Enhanced Internet security by a distributed traffic control service based on traffic ownership

Journal of Network and Computer Applications

Volumn 30, Issue 3, 2007, Pages 841-857

  Bossardt, Matthias ^a   Dübendorfer, Thomas ^a   Plattner, Bernhard ^a  

^a ETH ZURICH   (Switzerland)

Author keywords

Distributed denial of service attack; Mitigation; Network management; Network services; Traffic control

Indexed keywords

COMPUTER SYSTEM FIREWALLS; DISTRIBUTED COMPUTER SYSTEMS; INTERNET; NETWORK MANAGEMENT; TELECOMMUNICATION TRAFFIC;

ADAPTIVE TRAFFIC PROCESSING; DISTRIBUTED DENIAL OF SERVICE ATTACK; INTERNET ATTACKS; MITIGATION; NETWORK SERVICES;

NETWORK SECURITY;

EID: 33947709385     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2005.07.006     Document Type: Article

References (26)

1. Andersen DG. Mayday: distributed filtering for internet services. In: fourth USENIX Symposium on Internet Technologies and Systems (USITS) 2003, Seattle, USA, March 2003.
2. Attig M, Lockwood JW. A framework for rule processing in reconfigurable network systems. In: Proceedings of IEEE symposium on field-programmable custom computing machines (FCCM), Napa, USA, April 2005.
3. Bates T, Smith P, Huston G. CIDR report for 22 February 2005. February 2005. http://www.cidr-report.org/.
4. Bossardt M, Hoog Antink R, Moser A, Plattner B. Chameleon: realizing automatic service composition for extensible active routers. In: Proceedings of the fifth annual international working conference on active networks, IWAN 2003, Lecture Notes in Computer Science, Kyoto, Japan, Berlin: Springer, December 2003.
5. Dübendorfer T, Bossardt M. Distributed Internet Traffic Control System, Patent PCT/CH2004/000631, 2004.
6. Dübendorfer T, Bossardt M, Plattner B. Adaptive distributed traffic control service for DDoS attack mitigation. In: IEEE Proceedings of IPDPS 2005, International workshop on security in systems and networks SSN, Denver, USA, 2005.
7. Dübendorfer T, Wagner A, Plattner B. An economic damage model for large-scale internet attacks. In: 13th IEEE international workshops on enabling technologies (WET ICE 2004); Enterprise security. IEEE, June 2004.
8. Ferguson P, Senie D. RFC 2267: Network ingress filtering: defeating denial of service attacks which employ IP source address Spoofing, January 1998.
9. Floyd S, Bellovin S, Ioannidis J, Kompella K, Mahajan R, Paxson V. Pushback messages for controlling aggregates in the network. Internet Draft, work in progress, 2001.
10. Heise Online. Doubleclick knickt unter DDoS-Attacke ein, July 2004. http://www.heise.de/newsticker/meldung/49514.
11. Heise Online. Gezielte denial-of-service-attacke gegen heise online [Update]. February 2005. http://www.heise.de/newsticker/meldung/55800.
12. Keromytis AD, Misra V, Rubenstein D. SOS: secure overlay services. In: Proceedings of ACM sigcomm 2002, Pittsburgh, USA, August 2002.
13. Lakshminarayanan K, Adkins D, Perrig D, Stoica I. Taming IP packet flooding attacks. In: Proceedings of ACM hot topics in networking workshop (HotNets-II), Cambridge, USA, November 2003.
14. Lemos R. MSBlast epidemic far larger than believed. 2004. http://news.com.com/MSBlast+epidemic+far+larger+than+believed/2100-7349_3-5184439.html.
15. Mahajan R., Bellovin S.M., Floyd S., Ioannidis J., Paxson V., and Shenker S. Controlling high bandwidth aggregates in the network. ACM Computer Communication Review, 32 3 (July 2002)
16. Netcraft. Web server survey. February 2005. http://news.netcraft.com/archives/2005/02/01/february_2005_web_server_survey_finds_40_million_sites_on_apache.html.
17. Network Wizards. Internet domain survey. July 2005. http://www.isc.org/.
18. Park K, Lee H. On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets. In: Proceedings of ACM sigcomm 2001, San Diego, USA, August 2001.
19. Paxson V. An analysis of using reflectors for distributed denial-of-service attacks. ACM Comput Commun Rev (CCR) 31 3 (2001)
20. Savage S, Wetherall D, Karlin A, Anderson T. Practical network support for IP traceback. In: Proceedings of ACM sigcomm 2000, Stockholm, Sweden, August 2000.
21. Schuehler DV, Lockwood JW. A modular system for FPGA-based TCP flow processing in high-speed networks. In: Proceedings of the 14th international conference on field programmable logic and applications (FPL), Antwerp, Belgium. Lecture Notes in Computer Science, vol. 3203, Berlin: Springer, 2004.
22. Snoeren AC, Partridge C, Sanchez LA, Jones CE. Hash-based IP traceback. In: Proceedings of ACM sigcomm 2001, San Diego, USA, August 2001.
23. Song DX, Perrig A. Advanced and authenticated marking schemes for IP traceback. In: Proceedings of IEEE infocom 2001, Anchorage, USA, April 2001.
24. Stoica I, Adkins D, Zhuang S, Shenker S, Surana S. Internet indirection infrastructure. In: Proceedings of ACM sigcomm 2002, Pittsburgh, USA, August 2002.
25. US-CERT. Technical cyber security alert TA04-028A on W32/MyDoom, 2004.
26. Yaar A, Perrig A, Song D. Pi: a path identification mechanism to defend against DDoS attacks. In: Proceedings of IEEE symposium on security and privacy, Berkeley, USA, May 2003.