A coordinated detection and response scheme for distributed denial-of-service attacks

IEEE International Conference on Communications

Volumn 5, Issue , 2006, Pages 2165-2170

  Lam, Ho Yu ^a   Li, Chi Pan ^a   Chanson, Samuel T ^a   Yeung, Dit Yan ^a  

^a HONG KONG UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Hong Kong)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER SIMULATION; INTERNET; RESOURCE ALLOCATION; SERVERS;

DISTRIBUTED DENIAL-OF-SERVICE (DDOS); RESPONSE SCHEME;

INTRUSION DETECTION;

EID: 42549129280     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2006.255091     Document Type: Conference Paper

References (29)

1. Arbor Networks, "Worldwide ISP security report," Sept. 2005. [Online]. Available: http://www.arbor.net/downloads/Arbor.Worldwide. ISP.Security.Report.pdf
2. A. Hussain, J. Heidemann, and C. Papadopoulos, "A framework for classifying denial of service attacks," in Proc. of the ACM SIGCOMM '03, Karlsruhe, Germany, Aug 2003.
3. S. Savage, D. Wetherall, A. R. Karlin, and T. Anderson, "Network support for IP traceback," ACM/IEEE Transactions on Networking, vol. 9, no. 3, pp. 226-237, June 2001.
4. D. Song and A. Perrig, "Advanced and authenticated marking schemes for IP traceback," in Proc. of the IEEE INFOCOM '01, vol. 2, April 2001, pp. 878-886.
5. A. C. Snoeren, C. Partridge, L. A. Sanchez, C. E. Jones, F. Tchakountio, B. Schwartz, S. T. Kent, and W. T. Strayer, "Single-packet IP traceback," IEEE/ACM Transactions on Networking, vol. 10, no. 6, pp. 721-734, December 2002.
6. J. Li, M. Sung, J. Xu, and L. Li, "Large-scale IP traceback in high-speed internet: practical techniques and theoretical foundation," in Proc. of the 2004 IEEE Symp. on Security and Privacy, May 2004, pp. 115-129.
7. K. Park and H. Lee, "On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack," in Proc. of the IEEE INFOCOM '01, vol. 1, April 2001, pp. 338-347.
8. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the source," in Proc. of 10th IEEE International Conference on Network Protocols, Nov 2002, pp. 312-321.
9. A. D. Keromytis, V. Misra, and D. Rubenstein, "SOS: Secure overlay services," in Proc. of the ACM SIGCOMM '02, Pittsburgh, Pennsylvania, USA, Aug 2002, pp. 61-72.
10. M. Sung and J. Xu, "IP traceback-based intelligent packet filtering: A novel technique for defending against Internet DDoS attacks," in Proc. of 10th IEEE International Conference on Network Protocols, Nov 2002, pp. 302-311.
11. A. Yaar, A. Perrig, and D. Song, "Pi: A path identification mechanism to defend against DDoS attacks," to appear in Proc. of the IEEE Symposium on Security and Privacy, May 2003.
12. R. Thomas, B. Mark, T. Johnson, and J. Croall, "NetBouncer: Client-legitimacy-based high-performance DDoS filtering," in Proc. of the DARPA Information Survivability Conference and Exposition, vol. 1, April 2003, pp. 14-25.
13. J. Kang, Z. Zhang, and J. bin Ju, "Protect e-commerce against DDoS attacks with improved D-WARD detection system," in Proc. of the 2005 IEEE International Conference on e-Technology, e-Commerce and e-Service, March 2005, pp. 100-105.
14. R. Mahajan, S. M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker, "Controlling high bandwidth aggregates in the network," Technical Report, AT&T Center for Internet Research at ICSI, July 2001.
15. D. K. Y. Yau, J. C. S. Lui, and F. Liang, "Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles," in Proc. of the IEEE International Workshop on Quality of Service, May 2002, pp. 35-44.
16. K. K. K. Wan and R. K. C. Chang, "Engineering of a global defense infrastructure for DDoS attacks," in Proc. of the IEEE International Conference on Networks, Aug 2002, pp. 419-427.
17. C. Papadopoulos, R. Lindell, J. Mehringer, A. Hussain, and R. Govindan, "COSSACK: Coordinated suppression of simultaneous attacks," in Proc. of the DARPA Information Survivability Conference and Exposition, vol. 1, April 2003, pp. 2-13.
18. J. Mirkovic, M. Robinson, and P. Reiher, "Alliance formation for DDoS defense," in NSPW '03: Proc. of the 2003 workshop on New security paradigms. New York, NY, USA: ACM Press, 2003, pp. 11-18.
19. H. Sun, J. C. Lui, and D. K. Yau, "Defending against low-rate TCP attacks: dynamic detection and protection," in Proc. of the 12th IEEE International Conference on Network Protocols, Oct 2004, pp. 196-205.
20. K. Calvert, M. Doar, and E. W. Zegura, "Modeling internet topology," IEEE Communications Magazine, vol. 35, pp. 160-163, June 1997.
21. B. H. Bloom, "Space/time trade-offs in hash coding with allowable errors," Commun. ACM, vol. 13, no. 7, pp. 422-426, 1970.
22. T. Gil and M. Poleto, "MULTOPS: A data-structure for bandwidth attack detection," in Proc. of the 10th Usenix Security Symposium, August 2001, pp. 23-28.
23. R. B. Blazek, H. Kim, B. Rozovskii, and A. Tartakovsky, "A novel approach to detection of "denial-of-service" attacks via adaptive sequential and batch-sequential change-point detection methods," in Proc. of the 2nd Annual IEEE Systems, Man, and Cybernetics Information Assurance Workshop, West Point, NY, June 2001.
24. B. E. Brodsky and B. S. Darkhovsky, "Nonparametric methods in change-point problems," Kluwer Academic Publishers, 1993.
25. H. Lam, C. Li, S. Chanson, and D. Yeung, "A coordinated detection and response scheme for distributed denial-of-service attacks," Department of Computer Science, Hong Kong University of Science and Technology, Tech. Rep. Technical Report HKUST-CS06-01, March 2006, ftp://ftp.es.ust.hk/pub/techreport/ 06/tr06-01.pdf.
26. H. Wang, D. Zhang, and K. G. Shin, "SYN-dog: Sniffing SYN flooding sources," in Proc. of the IEEE International Conference on Distributed Computing Systems' 2002, Vienna, Austria, July 2002, pp. 421-428.
27. L. N. R. Group. (1997, Sept.) UCB/LBNL/VINT network simulator-ns (version 2). [Online]. Available: http://www-mash.cs.berkeley.edu/ns/
28. MAWI working group traffic archive. [Online]. Available: http: //tracer.csl.sony.co.jp/mawi
29. DDoS attack tools (TFN, TEN2k and Trinoo) download website. [Online]. Available: http://www.angelfire.com/rock/nsi/