Scalable network-layer defense against internet bandwidth-flooding attacks

IEEE/ACM Transactions on Networking

Volumn 17, Issue 4, 2009, Pages 1284-1297

  Argyraki, Katerina ^a   Cheriton, David R ^b  

^a EPFL   (Switzerland)

^b STANFORD UNIVERSITY   (United States)

Author keywords

Denial of service defenses; Network level security and protection; Traffic filtering

Indexed keywords

DEFENSE MECHANISM; DENIAL-OF-SERVICE DEFENSES; INTERNET TRAFFIC; MOORE'S LAW; NETWORK-LEVEL SECURITY AND PROTECTION; SCALABLE NETWORKS; TRAFFIC FILTERING;

BANDWIDTH; INTERNET; INTERNET SERVICE PROVIDERS; NETWORK SECURITY; PUBLIC RISKS; TELECOMMUNICATION SYSTEMS;

TRAFFIC CONGESTION;

EID: 69249233518     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2008.2007431     Document Type: Article

References (31)

1. A. Kuzmanovic and E. Knightly, "Low-rate targeted TCP denial-ofservice attacks (The shrew vs. the mice and elephants)," in Proc. ACM SIGCOMM, Karlsruhe, Germany, Aug. 2003.
2. S. Gibson, The Strange Tale of the Denial of Service Against GRC. com. [Online]. Available: http://www.grc.com/dos/grcdos.htm
3. S. Berinato, Online Extortion. [Online]. Available: http:// www.csoonline.com/read/050105/extortion.html
4. B. Agrawal and T. Sherwood, "Modeling TCAM power for next generation network devices," in Proc. IEEE Int. Symp. Performance Analysis of Systems and Software (ISPASS), Austin, TX, Mar. 2006.
5. S. Staniford, V. Paxson, and N. Weaver, "How to own the internet in your spare time," in Proc. USENIX Security Symp., San Francisco, CA, Aug. 2002.
6. X. Yang, "NIRA: A new internet routing architecture," in Proc. ACM SIGCOMM Workshop on Future Directions in Network Architecture (FDNA), Karlsruhe, Germany, Aug. 2003.
7. K. Argyraki and D. R. Cheriton, "Loose source routing as a mechanism for traffic policies," in Proc. ACM SIGCOMM Workshop on Future Directions in Network Architecture (FDNA), Portland, OR, Aug. 2004.
8. A. Greenhalgh, M. Handley, and F. Huici, "Using routing and tunneling to combat DDoS attacks," in Proc. USENIX Workshop on Steps Towards Reducing Unwanted Traffic in the Internet (SRUTI), Cambridge, MA, Jul. 2005.
9. Mazu Enforcer. [Online]. Available: http://www.mazunetworks.com/ products/mazu-enforcer.php
10. Peakflow X Data Sheet. [Online]. Available: \url{http://arbornetworks. com/downloads/Arbor_Peakflow_X_Data_Sheet.pdf
11. A. Stavrou and A. Keromytis, "Countering DoS attacks with stateless multipath overlays," in Proc. ACM Conf. Computer and Communications Security (CCS), Alexandria, VA, Nov. 2005.
12. D. Bernstein, SYN Cookies. [Online]. Available: http://cr.yp.to/ syncookies.html
13. K. Argyraki, "Scalable defense against internet bandwidth-flooding attacks," Ph.D. dissertation, Stanford Univ., Stanford, CA, Dec. 2006.
14. R. Beverly and S. Bauer, "The spoofer project: Inferring the extent of source address filtering on the internet," in Proc. USENIX Workshop on Steps Towards Reducing Unwanted Traffic in the Internet (SRUTI), Cambridge, MA, Jul. 2005.
15. S. Kandula, D. Katabi, M. Jacob, and A. Berger, "Botz4Sale: Surviving organized DDoS attacks that mimic flash crowds," in Proc. USENIX Conf.Networked Systems Design and Implementation (NSDI , Boston, MA, May 2005.
16. A. Markopoulou, F. Tobagi, and M. Karam, "Loss and delay measurements of internet backbones," Elsevier Computer Commun., Special Issue on Measurements and Monitoring of IP Networks, vol. 29, pp. 1590-1604, Jun. 2006.
17. Z. Chen, C. Ji, and P. Barford, "Spatial-temporal characteristics of internet malicious sources," in Proc. IEEE INFOCOM Mini-Conference Phoenix, AZ, Apr. 2008.
18. D. Meyer, University of Oregon Route Views Archive Project. [Online]. Available: http://archive.routeviews.org/oix-route-views/
19. L. Gao, "On inferring autonomous system relationships in the internet," in Proc. Global Internet Symp., San Francisco, CA, Nov. 2000.
20. A. Keromytis, V. Misra, and D. Rubenstein, "SOS: Secure overlay services," in Proc. ACM SIGCOMM Conf., Pittsburgh, PA, Aug. 2002.
21. D. G. Andersen, "Mayday: Distributed filtering for internet services," in Proc. USENIX Symp. Internet Technologies and Systems (USITS), Seattle, WA, Mar. 2003.
22. R. Mahajan, S. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Schenker, "Controlling high bandwidth aggregates in the network," ACM Comput. Commun. Rev., vol. 32, no. 3, pp. 62-73, Jul. 2002.
23. M. Shaw, "Leveraging good intentions to reduce unwanted internet traffic," in Proc. USENIX Workshop on Steps Towards Reducing Unwanted Traffic in the Internet (SRUTI), San Jose, CA, Jul. 2006.
24. D. Andersen, H. Balakrishnan, N. Feamster, T. Koponen, D. Moon, and S. Shenker, "Holding the internet accountable," in Proc. ACM Workshop on Hot Topics in Networking (HotNets), Atlanta, GA, Nov. 2007.
25. T. Anderson, T. Roscoe, and D. Wetherall, "Preventing internet denial-of-service with capabilities," in Proc. ACM Workshop on Hot Topics in Networking (HotNets), Cambridge, MA, Nov. 2003.
26. A. Yaar, A. Perrig, and D. Song, "SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks," in Proc. IEEE Symp. Security and Privacy, Oakland, CA, May 2004.
27. K. Argyraki and D. R. Cheriton, "Network capabilities: The good, the bad, and the ugly," in Proc. ACM Workshop on Hot Topics in Networking (HotNets), College Park, MD, Nov. 2005.
28. X. Yang, D. Wetherall, and T. Anderson, "A DoS-limiting architecture," in Proc. ACM SIGCOMM, Philadelphia, PA, Aug. 2005.
29. M. Casado, A. Akella, P. Cao, N. Provos, and S. Shenker, "Cookies along trust-boundaries (CAT): Accurate and deployable flood protection," in Proc. USENIX Workshop on Steps Towards Reducing Unwanted Traffic in the Internet (SRUTI), San Jose, CA, Aug. 2006.
30. B. Parno, D. Wendlandt, E. Shi, A. Perrig, B. Maggs, and Y.-C. Hu, "Portcullis: Protecting connection setup from denial-of-capability attacks," in Proc. ACM SIGCOMM, Kyoto, Japan, Aug. 2007.
31. M. Casado, M. J. Freedman, J. Pettit, J. Luo, N. McKeown, and S. Shenker, "Ethane: Taking control of the enterprise," in Proc. ACMSIGCOMM, Kyoto, Japan, Aug. 2007.