NetBouncer: Client-legitimacy-based high-performance DDoS filtering

Proceedings - DARPA Information Survivability Conference and Exposition, DISCEX 2003

Volumn 1, Issue , 2003, Pages 14-25

  Thomas, R ^a   Mark, B ^b   Johnson, T ^a   Croall, J ^a  

^a Network Associates   (United States)

^b George Mason University   (United States)

Author keywords

Communication system traffic control; Computer crime; Filtering; Home appliances; Inductors; Isolation technology; Laboratories; Network servers; Protection; Testing

Indexed keywords

COMPUTER CONTROL SYSTEMS; COMPUTER CRIME; DENIAL-OF-SERVICE ATTACK; DISTRIBUTED COMPUTER SYSTEMS; DOMESTIC APPLIANCES; ELECTRIC INDUCTORS; FILTRATION; LABORATORIES; LONG TERM EVOLUTION (LTE); NETWORK SECURITY; PACKET NETWORKS; TELECOMMUNICATION TRAFFIC; TESTING;

COMMUNICATION SYSTEM TRAFFIC; DISTRIBUTED DENIAL OF SERVICE ATTACK; HIGH-SPEED PACKET PROCESSING; HIGH-SPEED ROUTERS; ISOLATION TECHNOLOGY; NETWORK PROCESSOR; NETWORK SERVER; PROTECTION;

TRAFFIC CONGESTION;

EID: 34250620174     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DISCEX.2003.1194869     Document Type: Conference Paper

References (25)

1. D.J. Bernstein, SYN Cookies, http://cr.yp.to/syncookies.html
2. Peakflow/DoS, Arbor networks, http://www.arbornetworks.com/up-media/up-files/Pflow-Enter-datasheet2.1.pdf
3. DDoS Enforcer, Mazu Networks, http://www.mazunetworks.com/solutions/product-overview.html#300
4. Asta vantage System, Asta Networks, http://www.astanetworks.com/products/vantage/
5. S. Capshaw, Minimizing the Effects of DoS Attacks, Application Note, Juniper networks, November 2000, http://www.juniper.net/techcenter/app-note/350001.pdf
6. Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks, White Paper, CISCO Systems, http://www.cisco.com/warp/public/707/newsflash.html
7. Characterizing and Tracing Packet Floods Using Cisco Routers, Technical Note, CISCO Systems, July 1999, http://www.cisco.com/warp/public/707/22.html
8. Configuring TCP Intercept (Prevent Denial-of Service Attacks), CISCO Systems, http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed-cr/secur-c/scprt3/scdenial.htm
9. Cisco IOS Netflow, http://www.cisco.com/warp/public/732/Tech/nmp/netflow
10. D. Dean and A. Stubblefield, Using client puzzles to protect TLS, Proceedings of the 10th USENIX Security Symposium, Washington, D.C, August 13-17, 2001.
11. M. Degermark, A. Brodnik, S. Carlsson and S. Pink, Small forwarding tables for fast routing slookups, ACM Computer Communication Review, 27 (4), pages 3 -14, October 1997.
12. A. Demers, S. Keshav, and S. Shenker, Analysis and simulation of a fair queueing algorithm, Internet Res. and experience, Volume 1, 1990.
13. S. Dietrich, N. Long and D. Dittrich, Analyzing Distributed Denial of Service Tools: The Shaft Case, Proceedings of the LISA XIV, December 3-8, 2000, New Orleans, LA.
14. R. Fan, A. Ishii, A. Itoh, M. Kobayashi, B. Mark, T. Muira, G. Ramamurthy, Q. Ren, S. Shibuya, H. Shimonishi and K. Yamada, ARC-LITE: An integrated quality-of-service ATM/IP switching-routing engine, In Proc. IEEE ATM Workshop '99, Koichi City, pages 161-166, May 1999.
15. N. Ferugson, Michael: an improved MIC for 802.11 WEP, IEEE P802.11, Wireless LANs, MacFergus, Bart de Ligtstraat 64, 1097 JE Amsterdam, Netherlands, January 17, 2002.
16. S. Golestani, A Self-Clocked Fair Queuing Scheme for Broadband Applications, Proc. IEEE INFOCOM'94, April 1994, pp. 636-646.
17. R. Mahajan, S. Bellovin, D. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, Controlling High Bandwidth Aggregates in the network, AT&T Center for Internet research at ICSI (ACIRI), DRAFT, February 5, 2001, http://www.research.att.com/~smb/papers/ddos-lacc.pdf
18. D. P. Morrison, Practical algorithm to retrieve information coded in Alfanumeric, Journal of ACM 15, 4 (October 1968), pages 514-534.
19. A. McAuley and P. Francis, Fast routing table lookup using CAMs, In Proceedings of INFOCOM, pages 1382-1391, March-April, 1993.
20. S. Nilsson and G. Karlsson, Fast Address Lookup for Internet Routers, In Proceedings of the International Conference on Broadband Communication, April 1998.
21. A.K. Parekh and R.G. Gallager, A Generalized Processor Sharing Approach to Flow Control in Integrated Services Networks - The Single Node Case, IEEE Trans. on Networking, June 1993, pages 344-357.
22. K. Park and H. Lee, "On the Effectiveness of Route-based Packet Filtering for Distributed DoS Attack Prevention in Power-law Internets," in Proceeding of the ACM SIGCOMM '01, pages 15-26. 2
23. D. Schnackenberg, K. Djahandari, and D. Sterne, "Infrastructure for Intrusion Detection and Response", Proceedings of the DARPA Information Survivability Conference and Exposition, Hilton Head, SC, January 2000.
24. R. K. Thomas, B. Mark, T. Johnson, J. Croall, High-speed Legitimacy-based DDoS Packet Filtering with Network Processors: A Case Study and Implementation on the Intel IXP1200, To appear in the Proceedings of the second Workshop on Network Processors - NP2, February 8-9, 2003, Anaheim, CA.
25. M. Waldvogel, G. Varghese, J. Turner, Bernhard Plattner, Scalable High Speed IP Routing Lookups, In Proceedings of SIGCOMM '97.