More accurate and fast SYN flood detection

Proceedings - International Conference on Computer Communications and Networks, ICCCN

Volumn , Issue , 2009, Pages

  Sun, Changhua ^a   Hu, Chengchen ^a   Tang, Yi ^a   Liu, Bin ^a  

^a TSINGHUA UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

BLOOM FILTERS; DETECTION METHODS; DISTRIBUTED DENIAL OF SERVICE ATTACK; EFFICIENT DATA STRUCTURES; IMPLEMENTATION COST; MEMORY COST; PACKET PAIRS; PUBLIC DETECTION; SYN FLOOD; TCP PORTS; THREE-WAY HANDSHAKE;

COMPUTER CRIME; DATA STRUCTURES; SECURITY OF DATA; TRANSMISSION CONTROL PROTOCOL;

TELECOMMUNICATION TRAFFIC;

EID: 70449092230     PISSN: 10952055     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICCCN.2009.5235270     Document Type: Conference Paper

References (25)

1. "CERT advisory CA-1996-21 TCP SYN flooding and IP spoofing attacks, " 1996. [Online]. Available: http://www.cert.org/advisories/CA-1996-21. html.
2. T. Peng, C. Leckie, and K. Ramamohanarao, "Survey of network-based defense mechanisms countering the DoS and DDoS problems, " ACM Computing Surveys, vol. 39, no. 1, 2007.
3. C. Labovitz, D. McPherson, S. Iekel-Johnson, and M. Hollyman, "Internet Traffic Trends - A View from 67 ISPs, " NANOG, 2008. [Online]. Available: http://www.nanog.org/meetings/nanog43/presentations/ LabovitzinternetstatsN43.pdf.
4. J. Lemon, "Resisting SYN flood DoS attacks with a SYN cache, " in USENIX BSDCon, 2002.
5. "SYN cookies." [Online]. Available: http://cr.yp.to/syncookies. html.
6. W. Eddy, "TCP SYN flooding attacks and common mitigations, " RFC 4987, 2007. [Online]. Available: http://www.rfc-editor.org/rfc/rfc4987.txt.
7. H. Wang, D. Zhang, and K. G. Shin, "Detecting SYN flooding attacks, " in IEEE INFOCOM, 2002.
8. -, "SYN-dog: sniffing SYN flooding sources, " in IEEE ICDCS, 2002.
9. W. Chen and D. Y. Yeung, "Defending against TCP SYN flooding attacks under different types of IP spoofing, " in Fifth International Conference on Networking (ICN), 2006.
10. C. Sun, J. Fan, and B. Liu, "A robust scheme to detect SYN flooding attacks, " in International Conference on Communications and Networking in China (ChinaCom), Shanghai, China, August 22-24 2007.
11. C. Sun, J. Fan, L. Shi, and B. Liu, "A novel router-based scheme to mitigate SYN flooding DDoS attacks, " in IEEE INFOCOM (Student Poster), Anchorage, Alaska, USA, May 2007.
12. R. R. Kompella, S. Singh, and G. Varghese, "On scalable attack detection in the network, " IEEE/ACM Transactions on Networking, vol. 15, no. 1, pp. 14-25, 2007.
13. C. Sun, C. Hu, Y. Zhou, X. Xiao, and B. Liu, "A more accurate scheme to detect SYN flood attacks, " in IEEE INFOCOM Student Workshop, Rio de Janeiro, Brazil, Apr. 20 2009.
14. A. Broder and M. Mitzenmacher, "Network applications of Bloom filters: a survey, " Internet Mathematics, vol. 1, no. 4, pp. 485-509, 2004.
15. V. Thing, M. Sloman, and N. Dulay, "A survey of Bots used for distributed denial of service attacks, " IFIP International Information Security Conference, vol. 232, p. 229, 2007.
16. H. Jiang and C. Dovrolis, "Passive estimation of TCP round-trip times, " ACM SIGCOMM Comput. Commun. Rev., vol. 32, no. 3, pp. 75-88, 2002.
17. K. chan Lan, A. Hussain, and D. Dutta, "Effect of malicious traffic on the network, " in Passive and Active Measurement (PAM), 2003.
18. "equinix-chicago monitor Realtime reports, " 2008. [Online]. Available: http://www.caida.org/data/passive/monitors/equinix-chicago.xml.
19. "SCO Offline from Denial-of-Service Attack, " 2003. [Online]. Available: http://www.caida.org/research/security/sco-dos/.
20. L. Fan, P. Cao, J. Almeida, and A. Z. Broder, "Summary cache: a scalable wide-area web cache sharing protocol, " in ACM SIGCOMM, 1998.
21. M. V. Ramakrishna, E. Fu, and E. Bahcekapili, "Efficient hardware hashing functions for high performance computers, " IEEE Transactions on Computers, vol. 46, no. 12, pp. 1378-1381, 1997.
22. J. Mirkovic, S. Wei, A. Hussain, B. Wilson, R. Thomas, S. Schwab, S. Fahmy, R. Chertov, and P. Reiher, "DDoS benchmarks and experimenter's workbench for the DETER testbed, " in 3rd International Conference on Testbeds and Research Infrastructure for the Development of Networks and Communities(Tridentcom), 2007.
23. "Auckland-VIII trace data, " NLANR Project, 2003. [Online]. Available: http://pma.nlanr.net/Special/auck8.html.
24. D. Dittrich, "Distributed denial of service (DDoS) attacks/tools." [Online]. Available: http://staff.washington.edu/dittrich/ misc/ddos/.
25. M. Beaumont-Gay, "A comparison of SYN flood detection algorithms, " in International Conference on Internet Monitoring and Protection (ICIMP), 2007.