A divide-and-conquer strategy for thwarting distributed denial-of-service attacks

IEEE Transactions on Parallel and Distributed Systems

Volumn 18, Issue 5, 2007, Pages 577-588

  Chen, Ruiliang ^a   Park, Jung Min ^a   Marchany, Randolph ^b  

^a Virginia Polytechnic Institute and State University   (United States)

^b VIRGINIA POLYTECHNIC INSTITUTE AND STATE UNIVERSITY   (United States)

Author keywords

Network level security and protection

Indexed keywords

ELECTRONIC CRIME COUNTERMEASURES; INTERNET; PACKET NETWORKS; ROUTERS; SIGNAL FILTERING AND PREDICTION; TELECOMMUNICATION TRAFFIC; TOPOLOGY;

ATTACK DIAGNOSIS (AD); DISTRIBUTED DENIAL-OF-SERVICE (DDOS); PARALLEL ATTACK DIAGNOSIS (PAD);

NETWORK SECURITY;

EID: 34247601459     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2007.1014     Document Type: Article

References (44)

1. B. Al-Duwairi and T.E. Daniels, "Topology Based Packet Marking," Proc. IEEE Int'l Conf. Computer Comm. and Networks (ICCCN), pp. 146-151, Oct. 2004.
2. R.K.C. Chang, "Defending against Flooding-Based Distributed Denial-of-Service Attacks: A Tutorial," IEEE Comm. Magazine, vol. 40, no. 10, pp. 42-51, Oct. 2002.
3. H. Cheswicka and H. Burch, Internet Mapping Project, http://research.lumeta.com/ches/map/, 2006.
4. Y. Chen, K. Hwang, and Y.-K. Kwok, "Collaborative Defense against Periodic Shrew DDoS Attacks in Frequency Domain," http://gridsec.usc.edu/files/TR/ACMTISSEC-LowRateAttack-May3-05.pdf, 2005.
5. R. Chen and J.-M. Park, "Attack Diagnosis: Throttling Distributed Denial-of-Service Attacks Close to the Attack Sources," Proc. IEEE Int'l Conf. Computer Comm. and Networks (ICCCN), pp. 275-280, Oct. 2005.
6. S. Chen and Q. Song, "Perimeter-Based Defense against High Bandwidth DDoS Attacks," IEEE Trans. Parallel and Distributed Systems, vol. 16, no. 6, pp. 526-537, June 2005.
7. D. Dean, M. Franklin, and A. Stubblefield, "An Algebraic Approach to IP Traceback," ACM Trans. Information and System Security (TISSEC), vol. 5, no. 2, pp. 119-137, May 2002.
8. C. Douligeris and A. Mitrokotsa, "DDoS Attacks and Defense Mechanisms: Classification and State-of-the-Art," Computer Networks, vol. 44, no. 5, pp. 643-666, Apr. 2004.
9. W. Feng, E. Kaiser, and A. Luu, "Design and Implementation of Network Puzzles," Proc. IEEE INFOCOM, pp. 2372-2382, Mar. 2005.
10. A. Fei, G. Pei, R. Liu, and L. Zhang, "Measurements on Delay and Hop-Count of the Internet," http://irl.cs.ucla.edu/papers/ internet-measurement.ps.gz., 2005.
11. M.T. Goodrich, "Efficient Packet Marking for Large Scale IP Traceback," Proc. ACM Conf. Computer and Comm. Security (CCS), pp. 117-126, Nov. 2002.
12. V.D. Gligor, "Guaranteeing Access in Spite of Distributed Service-Flooding Attacks," Proc. Security Protocols Workshop, pp. 66-74, Apr. 2003.
13. C. Jin, H. Wang, and K.G. Shin, "Hop-Count Filtering: An Effective Defense against Spoofed DoS Traffic," Proc. ACM Conf. Computer and Comm. Security (CCS), pp. 30-41, Oct. 2003.
14. A. Juels and J. Brainard, "Client Puzzle: A Cryptographic Defense against Connection Depletion Attacks," Proc. Network and Distributed System Security Symp., pp. 151-165, Feb. 1999.
15. S. Kent, "Securing the Border Gateway Protocol: A Status Update," http://www.ir.bbn.com/sbgp/S-BGP_CMS2003-Kent.pdf, 2005.
16. T. Killalea, Recommended Internet Service Provider Security Services and Procedures, IETF RFC 3013, Nov. 2000.
17. T.K.T. Law, J.C.S. Lui, and D.K.Y. Yau, "You Can Run, but You Can't Hide: An Effective Statistical Methodology to Trace Back DDoS Attackers," IEEE Trans. Parallel and Distributed Systems, vol. 16, no. 9, pp. 799-813, Sept. 2005.
18. J. Li, M. Sung, J. Xu, and L. Li, "Large-Scale IP Traceback in High-Speed Internet: Practical Techniques and Theoretical Foundation," Proc. IEEE Symp. Security and Privacy, pp. 115-129, May 2004.
19. X. Luo and R.K.C. Chang, "On a New Class of Pulsing Denial-of-Service Attacks and the Defense," Proc. Network and Distributed System Security Symp., Feb. 2005.
