The need for a multi-perspective approach to solve the DDoS problem

Bell Labs Technical Journal

Volumn 12, Issue 3, 2007, Pages 121-130

  Hernandez Herrero, Jorge ^a   Solworth, Jon A ^b,c,d,e  

^a NOKIA RESEARCH CENTER   (United States)

^b UNIVERSITY OF ILLINOIS AT CHICAGO   (United States)

^c Kernel Security and Networking Laboratory

^d ASSOCIATION FOR COMPUTING MACHINERY   (United States)

^e IEEE

Author keywords

[No Author keywords available]

Indexed keywords

DENIAL OF SERVICE (DDOS); INTERORGANIZATIONAL PERSPECTIVE; NETWORKED SYSTEMS; PACKET FLOODING ATTACKS;

COSTS; DISTRIBUTED COMPUTER SYSTEMS; INTERNET PROTOCOLS; PACKET NETWORKS; PROBLEM SOLVING;

COMPUTER CRIME;

EID: 36549001307     PISSN: 10897089     EISSN: 15387305     Source Type: Journal    
DOI: 10.1002/bltj.20254     Document Type: Article

References (64)

1. S. Agarwal, T. Dawson, and C. Tryfonas, DDoS Mitigation via Regional Cleaning Centers, Sprint ATL, Res. Report RR04-ATL-013177, Jan. 2004, 〈http://ipmon.sprint.com/publications/uploads/RR04-ATL-013177.pdf〉.
2. Akamai Technologies, 〈http.7/www.akamai. com〉.
3. R. Anderson, "Why Information Security Is Hard-An Economic Perspective," Proc. 17th Annual Comput. Security Applications Conf. (ACSAC '01) (New Orleans, LA, 2001), pp. 358-365.
4. T. Anderson, T. Roscoe, and David Wetherall, "Preventing Internet Denial-of-Service with Capabilities," ACM SIGCOMM Comput. Commun. Rev., 34:1 (2004), 39-44.
5. Arbor Networks, "Managed Security Services: DDoS Protection and Mitigation," 〈http://www.arbornetworks.com〉.
6. K. Argyraki and D. R. Cheriton, "Active Internet Traffic Filtering: Real-Time Response to Denial of Service Attacks," Proc. USENIX Annual Tech. Conf. (USENIX '05) (Anaheim, CA, 2005), pp. 135-148.
7. K. Argyraki and D. R. Cheriton, "Network Capabilities: The Good, the Bad and the Ugly," Proc. ACM Hot Topics in Networks, Fourth Workshop (HotNets-IV '05) (College Park, MD, 2005).
8. Avantgarde, "Automated "Bots" Overtake PCs Without Firewalls Within 4 Minutes," Press Release, Nov. 30, 2004, 〈http://www. avantgarde.com/ttln113004.html〉.
9. D. Awduche, A. Chiu, A. Elwalid, I. Widjaja, and X. Xiao, "Overview and Principles of Internet Traffic Engineering," IETF RFC 3272, May 2002, 〈http://www.ietf.org/rfc/rfc3272.txt.〉.
10. P. Bacher, T. Holz, M. Kotter, and G. Wicherski, "Know Your Enemy: Tracking Botnets-Using Honeynets to Learn More About Bots," Honeynet Project and Research Alliance, Mar. 2005, 〈http://honeynet.org/papers/bots/ 〉.
11. S. Bekker, "Microsoft Taps Akamai for DNS Backup System," redmondmag.com, Jan. 29, 2001, 〈http://redmondmag.com/news/article.asp? EditorialsID=368〉.
12. S. Berinato, "How a Bookmaker and a Whiz Kid Took On an Extortionist-and Won," CSO, Nov. 22, 2003, 〈http://www.csoonline.com/ read/050105/extortion.html〉.
13. B. Braden, D. Clark, J. Crowcroft, B. Davie, S. Deering, D. Estrin, S. Floyd, V. Jacobson, G. Minshall, C. Partridge, L. Peterson, K. Ramakrishnan, S. Shenker, J. Wroclawski, and L. Zhang, "Recommendations on Queue Management and Congestion Avoidance in the Internet," IETF RFC 2309, Apr. 1998, 〈http://www.ietf.org/rfc/rfc2309.txt〉.
14. M. Casado, P. Cao, A. Akella, and N. Provos, "Flow-Cookies: Using Bandwidth Amplification to Defend Against DDoS Flooding Attacks," Proc. 14th IEEE Internat. Workshop on Quality of Service (IWQoS '06) (New Haven, CT, 2006), pp.286-287.
15. CERT®, "TCP SYN Flooding and IP Spoofing Attacks," Advisory CA-1996-21, Nov. 29, 2000, 〈http://www.cert.org/advisories/CA-1996-2l. html〉.
16. Cisco Systems, "Cisco Guard DDoS Mitigation Appliances," Case Studies, 〈http://www. cisco.com〉.
17. Cisco Systems, "Remotely Triggered Black Hole Filtering-Destination Based and Source Based," 2005, 〈http://www.cisco.com〉.
