RIP - A robust IP access architecture

Computers and Security

Volumn 28, Issue 6, 2009, Pages 359-380

  Sadok, Djamel H ^a   Souto, Eduardo ^b   Feitosa, Eduardo ^a,b   Kelner, Judith ^a   Westberg, Lars ^c  

^a FEDERAL UNIVERSITY OF PERNAMBUCO   (Brazil)

^b FEDERAL UNIVERSITY OF AMAZONAS   (Brazil)

^c Erricson Research   (Sweden)

Author keywords

Anomalous traffic; Attack detection; Internet security; Secure architectures

Indexed keywords

COMPUTER SYSTEM FIREWALLS; INTERNET PROTOCOLS; INTRUSION DETECTION; NETWORK ARCHITECTURE;

ANOMALOUS TRAFFIC; ANTI VIRUS; ATTACK DETECTION; EFFECTIVE SOLUTION; INTERNET SECURITY; INTRUSION DETECTION SYSTEMS; REMEDIATION SYSTEMS; SECURE ARCHITECTURES; SECURITY COMPONENTS; TRAFFIC ANALYSIS;

ARCHITECTURE;

EID: 67649827198     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2009.02.002     Document Type: Article

References (42)

1. Aboba B, Blunk L, Vollbrecht J, Carlson J, Levkowetz H. Extensible authentication protocol (EAP), RFC 3748; June 2004.
2. Aljifri H. IP traceback: a new denial-of- service deterrent. IEEE Security and Privacy (June 2003) 24-31
3. Barford P, Crovella M. Generating representative web workloads for network and server performance evaluation. In: Proceedings of ACM SIGMETRICS, July 1998, p. 151-60.
4. Bellovin S, Schiller J, Kaufman C. Security mechanism for the internet, RFC 3631; 2003.
5. CERT Coordination Center. Advisories; 2007.
6. Chakrabarti A., and Manimaran G. Internet infrastructure security: a taxonomy. IEEE Network 16 6 (November 2002) 13-21
7. ContentGuard, Inc. eXtensible rights markup language, XrML 2.0; 2001.
8. Crovella M., Taqqu M., and Bestavros A. Heavy-tailed probability distributions in the world wide web. A practical guide to heavy tails (1998), Chapman & Hall, New York 3-26 [chapter 1]
9. Damianou N, Dulay N, Lupu E, Sloman M. The ponder specification language. In: Workshop on policies for distributed systems and networks; January 2001.
10. Deri L. High-speed dynamic packet filtering. Journal of Network and System Management 15 3 (June 2007) 401-415
11. Hwang K., Cai M., Chen Y., and Qin M. Hybrid intrusion detection with weighted signature generation over anomalous internet episodes. IEEE Transactions on Dependable and Secure Computing 4 1 (January-March 2007) 41-55
12. IEEE. 802.1x: port based network access control. Available online: http://www.ieee802.org/1/pages/802.1x.html.
13. Intrusense Packit. Network injection and capture. Available online: http://www.intrusense.com/software/packit.
14. Jung J., Krishnamurthy B., and Rabinovich M. Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites (2002), MIT Laboratory for Computer Science
15. Kandula S, Katabi D, Jacob M, Berger A. Botz-4-Sale: surviving organized DDoS attacks that mimic flash crowds. In: Second symposium on networked systems design and implementation (NSDI), Boston, MA; May 2005.
16. Karagiannis T, Papagiannaki K, Faloutsos M. Blinc: multilevel traffic classification in the dark. In: SIGCOMM'05, Philadelphia, USA, August 2005, vol. 35, no. 4, p. 229-40.
17. Kim Y, Lau WC, Chuah MC, Chao HJ. PacketScore: statistics-based overload control against distributed denial of service attacks. In: Proceedings of INFOCOM; 2004.
18. Kudo M, Hada S. XML document security based on provisional authorization. In: 7th ACM conference on computer and communications security; 2000.
