Optimal filtering of source address prefixes: Models and algorithms

Proceedings - IEEE INFOCOM

Volumn , Issue , 2009, Pages 2446-2454

  Soldo, Fabio ^a   Markopoulou, Athina ^a   Argyraki, Katerina ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b EPFL   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL LISTS; BUILDING BLOCKES; COMPUTATIONALLY EFFICIENT; COST-EFFICIENT; DIFFERENT ATTACKS; DISTRIBUTED DENIAL OF SERVICE ATTACK; FILTER SELECTION; MALICIOUS CODES; MALICIOUS TRAFFIC; MULTIDIMENSIONAL KNAPSACK PROBLEMS; NETWORK INFRASTRUCTURE; OPTIMAL FILTERING; RESOURCE ALLOCATION PROBLEM; SCARCE RESOURCES; SOURCE ADDRESS; TERNARY CONTENT ADDRESSABLE MEMORIES;

ACCESS CONTROL; COMPUTER RESOURCE MANAGEMENT; INTEGER PROGRAMMING; OPTIMIZATION; PLANNING; RESOURCE ALLOCATION;

MATHEMATICAL OPERATORS;

EID: 70349658385     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2009.5062172     Document Type: Conference Paper

References (21)

1. Cisco Systems, White Paper, "Understanding acl on catalyst 6500 series switches," www.cisco.com/en/US/products/hw/switches/ps708/products- white-paper09186a00800c9470.shtml.
2. Cisco Systems, White Paper, "Protecting your core: Infrastructure protection access control lists," http://www.cisco.com/en/US/tech/tk648/ tk361/technologies-white-paper09186a00801a1a55.shtml.
3. Dshield http://www.dshield.org/
4. H. Kellerer, U. Pferschy, D. Pisinger, "Knapsack Problems", Springer, 2004.
5. G. Varghese, "Network Algorithmics," Morgan Kaufmann, 2005.
6. F. Soldo, A. Markopoulou, K. Argyraki, "Optimal Filtering of Malicious IP Sources", Technical Report arXiv:cs.NI/0811.3828, Nov. 2008
7. G.V. Gens and E.V. Levner, "Computational complexity of approximation algorithms for combinatorial problems", in Mathematical Foundations of Computer Science, LNCS, vol. 74, pp. 292-300, Springer 1979.
8. D.P. Bertsekas, "Non linear programming," Athena Scientific, 2003.
9. Z. Chen, C. Ji, P. Barford, "Spatial-Temporal Characteristics of Internet Malicious Sources," in IEEE INFOCOM (Mini-Conf.), April 2008.
10. E. Kohler, J. Li, V. Paxson, and S. Shenker, "Observed structure of addresses in IP traffic," IEEE/ACM ToN 14(6), pp. 1207-1218, Dec. 2006.
11. K. Argyraki, D.R. Cheriton, "Active Internet Traffic Filtering: Real-time Response to DoS Attacks", in Proc. of USENIX Security 2005.
12. X. Liu, X. Yang, Y. Lu, "To Filter or to Authorize: Network-Layer DoS Defense Against Multimillion-node Botnets," in ACM SIGCOMM 2008, Seattle, Aug. 2008.
13. R. Beverly, S. Bauer, "The Spoofer Project: Inferring the Extent of Internet Source Address Filtering on the Internet," in SRUTI 2005.
14. P. Ferguson, D. Senie, "Network Ingress Filtering: Defeating DoS Attacks which employ IP Source Address Spoofing", RFC 2827, May 2000.
15. D. Andersen, H. Balakrishnan, N. Feamster, T. Koponen, D. Moon, S. Shenker, "Accountable Internet Protocol (AIP)," in ACM SIGCOMM 2008, Seattle, Aug. 2008.
16. X. Liu, A. Li, X. Yang, D. Wetherall, "Passport: Secure and Adoptable Source Authentication," in Proc. USENIX/ACM NSDI 2008.
17. G. Pack, J. Yoon, E. Collins, C. Estan, "On Filtering of DDoS Attacks Based on Source Address Prefixes," in Proc. of SecureComm, Aug. 2006.
18. E. Al-Shaer et al., "Firewall Policy Advisor Project", De Paul Univ. http://www.mnlab.cs.depaul.edu/projects/SPA/
19. F. Soldo, K. El Defrawy, A. Markopoulou, B. Krishnamurthy, and K. v.d. Merwe, "Filtering sources of unwanted traffic" in Proc. of Inf. Theory and Applications Workshop, UCSD, Jan. 2008.
20. A. Caprara, H. Kellerer, U. Pferschy, and D. Pisinger, "Approximation algorithms for knapsack problems with cardinality constraints", European Journal of Operational Research, 123:333-345, 2000
21. A. Bagchi, N. Bhattacharyya, N. Chakravarti, "LP relaxation of the two dimensional knapsack problem with box and GUB constraints", European Journal of Operational Research, Elsevier, 1994