18. R. Clayton, "Complexities in Criminalizing Denial of Service Attacks," Feb. 2006, 〈http://www.cl.cam.ac.uk/~rncl/complexity. pdf〉.
19. DoS and DDoS Attacks Information, "Who Are the Major Players in the Market for Anti-DoS/Anti-DDoS Equipment?" 〈http://www.dos-attacks.com/ html/major_market.htm〉.
20. P. Ferguson and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing," IETF RFC 2827, May 2000, 〈http://www.ietf.org/rfc/rfc2827.txt〉.
21. S. Floyd, "Congestion Control Principles," IETF RFC 2914, Sept. 2000, 〈http://www.ietf.org/rfc/rfc2914.txt〉.
22. P. Francis, "Firebreak: An IP Perimeter Defense Architecture," 2004, 〈http://www.es.Cornell. edu/People/francis/firebreak/hotnets- firebreak-v7.pdf〉.
23. F. C. Freiling, T. Holz, and G. Wicherski, "Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks," RWTH Aachen University, TR AIB-2005-07, Apr. 2005, 〈http://sunsite.informatik.rwth-aachen.de/Publications/AIB/2005/2005-07. pdf〉.
24. L. Garber, "Denial-of-Service Attacks Rip the Internet," IEEE Comput., 33:4 (2000), 12-17.
25. A. Greenhalgh, M. Handley, and F. Huici, "Using Routing and Tunneling to Combat DoS Attacks," Proc. 1st Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI '05) (Cambridge, MA, 2005), sponsored by USENIX Assoc., pp. 1-7.
26. M. Handley and A. Greenhalgh, "Steps Towards a DoS-Resistant Internet Architecture," Proc. ACM SIGCOMM Workshop on Future Directions on Network Architecture (FDNA '04) (New York, NY, 2004), pp. 49-56.
27. M. Hofmann and L. R. Beaumont, "Content Networking: Architecture, Protocols, and Practice," Morgan Kaufmann, San Francisco, 2005.
28. T. Holz, "A Short Visit to the Bot Zoo," IEEE Security Privacy, 3:3 (2005), 76-79.
29. Insecure.Org, "Ping Of Death," Jan. 1997, 〈http:// insecure.org/sploits/ping-o-death.html〉.
30. IT-Observer, "Ping Of Death Comes to Solaris," Jan. 31, 2007, 〈http://www.it-observer. com/news.php?id=7040〉.
31. F. Kargl, J. Maier, and M. Weber, "Protecting Web Servers from Distributed Denial of Service Attacks," Proc. 10th Internat. World Wide Web Conf. (WWW '01) (Hong Kong, 2001), pp. 514-524.
32. G. Keizer, "Botnet Herder Corralled, Sentenced to 57 Months," Inform. Week, May 9, 2006, 〈http://www.informationweek.com/news/ showArticle.jhtml?articleID=187201638〉.
33. kernelSec, 〈http://www.kernelsec.org/〉.
34. A. D. Keromytis, V. Misra, and D. Rubenstein, "SOS: An Architecture for Mitigating DDoS Attacks," IEEE J. Select. Areas in Commun., 22:1 (2004), 176-188.
35. M. Kotadia, "National Australia Bank Hit by DDoS Attack," ZDNet Australia, Oct. 20, 2006, 〈http://www.zdnet.com.au/news/security/soa/ National-Australia-Bank-hit-by-DDoS-attack/0,130061744,339271790,00.htm〉.
36. B. Krebs, "Invasion of the Computer Snatchers," washingtonpost.com, Feb. 19, 2006, 〈http://www.washingtonpost.com/wp-dyn/ content/article/2006/02/14/AR2006021401342.html〉.
37. B. Krebs, "Blue Security Kicked While It's Down," washingtonpost.com, May 17, 2006, 〈http://blog.washingtonpost.com/ securityfix/2006/05/blue_security_surrenders_but_s.html〉.
38. D. R. Kuhn, T. J. Walsh, and S. Fries, "Security Considerations for Voice Over IP Systems," National Institute of Standards and Technology, Computer Security Division, NIST SP 800-58, Jan. 2005, 〈http://csrc.nist. gov〉.
39. R. LeMay, "The 12-Minute Windows Heist," ZDNet Australia, July 1, 2005, 〈http://www.zdnet.com.au/news/security/soa/The-12-minute-Windows- heist/0,130061744,139200021,00.htm〉.
40. R. Lemos, "Blue Security Folds Under Spammer's Wrath," SecurityFocus, May 17, 2006, 〈http://www.securityfocus.com/news/ 11392〉.
41. J. Leyden, "DDoS Attacks Go Through the Roof," The Register, Feb. 12, 2004, 〈http://www.theregister.co.uk/2004/02/12/ ddos_attacks_go_through/〉.