19. Mirkovic J., and Reiher P. A taxonomy of DDoS attack and DDoS defense mechanisms. ACM SIGCOMM Computer Communication Review 34 2 (2004) 39-53
20. Mirkovic J, Prier G, Reiher P. Attacking DDoS at the source. In: Proceedings of 10th IEEE international conference on network protocols, November 2002, pp. 312-21.
21. Mirkovic J., Robinson M., Reiher P., and Kuenning G. Forming alliance for DDos defenses. Proceeding of the new security paradigms workshop (August 2003), ACM Press 11-18
22. Mirkovic J., Dirtrich S., Dittrich D., and Reiher P. Internet denial of service. Attack and defense mechanisms (2005), Prentice Hall. 0-13-147573-8
23. Ning P., Jajodia S., and Wang X.S. Abstraction-based intrusion detection in distributed environment. ACM Transactions On Information and System Security (November 2001) 407-452
24. OASIS. Assertions and protocols for the OASIS security assertion markup language (SAML) V2.0; March 2005.
25. OASIS. eXtensible access control markup language (XACML) version 2.0; February 2005.
26. Oasis. XACML v3.0 administrative policy, working draft; December 2005.
27. Open digital rights language initiative, open digital rights language. Available online: (2001). http://odrl.net
28. Papadopoulos C, Lindell R, Mehringer J, Hussain A, Govindan R. Cossack: coordinated suppression of simultaneous attacks. In: Proceedings of DISCEX III; 2003, p. 2-13.
29. PCAP Public Repository. Available online: http://wwwnrg.ee.lbl.gov.
30. Peng T., Leckie C., and Ramamohanarao K. Survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys 39 1 (April 2007)
31. Rigney C, Willens S, Rubens A, Simpsom W. Remote authentication dial in user service (Radius), RFC 2865; June 2000.
32. Schneider F., Wallerich J., and Feldmann A. Packet capture in 10-Gigabit ethernet environments using contemporary commodity hardware. Lecture notes in computer science vol. 4427 (2007) p. 207-17
33. Siaterlis C, Maglaris B. Towards multisensor data fusion for DoS detection. In: Proceedings of the 19th ACM symposium on applied computing, Nicosia, Cyprus; 2004, p. 439-46.
34. Shannon C.E., and Weaver. The mathematic theory of communication (1949), University of Illinois Press
35. Shannon C, Moore D, Aben E. The CAIDA backscatter 2004-2005, IDA's Network Telescope. Available online: http://www.caida.org/data/passive/backscatter_2004_2005_dataset.xml.
36. Shyu M.-L., Quirino T., Xie Z., Chen S.-C., and Chang L. Network intrusion detection through adaptive sub-eigenspace modeling in multiagent systems. ACM Transactions on Autonomous and Adaptive Systems 2 (September 2007)
37. Stevens R.W., and UNIX Network Programming. Networking APIs: sockets and XTI. 2nd ed. vol. 1 (1998), Prentice Hall
38. Verma D.C. Policy-based networking: architecture and algorithms (2000), New Riders Publishing
39. Westerinen A, et al. Terminology for policy management, RFC 3198; November 2001.
40. Xu K, Zhang Z-L, Bhattacharyya S. Profiling internet backbone traffic: behavior models and applications. In: SIGCOMM'05, Philadelphia, USA, August 2005, p. 169-80.
41. Xu K, Zhang Z-L, Bhattacharyya S. Reducing unwanted traffic in a backbone network. In: Proceedings of steps to reducing unwanted traffic on the internet workshop (SRUTI); July 2005.
42. Xie Z, Quirino T, Shyu M-L, Chen S-C, Chang L. A distributed agent-based approach to intrusion detection using the lightweight PCC anomaly detection classifier. In: Proceedings of the IEEE international conference on sensor networks, ubiquitous, and trustworthy computing; 2006.