SERVERS; TELECOMMUNICATION TRAFFIC; WEBSITES;

DISTRIBUTED DENIAL OF SERVICE (DDOS); INTERNET TRAFFIC ANALYSIS; NETWORK SECURITY; REDUCTION OF QUALITY (ROQ);

FREQUENCY DOMAIN ANALYSIS;

EID: 33751424902     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/LCN.2005.70     Document Type: Conference Paper

References (27)

1. P. Abry and D. Veitch, "Wavelet Analysis of Long-Range-Dependent Traffic," IEEE Trans. Information Theory, vol. 44, no. 1, 1998, pp. 2-15.
2. P. Abry, R. Baraniuk, P. Flandrin, R. Riedi, and D. Veitch, "Multiscale Nature of Network Traffic," IEEE Signal Processing Magazine, vol. 19, no. 3, 2002, pp. 28-46.
3. R. Allen and D. Mills, Signal Analysis: Time, Frequency, Scale, and Structure, John Wiley & Sons, 2004.
4. P. Barford, J. Kline, D. Plonka, and A. Ron, "A Signal Analysis of Network Traffic Anomalies," Proc. Internet Measurement Workshop, 2002.
5. R. K. Chang, "Defending Against Flooding-Based Distributed Denial-of-Service Attacks: A Tutorial," IEEE Communications Magazine, Oct. 2002.
6. Y. Chen, Y.-K. Kwok, and K. Hwang, "MAFIC: Adaptive Packet Dropping for Cutting Malicious Flows to Pushback DDoS Attacks," IEEE International Workshop on Security in Distributed Computing Systems (SDCS-2005), 2005.
7. Y. Chen, Y.-K. Kwok, and K. Hwang, "Collaborative Defense Against Periodic Shrew DDoS Attacks in Frequency Domain," ACM Trans. on Information and System Security (TISSEC), submitted May 2005.
8. C.-M. Cheng, H. Kung, and K.-S. Tan, "Use of Spectral Analysis in Defense against DoS Attacks," Proc. IEEE GLOBECOM, Taipei, China, 2002.
9. DETER and EMIST Team Members, "Cyber Defence Technology Networking and Evaluation," Comm. ACM, vol. 47, no. 3, Mar. 2004, pp. 58-61.
10. "The DETER Testbed: Overview," http://www.isi.edu/deter/docs/ testbed.overview.pdf.
11. J. Devore and N. Farnum, "Applied Statistics for Engineers and Scientists," Duxbury Press, 1999.
12. M. Guirguis, A. Bestavros, and I. Matta, "Bandwidth Stealing via Link Targeted RoQ Attacks," Proc. 2nd IASTED Int'l Conf. on Communication and Computer Networks, Nov. 2004.
13. M. Guirguis, A. Bestavros, I. Matta, and Y. Zhang, "Reduction of Quality (RoQ) Attacks on Internet End Systems," Proc. INFOCOM 2005.
14. X. He, C. Papadopoulos, J. Heidemann, and A. Hussain, "Spectral Characteristics of Saturated Links," under submission, http://www.isi.edu/ ~johnh/PAPERS/He04a.html.
15. P. Huang, A. Feldmann, and W. Willinger, "A Non-Intrusive, Wavelet-Based Approach to Detecting Network Performance Problems," Proc. ACM SIGCOMM Internet Measurement Workshop, 2001.
16. A. Hussain, J. Heidemann, and C. Papadopoulos, "A Framework for Classifying Denial of Service Attacks," Proc. ACM SIGCOMM 2003.
17. A. Kuzmanovic and E. W. Knightly, "Low-Rate TCP-Targeted Denial of Service Attacks - The Shrew vs. the Mice and Elephants," Proc. ACM SIGCOMM2003, Aug. 2003.
18. Y.-K. Kwok, R. Tripathi, Y. Chen, and K. Hwang, "HAWK: Halting Anomaly with Weighted ChoKing to Rescue Well-Behaved TCP Sessions from Shrew DoS Attacks," Proc. Int'l Conf. on Computer Networks and Mobile Computing (ICCNMC 2005), Zhangjiajie, China, Aug. 2-4, 2005.
19. K. C. Lan, A. Hussain, and D. Dutta, "The Effect of Malicious Traffic on the Network," Proc. PAM, La Jolla, Apr. 6-8, 2003.
20. X. Luo and R. K. Chang, "On a New Class of Pulsing Denial-of-Service Attacks and the Defense," Network and Distributed System Security Symposium (NDSS'05), San Diego, CA, Feb. 2-5, 2005.
21. R. Mahajan, S. Floyd, and D. Wetherall, "Controlling High-Bandwidth Flows at the Congested Router," Proc. ACM 9th Int'l Conf. on Network Protocols (ICNP), Nov. 2001.
22. D. Moore, G. M. Voelker, and S. Savage, "Inferring Internet Denial-of-Service Activity," Proc. USENIX Security, 2001.
23. NS-2, http://www.isi.edu/nsnam/ns/, 2004.
24. C. Partridge, D. Cousins, A. Jackson, R. Krishnan, T. Saxena, and W. T. Strayer, "Using Signal Processing to Analyze Wireless Data Traffic," Proc. ACM Workshop on Wireless Security, Atlanta, GA, Sept. 2002.
25. V. Paxson and M. Allman, "Computing TCP's Retransmission Timer," Internet RFC 2988, Nov. 2000.
26. S. M. Specht and R. B. Lee, "Distributed Denial of Service: Taxonomies of Attacks, Tools and Countermeasures," Proc. PDCS, Sept. 18, 2004.
27. H. Sun, J. Lui, and D. Yau, "Defending Against Low-rate TCP Attacks: Dynamic Detection and Protection," Proc. IEEE International Conference on Network Protocols (ICNP), Berlin, Germany, Oct. 2004.