IP packet size entropy-based scheme for detection of DoS/DDoS attacks

IEICE Transactions on Information and Systems

Volumn E91-D, Issue 5, 2008, Pages 1274-1281

  Du, Ping ^a   Abe, Shunji ^a  

^a NATIONAL INSTITUTE OF INFORMATICS   (Japan)

Author keywords

Attack detection; Denial of service attack; Network security

Indexed keywords

DENIAL-OF-SERVICE ATTACK; ENTROPY; INTERNET PROTOCOLS; NETWORK SECURITY;

ATTACK DETECTION; BACK-BONE NETWORK; DENIAL OF SERVICE; DETECTION OF ATTACKS; DOS/DDOS ATTACKS; DOS/DDOS DETECTIONS; INTERNET TRAFFIC; REAL-TIME DETECTION;

COMPUTER CRIME;

EID: 68149178268     PISSN: 09168532     EISSN: 17451361     Source Type: Journal    
DOI: 10.1093/ietisy/e91-d.5.1274     Document Type: Article

References (18)

1. A. Hussain, J. Heidemann, and C. Papadopoulos, "A framework for classifying denial of service attacks," Proc. ACM SIGCOMM 2003.
2. D. Dittrich, "Distributed denial of service (DDoS) attacks/tools page," http://staff.washington.edu/dittrich/misc/ddos
3. J. Haggerty, T. Berry, Q. Shi, and M. Merabik, "DiDDeM: A system for early detection of TCP SYN flood attacks," Proc. IEEE GLOBECOM 2004, vol.4, no.4, pp.2037-2042, Dec. 2004.
4. A. Lakhina, M. Crovella, and C. Diot, "Diagnosing network-wide traffic anomalies," Proc. ACM SIGCOMM 2004.
5. A. Lakhina,M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," Proc. ACM SIGCOMM 2005.
6. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," Proc. ACM SIGCOMM Internet Measurement Workshop 2002.
7. H.Wang, D. Zhang, and K. Shin, "Detecting SYN flooding attacks," Proc. IEEE INFOCOM 2002, no.1, pp.1530-1539, June 2002.
8. A. Dainotti, A. Pescape, and G. Ventre, "Wavelet-based detection of DoS attacks," Proc. IEEE GLOBECOM 2006, vol.25, no.1, pp.1452-1457, Nov. 2006.
9. J. Brutlag, "Aberrant behavior detection in time series for network monitoring," USENIX Fourteenth System Administration Conference LISA XIV, pp.139-146, Dec. 2000.
10. C.M. Cheng, H.T. Kung, and K.S. Tan, "Use of spectral analysis in defense against DoS attacks," Proc. IEEE GLOBECOM2002, vol.3, no.3, pp.2143-2148, Dec. 2002.
11. V.A. Siris and F. Papagalou, "Application of anomaly detection algorithms for detecting SYN flooding attacks," Proc. IEEE GLOBECOM 2004, vol.4, pp.2050-2054, Nov. 2004.
12. R. Lippmann, et al., "The 1999 DARPA off-line intrusion detection evaluation," Comput. Netw., vol.34, no.4, pp.579-595, 2000. Data is available at http://www.ll.mit.edu/IST/ideval/
13. G. Vigna and R. Kemmerer, "NetSTAT: A network-based intrusion detection system," J. Computer Security, vol.7, no.1, pp.37-71, 1999.
14. R. Sekar, A. Gupta, J. Frullo, T. Shanbhag, S. Zhou, A. Tiwari, and H. Yang, "Specification based anomaly detection: A new approach for detecting network intrusions," Proc. ACM CCS, 2002.
15. http://www.sinet.ad.jp
16. M. Walfish, et al., "DDOS defense by offense," Proc. ACM SIGCOMM 2006.
17. L. Li and G. Lee, "DDos attack detection and wavelets," Proc. IEEE ICCCN 2003, pp.421-427, Oct. 2003.
18. H. Burch and B. Cheswick, "Tracing anonymous packets to their approximate source," Proc. Usenix LISA, Dec. 2000.