Discriminating DDoS flows from flash crowds using information distance

NSS 2009 - Network and System Security

Volumn , Issue , 2009, Pages 351-356

  Yu, Shui ^a   Thapngam, Theerasak ^a   Liu, Jianwen ^a   Wei, Su ^a   Zhou, Wanlei ^a  

^a DEAKIN UNIVERSITY   (Australia)

Author keywords

DDoS attack; Distance; Measurement

Indexed keywords

ATTACK FLOW; ATTACK STRATEGIES; DDOS ATTACK; DISTANCE METRICS; FEATURE-BASED ALGORITHM; FLASH CROWD; HELLINGER DISTANCE; INFORMATION DISTANCE; NETWORK TRAFFIC; ORIGINAL DESIGN; RANDOMLY DISTRIBUTED; REAL DATA SETS;

ALGORITHMS; INTERNET;

NETWORK SECURITY;

EID: 72849125444     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NSS.2009.29     Document Type: Conference Paper

References (29)

1. P. Barford, J. Kline, D. Plonka and A. Ron, "A Signal Analysis of Network Traffic Anomalies", Proc. ACM SIGCOMM Internet Measurement Workshop, ACM Press, November 2002, pp. 71-82.
2. R.B. Blazek, H. Kim, B. Rozovskii, and A. Tartakovsky, "A Novel Approach to Detection of 'Denial-of-Service' Attacks via Adaptive Sequential and Batch-Sequential Change-Point Detection Methods", Proc. IEEE Workshop Information Assurance and Security, IEEE CS Press, June 2001, pp. 220-226.
3. R.R. Brooks, Disruptive Security Technologies with Mobile Code and Peer-to-Peer Networks, CRC Press, Boca Raton, 2005.
4. G. Carl, G. Kesidis, R.R. Brooks, and S. Rai, "Denial-of-Service Attack Detection Techniques", IEEE Internet Computing, Vol. 10, No. 1, January 2006, pp. 82-89.
5. CERT, "CERT Advisory CA-1996-21 TCP SYN Flooding and IP Spoofing Attacks", CERT Coordination Center, 29 November 2000. http://www.cert.org/advisories/CA-1996-21.html
6. Y. Chen and K. Hwang, "Spectral Analysis of TCP Flows for Defense against Reduction-of-Quality Attacks", the 2007 IEEE International Conference on Communications (ICC'07), June 2007, pp. 1203-1210.
7. Y. Chen and K. Hwang, "Collaborative Change Detection of DDoS Attacks on Community and ISP Networks", the IEEE International Symposium on Collaborative Technologies and Systems (CTS 2006), May 2006, pp. 401-410.
8. Y. Chen and K. Hwang, "Collaborative detection and filtering of shrew DDoS attacks using spectral analysis", Journal of Parallel and Distributed Computing, Vol. 66, No. 9, September 2006, Academic Press, Orlando, pp. 1137-1151.
9. C.M. Cheng, H.T. Kung and K.S. Tan, "Use of Spectral Analysis in Defense Against DoS Attacks," IEEE Global Communications Conference, 2002, pp. 2143-2148.
10. nd edition, Wiley-Interscience, June 2006.
11. Z. Duan, X. Yuan and J. Chandrashekar, "Controlling IP Spoofing through Interdomain Packet Filters", IEEE Trans. on Dependable and Secure Computing, Vol. 5, No. 1, January-March 2008, pp. 22-36.
12. L. Feinstein, D. Schnackenberg R. Balupari and D. Kindred, "Statistical Approaches to DDoS Attack Detection and Response," Proc. DARPA Information Survivability Conf. and Exposition, Vol. 1, IEEE CS Press, 22-24 April 2003, pp. 303-314.
13. S. Gibson, "Distributed Reflection Denial of Service Description and Analysis of a Potent, Increasingly Prevalent, and Worrisome Internet Attack", Gibson Research Corporation, February 2002. http://grc.com/dos/drdos.htm
14. M. Guirguis, A. Bestavros, I. Matta, and Y. Zhang, "Reduction of Quality (RoQ) Attacks on Internet End Systems", Proc. IEEE INFOCOM, Vol. 2, March 2005, pp. 1362-1372.
15. J. Jung, B. Krishnamurthy, and M. Rabinovich, "Flash Crowds and Denial-of-Service Attacks: Characterization and Implications for CDNs and Web Sites", Proc. International World Wide Web Conferences, ACM Press, New York, May 2002, pp. 293-304.
16. K. Kumar, R.C. Joshi, and K. Singh, "A Distributed Approach using Entropy to Detect DDoS Attacks in ISP Domain", The International Conference on Signal Processing of Communications and Networking (ICSCN '07), February 2007, pp. 331-337.
17. K. Lu, D. Wu, J. Fan, S. Todorovic and A. Nucci, "Robust and efficient detection of DDoS attacks for large-scale internet," Computer Networks, Vol. 51, September 2007, pp. 5036-5056.
18. G.J. McLachlan, Discriminant analysis and statistical pattern recognition, Wiley-Interscience, March 1992.
19. MIT Lincoln Laboratory, "Lincoln Laboratory Scenario (DDoS) 1.0", Massachusetts Institute of Technology (MIT), 1999. http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/2000/ LLS-DDOS-1.0.html
20. Passive Measurement and Analysis (PMA) Project "Auckland-VIII", The National Laboratory for Applied Network Research (NLANR), December 2003. http://pma.nlanr.net/Special/auck8.html
21. D. Moore, G.M. Voelker, and S. Savage, "Inferring Internet Denial-of-Service Activity," Proc. 2001 USENIX Security Symposium, Vol. 10, USENIX Association, August 2001.
22. C. Patrikakis, M. Masikos, and O. Zouraraki, "Distributed Denial of Service Attacks", The Internet Protocol Journal, Vol. 7, No. 4, December 2004.
23. D. Radcliff, "Cybersleuthing solves the case", Computerworld, 14 January 2002. http://www.paypal.com/html/computerworld- 011402.html
24. T. Peng, C. Leckie and K. Ramamohanarao, "Survey of Network-Based Defense Mechanisms Countering the DoS and DDoS Problems", ACM Computing Surveys, Vol. 39, No. 1, April 2007.
25. H. Sengar, H. Wang, D. Wijesekera, and S. Jajodia, "Detecting VoIP Floods Using the Hellinger Distance", IEEE Transactions on Parallel and Distributed Systems, Vol. 19, No. 6, June 2008. pp. 794-805.
26. H. Wang, D. Zhang and K.G. Shin, "Change-Point Monitoring for the Detection of DoS Attacks", IEEE Transactions on Dependable and Secure Computing, Vol. 1, No. 4, October-December 2004. pp. 193-208.
27. H. Wang, C. Jin, and K.G. Shin, "Defense Against Spoofed IP Traffic Using Hop-Count Filtering", IEEE/ACM Transactions on Networking, Vol. 15, No. 1, February 2007, pp. 40-53.
28. F. Yi, S. Yu, W. Zhou, J. Hai, and A. Bonti, "Source-Based Filtering Algorithm Against DDOS Attacks", International Journal of Database Theory and Application, Vol. 1, No. 1, December 2008, pp. 9-20.
29. S. Yu, W. Zhou and R. Doss, "Information Theory Based Detection Against Network Behavior Mimicking DDoS Attack", IEEE Communications Letters, Vol. 12, No. 4, April 2008, pp. 319-321.