WDA: A Web farm distributed denial of service attack attenuator

Computer Networks

Volumn 55, Issue 5, 2011, Pages 1037-1051

  Doron, Ehud ^a   Wool, Avishai ^a  

^a TEL AVIV UNIVERSITY   (Israel)

Author keywords

Distributed Denial Of Service; Network security

Indexed keywords

ACTIVE QUEUE MANAGEMENT; ATTACK TRAFFIC; BROWSING SOFTWARE; CLIENT-TRAFFIC; DDOS ATTACK; DDOS ATTACKERS; DISTRIBUTED DENIAL OF SERVICE; DISTRIBUTED DENIAL OF SERVICE ATTACK; EXTENSIVE SIMULATIONS; FLOODING ATTACKS; INTERNET USERS; KEY FEATURE; NOVEL ARCHITECTURE; ORDERS OF MAGNITUDE; SERVICE DEGRADATION; WEB SERVERS;

BANDWIDTH; COMPUTER CRIME; FARMS; INTERNET; TELECOMMUNICATION NETWORKS; TRANSMISSION CONTROL PROTOCOL; WORLD WIDE WEB;

NETWORK SECURITY;

EID: 79952454671     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2010.05.001     Document Type: Article

References (47)

1. Arbor Networks: Arbor Peakflow SP - Data Sheet, .
2. Arbor Networks: Worldwide ISP Security Report, September 2005, .
3. P. Barford, M. Crovella, Generating representative Web workloads for network and server performance evaluation, in: SIGMETRICS, 1998, pp. 151-160. (Pubitemid 128593231)
4. S.M. Bellovin, ICMP Traceback Messages, Work in Progress, Internet Draft draftbellovin-itrace-00.txt, March 2000.
5. R. Braden, IETF RFC 1122: Requirements for Internet Hosts - Communication Layers, October 1989.
6. A. Bremler-Barr, N. Halachmi, H. Levi, Aggressiveness Protective Fair Queueing for Bursty Applications, in: IWQoS, 2006.
7. H.-K. Choi, J.O. Limb, A behavioral model of Web traffic, in: ICNP, 1999, pp. 327-334.
8. Cisco Systems: Defeating DDOS Attacks - White Paper, .
9. E. Doron, WDA Source Code, 2010, .
10. C. Douligeris, and A. Mitrokotsa DDoS attacks and defense mechanisms: classification and state-of-the-art Computer Networks 44 5 2004 643 666
11. P. Ferguson, D. Senie, IETF RFC 2267: Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing, January 1998.
12. R. Fielding, J. Getty, J. Mogul, H. Frystyk, T. Berners-Lee, IETF RFC 2616: Hypertext Transfer Protocol - http/1.1., June 1999.
13. T.M. Gil, M. Poletter, MULTOPS: a data-structure for bandwidth attack detection, in: Proceedings of USENIX Security Symposium 2001, Washington, DC, August 2001.
14. The Internet Traffic Report: Networks Overview, March 2008, .
15. J. Ioannidis, S.M. Bellovin, Implementing pushback: router-based defense against DDOS attacks, in: NDSS, 2002.
16. J. Jung, B. Krishnamurthy, M. Rabinovich, Flash crowds and denial of service attacks: characterization and implications for CDNs and Web sites, in: WWW, 2002, pp. 293-304.
17. S. Kandula, D. Katabi, M. Jacob, A. Berger, Botz-4-sale: surviving organized DDOS attacks that mimic flash crowds, in: NSDI, 2005.
18. A.D. Keromytis, V. Misra, and D. Rubenstein SOS: an architecture for mitigating DDOS attacks IEEE Journal on Selected Areas in Communications 22 1 2004 176 188
19. Y. Kim, W.-C. Lau, M.C. Chuah, H.J. Chao, Packetscore: statistical-based overload control against distributed denial-of-service attacks, in: INFOCOM, 2004.
20. A. Kuzmanovic, E.W. Knightly, Low-rate TCP-targeted denial of service attacks: the shrew vs. the mice and elephants, in: SIGCOMM, 2003, pp. 75-86.
21. Q. Li, E.-C. Chang, M.C. Chan, On the effectiveness of DDOS attacks on statistical filtering, in: INFOCOM, 2005, pp. 1373-1383. (Pubitemid 41390788)
22. X. Luo, R.K.C. Chang. On a new class of pulsing denial-of-service attacks and the defense, in: NDSS, 2005.
23. R. Mahajan, S.M. Bellovin, S. Floyd, J. Ioannidis, V. Paxson, and S. Shenker Controlling high bandwidth aggregates in the network Computer Communication Review 32 3 2002 62 73
