Robust and efficient detection of DDoS attacks for large-scale internet

Computer Networks

Volumn 51, Issue 18, 2007, Pages 5036-5056

  Lu, Kejie ^a   Wu, Dapeng ^b   Fan, Jieyan ^b   Todorovic, Sinisa ^c   Nucci, Antonio ^d  

^a UNIVERSITY OF PUERTO RICO   (Puerto Rico)

^b J Crayton Pruitt Family Department of Biomedical Engineering   (United States)

^c UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

^d Narus Inc   (United States)

Author keywords

Detection; Distributed denial of service (DDoS) attacks; Machine learning; Spatial correlation

Indexed keywords

COMPUTER SIMULATION; CORRELATION DETECTORS; INTERNET; LARGE SCALE SYSTEMS; LEARNING SYSTEMS; ROBUST CONTROL; SECURITY OF DATA;

ALARM PROBABILITY; DETECTION PROBABILITY; DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS; SPATIAL CORRELATIONS;

COMPUTER CRIME;

EID: 35549011836     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2007.08.008     Document Type: Article

References (21)

1. Mirkovic J., and Reiher P. A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communications Review 34 2 (2004) 39
2. Chen L.-C., Longstaffv T.A., and Carley K.M. Characterization of defense mechanisms against distributed denial of service attacks. Computers & Security 23 8 (2004) 665-678
3. S.S. Kim, A.L.N. Reddy, M. Vannucci, Detecting traffic anomalies using discrete wavelet transform, in: Proceedings of International Conference on Information Networking (ICOIN), Busan, Korea, 2004, vol. III, pp. 1375-1384.
4. C.-M. Cheng, H.T. Kung, K.-S. Tan, Use of spectral analysis in defense against dos attacks, in: Proceedings of IEEE GLOBECOM 2002, Taipei, Taiwan, 2002.
5. A. Hussain, J. Heidemann, C. Papadopoulos, A framework for classifying denial of service attacks, in: Proceedings of ACM SIGCOMM, Karlsruhe, Germany, 2003.
6. H. Wang, D. Zhang, K.G. Shin, Detecting SYN flooding attacks, in: Proceedings of IEEE INFOCOM'2002, New York City, NY, 2002, pp. 1530-1539.
7. T. Peng, C. Leckie, K. Ramamohanarao, Detecting distributed denial of service attacks using source IP address monitoring, Tech. Rep., Department of Computer Science and Software Engineering, The University of Melbourne, 2002. URL .
8. R.B. Blazek, H. Kim, B. Rozovskii, A. Tartakovsky, A novel approach to detection of "denial-of-service attacks via adaptive sequential and batch- sequential change-point detection methods, in: Proceedings of IEEE Workshop on Information Assurance and Security, West Point, NY, 2001, pp. 220-226.
9. S. Mukkamala, A.H. Sung, Detecting denial of service attacks using support vector machines, in: Proceedings of IEEE International Conference on Fuzzy Systems, 2003.
10. S. Savage, D. Wetherall, A. Karlin, T. Anderson, Practical network support for ip traceback, in: Proceedings of ACM SIGCOMM'2000, 2000.
11. P. Ferguson, D. Senie, Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing, IETF, RFC 2267.
12. K. Park, H. Lee, On the effectiveness of route-based packet filtering for distributed dos attack prevention in power-law internets, in: Proceedings of ACM SIGCOMM, 2001.
13. Chen S., and Song Q. Perimeter-based defense against high bandwidth DDoS attacks. IEEE Trans. Parallel Distrib. Syst. 16 6 (2005) 526-537
14. Wang H., Zhang D., and Shin K.G. Change-point monitoring for the detection of dos attacks. IEEE Transactions on Dependable and Secure Computing 4 (2004) 193-208
15. T. Peng, C. Leckie, K. Ramamohanarao, Protection from distributed denial of service attacks using history-based IP filtering, in: Proceedings of IEEE ICC 2003, Anchorage, AK, 2003, pp. 482-486.
16. L. Feinstein, D. Schnackenberg, R. Balupari, D. Kindred, Statistical approaches to DDoS attack detection and response, in: Proceedings of DARPA Information Survivability Conference and Exposition, vol. 1, 2003, pp. 303-314.
17. A. Yaar, A. Perrig, D. Song, Stackpi: New packet marking and filtering mechanisms for ddos and ip spoofing defense, Tech. Rep., Carnegie Mellon University, 2003.
18. Bloom B.H. Space/time trade-offs in hash coding with allowable errors. Communications of the ACM 13 7 (1970) 422-426
19. Frey B.J. Graphical Models for Machine Learning and Digital Communication (1998), MIT Press, Cambridge, MA
20. Scharf L.L. Statistical Signal Processing: Detection, Estimation, and Time Series Analysis (1991), Addison Wesley
21. Auckland-IV trace data, 2001. URL .