A TCAM-based solution for integrated traffic anomaly detection and policy filtering

Computer Communications

Volumn 32, Issue 17, 2009, Pages 1893-1901

  Wang, Zhijun ^a   Che, Hao ^b   Cao, Jiannong ^a   Wang, Jingshan ^a  

^a HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

^b The University of Texas at Arlington   (United States)

Author keywords

Flow anomaly detection; TCAM coprocessor; Two dimensional matching

Indexed keywords

ANOMALY DETECTION; CO-PROCESSORS; FLOW ANOMALY DETECTION; FUTURE INTERNET; IP ADDRESSS; KEY FEATURE; LINE RATE; LOW RATES; MALICIOUS ATTACK; REAL-WORLD; SECURITY AND PERFORMANCE; TCAM COPROCESSOR; TCP FLOWS; TERNARY CONTENT ADDRESSABLE MEMORIES; TRAFFIC ANOMALIES; TWO-DIMENSIONAL MATCHING;

INTERNET; INTERNET PROTOCOLS; LOGIC GATES; TRANSMISSION CONTROL PROTOCOL; TWO DIMENSIONAL;

FILTRATION;

EID: 69249222599     PISSN: 01403664     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comcom.2009.07.016     Document Type: Article

References (29)

1. Ayres P.E., Sun H., and Chao H.J. A high-speed PacketScore DDoS defense system. IEEE Journal on Selected Areas in Communications 24 10 (2006) 1864-1876
2. F. Baboesu, G. Varghese, Scalable packet classification, in: Proceedings of ACM SIGCOMM, 2001.
3. S. Bellovin, ICMP traceback messages, Work in Progress, Internet Draft draft-bellovin-itrace-00.txt, 2000.
4. Cypress Ayama 10K/20K NSE Series TCAM Products. Available from: .
5. Che H., Wang Z., Zheng K., and Liu B. DRES: dynamic range encoding scheme for TCAM coprocessors. IEEE Transactions on Computers 57 7 (2008) 902-915
6. Z. Duan, X. Yuan, J. Chandrashekar, Constructing inter-domain packet filters to control IP spoofing based on BGP updates, in: Proceedings of IEEE INFOCOM, 2006.
7. Fang Yu, Randy H. Katz, T.V. Lakshman, Gigabit rate packet pattern matching with TCAM, in: IEEE ICNP, 2004.
8. J. Fan, D. Wu, K. Lu, A. Nucci, Design of bloom filter array for network anomaly detection, in: Proceedings of IEEE GLOBECOM, 2006.
9. M.T. Goodrich, Efficient packet marking for large-scale IP traceback, in: Proceedings of ACM Conference on Computer and Communications Security (CCS), 2002.
10. http://www.pma.nlanr.net/Specical/ipsl4.html.
11. A. Hussain, J. Heidemann, C. Papadopoulos, A framework for classifying denial of service attacks, in: ACM SIGCOMM, 2003.
12. A. Kuzmanovic, E.W. Knightly, Low-rate TCP-targeted denial of service attacks, in: ACM SIGCOMM, 2003.
13. J. Joannidis, S.M. Bellovin, Implementing pushback: router-ased defense against DDoD attacks, in: Network and Distributed System Security Symposium, 2002.
14. A. Lakhina, M. Crovella, C. Diot, Diagnosing network-wide traffic anomalies, in: Proceedings of ACM SIGCOMM, 2004.
15. K. Lakshminarayanan, A. Rangarajan, S. Venkatachary, Algorithms for advanced packet classification with ternary CAMs, in: Proceedings of ACM SIGCOM, 2005.
16. J. Li, M. Sung, J. Xu, L. Li, Large-scale IP traceback in high-speed internet: practical techniques and theoretical foundation, in: Proceedings of IEEE Symposium on Security and Privacy, 2004.
17. Q. Li, E. Chang, M. Chan, On the effectiveness of DDoS attacks on statistical filtering, in: IEEE INFOCOM, 2005.
18. Lunteren J., and Engbersen T. Fast and scalable packet classification. IEEE Journal on Selected Areas in Communications 21 4 (2003) 560-571
19. X. Luo, E. Chan, R. Chang, Vanguard: a new detection scheme for a class of TCP-targeted denial-of-service attacks, in: IEEE/IFIP Network Operations & Management Symposium, 2006.
20. T. Peng, C. Leckie, K. Ramamohanarao, Protection from distributed denial of service attacks using history-based IP filtering, in: Proceedings of IEEE International Conference on Communications, 2003.
21. Savage S., Wetherall D., Karlin A., and Anderson T. Network support for IP traceback. IEEE/ACM Transactions on Networking 9 3 (2001) 226-237
22. Shevtekar A., Anatharam K., and Ansari N. Low rate TCP denial-of-service attack detection at edge routers. IEEE Communication Letters 9 4 (2005) 363-365
23. A.C. Snoeren, C. Partridge, L.A. Sanchez, C.E. Jones, Hash-based IP traceback, in: Proceedings of ACM SIGCOMM, 2001.
24. D.X. Song, A. Perrig, Advanced and authenticated marking schemes for IP traceback, in: Proceedings of IEEE INFOCOM, 2001.
25. E. Spitznagel, D. Taylor, J. Turner, Packet classification using extended TCAMs, in: Proceedings of International Conference of Network Protocol (ICNP), September, 2003.
26. H. Sun, J. Lui, D. Yau, Defending against low-rate TCP attacks: dynamic detection and protection, in: IEEE INCP, 2004.
27. Wang Z., Che H., Kumar M., and Das S. CoPTUA: consistent policy table update algorithm for TCAM without locking. IEEE Transactions on Computers 53 12 (2004) 1602-1614
28. G. Yang, M. Gerla, M. Sanadidi, Defense against low-rate TCP-targeted denial-of-service attacks, in: IEEE Symposium on Computers and Communications (ISCC), 2004.
29. Zheng K., Hu C., Lu H., and Liu B. A TCAM-based distributed parallel IP lookup scheme and performance analysis. ACM/IEEE Transaction on Networking 14 4 (2006) 863-875