DDoS-shield: DDoS-resilient scheduling to counter application layer attacks

IEEE/ACM Transactions on Networking

Volumn 17, Issue 1, 2009, Pages 26-39

  Ranjan, Suprana,aya ^a,b   Swaminathan, Ram ^c   Uysal, Mustafa ^c   Nucci, Antonio ^b   Knightly, Edward ^a  

^a Rice University   (United States)

^b Narus Inc   (United States)

^c HEWLETT PACKARD LABORATORIES   (United States)

Author keywords

Anomaly detection; Application layer attacks; Denial of service attacks; Information entropy; Site security monitoring

Indexed keywords

COMPUTER CRIME; INTERNET PROTOCOLS; MONITORING; NETWORK SECURITY; SCHEDULING; SERVERS; TELECOMMUNICATION NETWORKS;

ANOMALY DETECTION; APPLICATION LAYER ATTACKS; DENIAL-OF-SERVICE ATTACKS; INFORMATION ENTROPY; SITE SECURITY MONITORING;

APPLICATIONS;

EID: 61449207953     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2008.926503     Document Type: Article

References (35)

1. S. Ranjan, R. Swaminathan, M. Uysal, and E. Knightly, "DDoS-resilient scheduling to counter application layer attacks under imperfect detection," presented at the IEEE 1NFOCOM, Barcelona, Spain, Apr. 2006.
2. S. Ranjan, "High performance DDoS-resilient web cluster architecture" Ph.D. Dissertation, Rice Univ., Houston, TX, Oct. 2005 [Online]. Available: http://www.ece.rice.edu/-sranjan
3. Cyber Security: A Crisis of Prioritization. P.I.T.A. Committee [Online]. Available: www.hpcc.gov/pitac/reports/20050301-Cybersecurity/ cybersecurity.pdf
4. Know Your Enemy: Tracking Botnets. Honeynet Project and Research Alliance [Online]. Available: http://www.honeynet.org
5. United States Vs Jay Echouafni et al. (Operation Cyber-slam) U.S. Dept. Justice [Online]. Available: www.usdoj.gov/criminal/fraud/docs/ reports/2004/websnare.pdf
6. S. Ranjan, R. Karrer, and E. Knightly, "Wide area redirection of dynamic content in Internet data centers," presented at the IEEE INFOCOM, Hong Kong, 2004.
7. TPC-W benchmark. Transaction Processing Council [Online]. Available: http://www.tpc.org
8. Akamai. [Online]. Available: http://www.akamai.com
9. S. Ranjan, J. Rolia, H. Fu, and E. Knightly, "QoS-driven server migration for Internet data centers," presented at the IWQoS, Miami Beach, FL, 2002.
10. M. Aron, D. Sanders, P. Druschel, and W. Zwaenepoel, "Scalable content-aware request distribution in cluster-based network servers," presented at the USENIX Annual Technical Conf., San Diego, CA, Jun. 2000.
11. C. Amza, A. Cox, and W. Zwaenepoel, "Conflict-aware scheduling for dynamic content applications," presented at the 4th USENIX Symp. Internet Technologies and Systems (USITS), Seattle, WA, Mar. 2003.
12. N. Bhatti, A. Bouch, and A. Kuchinsky, "Integrating user-perceived quality into web server design," presented at the World Wide Web Conf., Amsterdam, 2000.
13. T. Calinski and J. Harabasz, "A dendrite method for cluster analysis," Communications in Statistics, vol. 3, pp. 1-27, 1974.
14. G. W. Milligan and M. C. Cooper, "An examination of procedures for determining the number of clusters in a data set," Pyschometrika, vol. 50, pp. 159-179, 1985.
15. T. M. Cover and J. A. Thomas, Elements of Information Theory. New York: Wiley, 1991.
16. I. Csiszar, "The method of types," IEEE Trans. Inf. Theory, vol. 44, pp. 2505-2523, 1998.
17. S. Kandula, D. Katabi, M. Jacob, and A. W. Berger, "Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds," presented at the NSDI, Boston, MA, 2005.
18. Y. Kim, W. C. Lau, M. C. Chuah, and H. J. Chao, "PacketScore: Statistics-based overload control against distributed denial-of-service attacks," presented at the IEEE INFOCOM, Hong Kong, 2004.
19. Mazu Profiler. [Online]. Available: http://www.mazunetworks.com
20. Naruslnsight Secure Suite. [Online]. Available: http://www.narus.com
21. L. Ricciulli, P. Lincoln, and P. Kakkar, "TCP SYN flooding defense," presented at the CNDS, San Francisco, CA, 1999.
22. A. Hussain, J. Heidemann, and C. Papadopoulos, "Identification of repeated denial of service attacks," presented at the IEEE INFOCOM, Barcelona, Spain, 2006.
23. K. Xu, Z. Zhang, and S. Bhattacharyya, "Profiling Internet backbone traffic: Behavior models and applications," Proc. ACM SIGCOMM, 2005.
24. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," presented at the ACMSIGCOMM, Philadelphia, PA, 2005.
25. Open Source Network Intrusion Detection System. [Online]. Available: http://www.snort.org
26. V. Paxson, "Bro: A system for detecting network intruders in real-time," Computer Networks, vol. 31, pp. 2435-2463, Dec. 1999.
27. J. Jung, B. Krishnamurthy, and M. Rabinovich, "Flash crowds and denial of service attacks: Characterization and implications for CDNS and web sites," presented at theWorldWideWeb Conf., Honolulu, HI, May 2002.
28. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan, "Fast portscan detection using sequential hypothesis testing," presented at the IEEE Symp. Security and Privacy, Oakland, CA, May 2004.
29. A. Wald, Sequential Analysis.. New York: Wiley, 1947.
30. G. Mori and J. Malik, "Recognizing objects in adversarial clutter: Breaking a visual CAPTCHA," IEEE Comput. Vision Pattern Recognit. vol. 1, pp. 134-141, 2003.
31. A. Garg and A. L. N. Reddy, "Mitigating denial of service attacks using QoS regulation," presented at the IWQoS, Miami Beach, FL, May 2002.
32. F. Kargl, J. Maier, and M. Weber, "Protecting web servers from distributed denial of service attacks," presented at the World Wide Web Conf., Hong Kong, 2001.
33. K. Argyraki and D. Cheriton, "Active Internet traffic filtering: Real-time response to denial-of-service attacks," presented at the USENIX Annual Techical Conf., Anaheim, CA, Apr. 2005.
34. T. Anderson, T. Roscoe, and D. Wetherall, "Preventing Internet denial-of-service with capabilities," presented at the 2nd Workshop on Hot Topics in Networks (HotNets-II), Cambridge, MA, Nov. 2003.
35. M. Walfish, H. Balakrishnan, D. Karger, and S. Shenker, "DDoS defense by offense," presented at the ACM SIGCOMM, Pisa, Italy, Sep. 2006.