Distributed management architecture for cooperative detection and reaction to DDoS attacks

Journal of Network and Systems Management

Volumn 12, Issue 1, 2004, Pages 73-94

  Koutepas, G ^a   Stamatelopoulos, F ^a   Maglaris, B ^a  

^a NATIONAL TECHNICAL UNIVERSITY OF ATHENS   (Greece)

Author keywords

Automated reaction; Distributed management; Inter domain; Multicast; Network security

Indexed keywords

DATA PROCESSING; DEMODULATION; INFORMATION TECHNOLOGY; MULTICASTING; OPTIMIZATION; SECURITY OF DATA; SOFTWARE PROTOTYPING; WEBSITES;

AUTOMATED REACTION; DISTRIBUTED MANAGEMENT; INTER-DOMAIN; NETWORK SECURITY;

COMPUTER NETWORKS;

EID: 3543107873     PISSN: 10647570     EISSN: None     Source Type: Journal    
DOI: 10.1023/B:JONS.0000015699.50210.e3     Document Type: Review

References (26)

1. G. Koutepas, F. Stamatelopoulos, and B. Maglaris, Efficiency and performance issues in distributed intrusion detection systems, Applied Telecommunication Symposium 2002 (ATS 02), San Diego, California, April 2002.
2. D. Moore, G. Voelker, and S. Savage, Inferring Internet denial-of-service activity, Proc. Tenth USENIX Sec. Symp., 2001.
3. Minho Sung, Markus Haas, and Jun Xu, Analysis of DoS attack traffic data, 2002 FIRST Conference (www.first.org), Hawaii, June 2002.
4. R. Chang, Defending against flooding-based distributed denial-of-service attacks: A tutorial, IEEE Communications Magazine, pp. 42-51, October 2001.
5. J. Mirkovic, J. Martin, and P. Reiher, A Taxonomy of DDoS attacks and DDoS defense mechanisms, University of California, Technical Report#020018 2002. (Also available at http://www.lasr.cs.ucla.edu/ddos/ucla_tech_report_020018. pdf)
6. M. Behringer, Tracing DoS attacks, Hi Tech 2002 Workshop, Limmerick, IE, June 2002.
7. R. Manajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, Controlling high bandwidth aggregates in the network, ACM SIGCOMM Computer Communication Review, Vol. 32, No. 3, pp. 62-73, 2002.
8. C. Estan and G. Varghese, "New directions in traffic measurement and accounting, Proceedings of the 2001 ACM SIGCOMM Internet Measurement Workshop, pp. 75-80, (San Francisco, California), November 2001.
9. Cisco IOS NetFlow, http://www.cisco.com/warp/public/732/Tech/nmp/netflow/ index.shtml
10. C. Kotsokalis, D. Kalogeras, and B. Maglaris, Router-based detection of DoS and DDoS attacks, HP Open View University Association (HPOVUA) Conference '01, Berlin, Germany, June 2001.
11. K. K. Wan and R. Chang, Engineering of a global defence infrastructure for DDoS attacks, Proc. of IEEE International Conference on Networking, August 2002.
12. D. Sterne, K. Djahandari, B. Wilson, B. Babson, D. Schnackenberg, H. Holliday, and T. Reid, Autonomic response to distributed denial-of-service attacks, Proceedings of the Fourth International Symposium on Recent Advances in Intrusion Detection, RAID 2001, Davis, California, pp. 134-149, October 2001.
13. D. Schnackenberg, K. Djahandari, and D. Sterne, Infrastructure for intrusion detection and response, Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEXII), Anaheim, California, January 2000.
14. A. Snoeren, C. Partridge, L. Sanchez, C. Jones, F. Tchakountio, S. Kent, and W. Strayer, Hash-based IP traceback, Proceedings of the ACM SIGCOMM 2001 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, August 2001.
15. J. Ioannidis and S. Bellovin, Implementing pushback: Router-based defense against DDoS attacks, Network and Distributed System Security Symposium, NDSS '02, San Diego, California, February 2002.
16. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, Practical network support for IP traceback, Proceedings of the ACM SIGCOMM Conference, Stockholm, Sweden, pp. 295-306, August 2000.
17. D. Dean, M. Franklin, and A. Stubblefield, An algebraic approach to IP traceback, Network and Distributed System Security Symposium, NDSS '01, February 2001.
18. R. Stone, CenterTrack: An IP overlay network for tracking DoS floods, Ninth USENIX Security Symposium, Denver Colorado, August 2000.
19. K. Park and H. Lee, On the effectiveness of route-based packet filtering for distributed DDoS attack prevention in power-law internets, Proc. of the ACM SIGCOMM, 2001.
20. Trusted Introducer for CSIRTs in Europe, http://www.ti.terena.nl/
21. K. Almeroth, The evolution of multicast: From the MBone to inter-domain multicast to Internet2 deployment, IEEE Network, January /February 2000.
22. D. Curry and H. Debar, Intrusion detection message exchange format data model and extensible Markup Language (XML) document type definition, IETF Internet Draft, draft-ietf-idwg-idmef-xml-10.txt, January 2003.
23. Sun Microsystems, Java Management Extensions Instrumentation and Agent Specification, v1. 2, February 2002. http://jcp.org/aboutJava/communityprocess/ final/jsr003/index3.html
24. K. Wan, An infrastructure to defend against distributed denial-of-service attack, M.Sc. Thesis, The Hong Kong Polytechnic University, June 2001.
25. Q. Zhang and R. Janakiraman, Indra: A distributed approach to network intrusion detection and prevention, Washington University Technical Report # WUCS-01-30, 2001.
26. D. Frincke, D. Tobin, J. McConnell, J. Marconi, and D. Polla, A framework for cooperative intrusion detection, Proceedings of the 21st National Information Systems Security Conference, pp. 361-373, October 1998.