Vanguard: A new detection scheme for a class of TCP-targeted denial-of-service attacks

IEEE Symposium Record on Network Operations and Management Symposium

Volumn , Issue , 2006, Pages 507-518

  Luo, Xiapu ^a   Chan, Edmond W W ^a   Chang, Rocky K C ^a  

^a HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

Author keywords

[No Author keywords available]

Indexed keywords

DATA PRIVACY; DATA TRANSFER; INTERNET; INTRUSION DETECTION; TRANSMISSION CONTROL PROTOCOL;

DENIAL-OF-SERVICE (DOS); PULSING DOS (PDOS); REDUCTION OF QUALITY (ROQ);

COMPUTER CRIME;

EID: 34250739801     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (44)

1. D. Moore, G. Voelker, and S. Savage. Inferring internet denial of service activity. In Proc. USENIX Security Symp., 2001.
2. X. Yang and D. Wetherall and T. Anderson. A DoS-limiting network architecture. In Proc. ACM SIGCOMM, 2005.
3. D. Dittrich. http://staff.washington.edu/dittrich/misc/ddos/.
4. J. Mirkovic and P. Reiher. A taxonomy of DDoS attacks and defense mechanisms. ACM SIGCOMM Computer Communications Review, 34(2):39-54, Apr. 2004.
5. The open source network intrusion detection system: Snort. www.snort.org.
6. C. Estan, S. Savage, and G. Varghese. Automatically inferring patterns of resource consumption in network traffic. In Proc. ACM SIGCOMM, 2003.
7. F. Hao, M. Kodialam and T. Lakshman. Real-time detection of hidden traffic patterns. In Proc. IEEE ICNP, 2004.
8. P. Chhabra, A. John, and H. Saran. Pisa: Automatic extraction of traffic signatures. In Proc. IFIP Networking, 2005.
9. R. Blazek, H. Kirn, B. Rozovskii, and A. Tartakovsky. A novel approach to detection of denial of service attacks via adaptive sequential and batch-sequential change-point detection methods. In Proc. IEEE Workshop Information Assurance and Security, June 2001.
10. J. Baras, A. Cardenas, and V. Ramezani. On-line detection of distributed attacks from space-time network flow patterns. In Proc. 23rd Army Science Conf., 2002.
11. C. Jin, H. Wang, and K. Shin. Hop-count filtering: an effective defense against spoofed DDoS traffic. In Proc. ACM Conf. Computer and Communications Security (CCS), 2003.
12. Z. Zhang, J. Li, C. Manikopoulos, J. Jorgenson, and J. Ucles. Hide: A hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In Proc. of IEEE Man Systems and Cybernetics Information Assurance Workshop. IEEE, 2001.
13. H. Wang, D. Zhang, and K. Shin. Detecting SYN flooding attacks. In Proc. IEEE INFOCOM, 2002.
14. K. Wan and R. Chang. Engineering of a global defense infrastructure for DDoS attacks. In Proc. of IEEE Intl. Conf. Networks, pages 419-127, Aug. 2002.
15. S. Mukkamala and A. Sung. Detecting denial of service attacks using support vector machines. In Proc. of IEEE Intl. Conf. Fuzzy Systems, volume 2, pages 1231-1236, 2003.
16. C. Manikopoulos and S. Papavassiliou. Network intrusion and fault detection: a statistical anomaly approach. IEEE Communications Magazine, 40(10):76-82, Oct. 2002.
17. P. Barford, J. Kline, D. Plonka, and A. Ron. A signal analysis of network traffic anomalies. In Proc. ACM Internet Measurement Workshop, 2002.
18. A. Hussain and J. Heidemann and C. Papadopoulos. A framework for classifying denial of service attacks. In Proc. ACM SIGCOMM, 2003.
19. A. Kuzmanovic and E. Knightly. Low-rate TCP-targeted denial of service attacks (the shrew vs. the mice and elephants). In Proc. ACM SIGCOMM, Aug. 2003.
20. M. Guirguis, A. Bestavros, and I. Matta. Exploiting the transients of adaptation for RoQ attacks on Internet resources. In Proc. IEEE ICNP, 2004.
21. X. Luo and R. Chang. On a new class of pulsing denial-of-service attacks and the defense. In Proc. Network and Distributed System Security Symp. (NDSS), Feb. 2005.
22. Q. Li, E. Chang, and M. Chan. On the effectiveness of DDoS attacks on statistical filtering. In Proc. IEEE INFOCOM, 2005.
23. V. Paxson and M. Allman. Computing TCP's retransmission timer. RFC 2988, Nov. 2000.
24. H. Sun, J. Lui, and D. Yau. Defending against low-rate TCP attack: Dynamic detection and protection. In Proc. IEEE ICNP, 2004.
25. Y. Chen and K. Hwang and Y. Kwok. Collaborative defense against periodic Shrew DDoS attacks in frequency domain. Technical Report TR 2005-11, USC Internet and Grid Computing Lab, 2005.
26. D. R. Cox. Renewal Theory. Chapman & Hall, 1962.
27. X. Luo, R. Chang, and E. Chan. Performance analysis of TCP/AQM under denial-of-service attacks. In Proc. of IEEE Intl. Symp. Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS), 2005.
28. M. Mathis, J. Semke, J. Mahdavi, and T. Ott. The macroscopic behavior of the TCP congestion avoidance algorithm. Computer Communication Review, 27(3), Jul. 1997.
29. M. Hassan and R. Jain. High performance TCP/IP Networking: Concepts, Issues, and solutions. Pearson Education, Inc., 2004.
30. Y. Yang and S. Lam. General AIMD congestion control. In Proc. IEEE ICNP, 2000.
31. M. Allman, V. Paxson, and W. Stevens. TCP congestion control. RFC 2581, Apr. 1999.
32. n with stationary coefficients. Advances in Applied Probability, 18(1), 1986.
33. t with nonstationary coefficients. Journal of Applied Probability, 38(1), 2001.
34. E. Altman, K. Avrachenkov, and C. Barakat. A stochastic model of TCP/IP with stationary random losses. IEEE/ACM Trans. Networking, 13(2), 2005.
35. K. Chandrayana and S. Kalyanaraman. Uncooperative congestion control. In Proc. ACM SIGMETRICS, 2004.
36. J. Mirkovic, G. Prier, and P. Reiher. Attacking DDoS at the source. In Proc. IEEE ICNP, 2002.
37. C. Chatfield. The Analysis of Time Series: An Introduction. Chapam & Hall/CRC, sixth edition, 2003.
38. M. Stricker and M. Orengo. Similarity of color images. In Proc. SPIE Conf. Storage and Retrieval for Image and Video Databases III, 1995.
39. A. Smoulders, M Worring, S. Santini, A. Gupta and R. Jain. Content-based image retrieval at the end of the early years. IEEE Trans. Pattern Analysis and Machine Intelligence, 2000.
40. B. Brodsky and B. Darkhovsky. Non-Parametric Statistical Diagnosis Problems and Methods. Kluwer Academic Publishers, The Netherlands, 2000.
41. M. Weeks and M. Bayoumi. Discrete wavelet transform: Architectures, design and performance issues. Journal of VLSI Signal Processing, 35, 2003.
42. A. Oppenheim, A. Willsky, and S. Nawab. Signals and Systems. Prentice Hall, second edition edition, 1996.
43. NLANR/DAST: Iperf 1.7.0 - The TCP/UDP bandwidth measurement tool. Available from http://dast.nlanr.net/Projects/Iperf/, 2003.
44. I. Daubechies. Ten lectures on wavelets. Society for Industrial and Applied Mathematics, Philadelphia, PA, USA, 1992.