20. R. Mahajan, S.M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling High Bandwidth Aggregates in the Network," Computer Comm. Rev., vol. 32, no. 3, pp. 62-73, July 2002.
21. T. McNevin, J.-M. Park, and R. Marchany, "Chained Puzzles: A Novel Framework for IP-Layer Client Puzzles," Proc. IEEE Int'l Conf. Wireless Networks, Comm., and Mobile Computing (WirelessCom '05), June 2005.
22. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the Source," Proc. IEEE Int'l Conf. Network Protocols (ICNP), pp. 312-321, Nov. 2002.
23. J. Mirkovic, M. Robinson, and P. Reiher, "Alliance Formation for DDoS Defense," Proc. Workshop New Security Paradigms, pp. 11-18, Aug. 2003.
24. J. Mirkovic and P. Reiher, "A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms," ACM SIGCOMM Computer Comm. Rev., vol. 34, no. 2, pp. 39-54, Apr. 2004.
25. K.M. Moriarty, "Distributed Denial of Service Incident Handling: Real-Time Inter-Network Defense," IETF Internet draft, work in progress, Feb. 2004.
26. K. Park and H. Lee, "On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets," Proc. ACM SIGCOMM, pp. 15-26, Aug. 2001.
27. C. Papadopoulos, R. Lindell, J. Mehringer, A. Hussain, and R. Govindan, "Cossack: Coordinated Suppression of Simultaneous Attacks," Proc. DARPA Information Survivability Conf. and Exposition, vol. 1, pp. 2-13, Apr. 2003.
28. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. ACM SIGCOMM, pp. 295-306, Aug. 2000.
29. "Skitter," http://www.caida.org/tools/measurement/skitter/ index.xml, Cooperative Assoc. for Internet Data Analysis, 2006.
30. A. Snoeren, C. Partridge, L. Sanchez, C. Jones, F. Tchakountio, S. Kent, and W. Strayer, "Hash-Based IP Traceback," Proc. ACM SIGCOMM, pp. 3-14, Aug. 2001.
31. D.X. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IP Traceback," Proc. IEEE INFOCOM, pp. 878-886, Apr. 2001.
32. R. Stone, "CenterTrack: An IP Overlay Network for Tracking DoS Floods," Proc. USENIX Security Symp., pp. 199-212, July 2000.
33. M. Sung and J. Xu, "IP Traceback-Based Intelligent Packet Filtering: A Novel Technique for Defending against Internet DDoS Attacks," IEEE Trans. Parallel and Distributed Systems, vol. 14, no. 9, pp. 861-872, Sept. 2003.
34. R. Thomas, B. Mark, T. Johnson, and J. Croall, "NetBouncer: Client-Legitimacy-Based High-Performance DDoS Filtering," Proc. DARPA Information Survivability Conf. and Exposition, vol. 1, pp. 14-25, Apr. 2003.
35. X. Wang and M.K. Reiter, "Mitigating Bandwidth-Exhaustion Attacks Using Congestion Puzzles," Proc. ACM Conf. Computer and Comm. Security (CCS), pp. 257-267, Oct. 2004.
36. H. Wang and K.G. Shin, "Transport-Aware IP Routers: A Built-In Protection Mechanism to Counter DDoS Attacks," IEEE Trans. Parallel and Distributed Systems, vol. 14, no. 9, pp. 873-884, Sept. 2003.
37. J. Xu and W. Lee, "Sustaining Availability of Web Services under Distributed Denial of Service Attacks," IEEE Trans. Computers, vol. 52, no. 2, pp. 195-208, Feb. 2003.
38. D.K.Y. Yau, J.C.S. Lui, F. Liang, and Y. Yam, "Defending against Distributed Denial-of-Service Attacks with Max-Min Fair Server-Centric Router Throttles," IEEE/ACM Trans. Networking, pp. 29-42, Feb. 2005.
39. A. Yaar, A. Perrig, and D. Song, "Pi: A Path Identification Mechanism to Defend against DDoS Attacks," Proc. IEEE Symp. Security and Privacy, pp. 93-107, May 2003.
40. A. Yaar, A. Perrig, and D. Song, "StackPi: A New Defensive Mechanism against IP Spoofing and DDoS Attacks," Technical Report CMU-CS-02-208, Carnegie Mellon Univ., Feb. 2003.
41. A. Yaar, A. Perrig, and D. Song, "SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks," Proc. IEEE Symp. Security and Privacy, pp. 130-143, May 2004.
42. A. Yaar, A. Perrig, and D. Song, "FIT: Fast Internet Traceback," Proc. IEEE INFOCOM, pp. 1395-1406, Mar. 2005.
43. X. Yang, D. Wetherall, and T. Anderson, "A DoS-Limiting Network Architecture," Proc. ACM SIGCOMM, pp. 241-252, Aug. 2005.
44. S. Zhang and P. Dasgupta, "Denying Denial of Service Attacks: A Router Based Solution," Proc. Int'l Conf. Internet Computing, June 2003.