24. A. Mahimkar, J. Dange, V. Shmatikov, H. Vin, Y. Zhang, dFence: transparent network-based denial of service mitigation, in: Fourth USENIX NSDI, Cambridge, MA, April 2007.
25. Mazu Networks: Mazu Enforcer - Product Sheet, .
26. J. Mirkovic, G. Prier, P.L. Reiher, Attacking DDOS at the Source, in: ICNP, 2002, pp. 312-321.
27. J. Mirkovic, and P.L. Reiher A taxonomy of DDoS attack and DDoS defense mechanisms Computer Communication Review 34 2 2004 39 53
28. NS2, The Network Simulator, .
29. A.K. Parekh, and R.G. Gallager A generalized processor sharing approach to flow control in integrated services networks: the single-node case IEEE/ACM Transactions on Networking 1 3 1993 344 357
30. M.A. Rajab, J. Zarfoss, F. Monrose, A. Terzis, A multifaceted approach to understanding the botnet phenomenon, in: Internet Measurement Conference, 2006, pp. 41-52. (Pubitemid 47165587)
31. S. Ranjan, R. Swaminathan, M. Uysal, E.W. Knightly, DDoS-resilient scheduling to counter application layer attacks under imperfect detection, in: INFOCOM, 2006.
32. V. Sekar, N. Duffield, O. Spatscheck, J. van der Merwe, H. Zhang, LADS: Large-scale Automated DDoS Detection System.
33. R. Sherwood, B. Bhattacharjee, R. Braud, Misbehaving TCP receivers can cause Internet-wide congestion collapse, in: ACM Conference on Computer and Communications Security, 2005, pp. 383-392. (Pubitemid 44022021)
34. M. Srivatsa, A. Iyengar, J. Yin, L. Liu, A middleware system for protecting against application level denial of service attacks, in: Middleware, 2006, pp. 260-280. (Pubitemid 46030570)
35. A. Stavrou, D.L. Cook, W.G. Morein, A.D. Keromytis, V. Misra, and D. Rubenstein WebSOS: an overlay-based system for protecting Web servers from denial of service attacks Computer Networks 48 5 2005 781 807 (Pubitemid 40684162)
36. A. Stavrou, J. Ioannidis, A.D. Keromytis, V. Misra, D. Rubenstein, A pay-per-use DoS protection mechanism for the Web, in: ACNS, 2004, pp. 120-134.
37. A. Stavrou, A.D. Keromytis, J. Nieh, V. Misra, D. Rubenstein, MOVE: an end-to-end solution to network denial of service, in: NDSS, 2005.
38. R. Thomas, B. Mark, T. Johnson, J. Croall, NetBouncer: client-legitimacy-based high-performance DDOS filtering, in: DISCEX, 2003, pp. 14-25.
39. R. Vasudevan, Z. Mao, O. Spatscheck, J. van der Merwe, Reval: a tool for real-time evaluation of DDoS mitigation strategies, in: USENIX Technical Conference, 2006.
40. M. Walfish, M. Vutukuru, H. Balakrishnan, D. Karger, S. Shenker, DDoS defense by offense, in: ACM SIGCOMM 2006, Pisa, Italy, September 2006.
41. H. Wang, and K.G. Shin Transport-aware IP routers: a built-in protection mechanism to counter DDOS attacks IEEE Transactions on Parallel and Distributed Systems 14 9 2003 873 884
42. X. Wang, M.K. Reiter, Mitigating bandwidth-exhaustion attacks using congestion puzzles, in: ACM Conference on Computer and Communications Security, 2004, pp. 257-267. (Pubitemid 40338207)
43. websiteoptimization.com, Average Web Page Size Triples Since 2003, .
44. A. Yaar, A. Perrig, D.X. Song, PI: a path identification mechanism to defend against DDOS attack, in: IEEE Symposium on Security and Privacy, 2003, p. 93.
45. A. Yaar, A. Perrig, D.X. Song, SIFF: A stateless Internet flow filter to mitigate DDOS flooding attacks, in: IEEE Symposium on Security and Privacy, 2004, p. 130.
46. A. Yaar, A. Perrig, D.X. Song, FIT: fast Internet traceback, in: INFOCOM, 2005, pp. 1395-1406. (Pubitemid 41390790)
47. X. Yang, D. Wetherall, T.E. Anderson, A DOS-limiting network architecture, in: SIGCOMM, 2005, pp. 241-252. (Pubitemid 46323508)