42. J. Leyden, "Spamhaus Repels DDoS Attack," The Register, Sept. 18, 2006, 〈http://www.theregister.co.uk/2006/09/18/spamhaus_ddos_attack/ 〉.
43. Limelight Networks, 〈http://www. limelightnetworks.com〉.
44. R. Mahajan, S. M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling High Bandwidth Aggregates in the Network," ACM SIGCOMM Comput, Commun. Review, 32:3 (2002), 62-73.
45. R. McMillan, "Botnet Attack Targets Root Servers," CSO, Feb. 7, 2007, 〈http://www2. csoonline.com/blog_view.html?CID=28654〉.
46. R. Miller, "DDoS Attacks Target Final Fantasy XI," Netcraft, Apr. 19, 2005, 〈http://news.netcraft.com/archives/2005/04/19/ ddos_attacks_target_final_fantasy_xi.html〉.
47. R. Miller, "Payment Gateway StormPay Battling Sustained DDoS Attack," Netcraft, Feb. 10, 2006, 〈http://news.netcraft.com/archives/ 2006/02/10/payment_gateway_stormpay_ battling_sustained_ddos_attack.html〉.
48. J. Mirkovic and P. Reiher, "A Taxonomy of DDoS Attack and DDoS Defense Mechanisms," ACM SIGCOMM Comput. Commun. Review, 34:2 (2004), 39-53.
49. D. Moore, G. M. Voelker, and S. Savage, "Inferring Internet Denial-of-Service Activity," Proc. 10th USENIX Security Symposium (USENIX Security '01) (Washington D.C., 2001), pp. 9-22.
50. OUT-LAW.COM, "UK Bans Denial of Service Attacks," OUT-LAW News, Sept. 11, 2006, 〈http://www.out-law.com/page-7462〉.
51. K. Park and H. Lee, "On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets," Proc. ACM SIGCOMM Conf. Applications, Technol., Architectures, and Protocols for Comput. Commun. (SIGCOMM '01) (San Diego, CA, 2001), pp. 15-26.
52. V. Paxson, "An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks," ACM SIGCOMM Comput. Commun. Review, 31:3 (2001), 38-47.
53. J. H. Saltzer, D. P. Reed, and D. D. Clark, "End-to-End Arguments in System Design," ACM Trans. Comput. Syst., 2:4 (1984), 277-288.
54. Secure Computing, "CipherTrust's Zombie Stats," 〈http://www.ciphertrust.com/resources/statistics/zombie.php〉.
55. C. Shields, "What Do We Mean by Network Denial of Service?" Proc. 3rd Annual IEEE Inform. Assurance Workshop (IAW '02) (West Point, NY, 2002), 196-203.
56. A. Stavrou, D. L. Cook, W. G. Morein, A. D. Keromytis, V. Misra, and D. Rubenstein, "WebSOS: An Overlay-Based System for Protecting Web Servers from Denial of Service Attacks," Comput. Networks, 48:5 (2005), 781-807.
57. T. Sterling, "Dutch Say Suspects Hacked 1.5M Computers," USA Today, Oct. 2005, 〈http://www.usatoday.com/tech/news/computersecurity/2005- 10-20-dutch-hack_ x.htm〉.
58. B. Teitelbaum and S. Shalunov, "Why Premium IP Service Has Not Deployed (and Probably Never Will)," Internet2 QoS Working Group Informational Doc, May 3, 2002, 〈http://qos. internet2.edu/wg/documents- informational/20020503-premium-problems-non-architectural.html〉.
59. United States, National Security Agency, Central Security Service (NSA/CSS), "Security-Enhanced Linux," 〈http://www.nsa.gov/ selinux/〉.
60. P. Vixie, G. Sneeringer, and M. Schleifer, "Events of 21-Oct-2002," Nov. 24, 2002, 〈http://d.root-servers.org/october21. txt〉.
61. J. Wang, X. Liu, and A. A. Chien, "Empirical Study of Tolerating Denial-of-Service Attacks With a Proxy Network," Proc. 14th USENIX Security Symposium (USENIX Security '05) (Baltimore, 2005), pp. 51-64.
62. B. Warner, "Home PCs Rented Out in Sabotage-for-Hire Racket," USA Today, July 7, 2004, 〈http://www.usatoday.com/tech/news/ computersecurity/2004-07-07-zombie-pimps_x.htm/〉.
63. A. Yaar, A. Perrig, and D. Song, "SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks," Proc. IEEE Symposium Security and Privacy (S&P '04) (Oakland, CA, 2004), pp. 130-143.
64. X. Yang, D. Wetherall, and T. Anderson, "A DoS-Limiting Network Architecture," Proc. ACM SIGCOMM Conf. Applications, Technol., Architectures, and Protocols for Comput. Commun. (SIGCOMM '05) (Philadelphia, PA, 2005), pp. 241-252.