Shield: DoS filtering using traffic deflecting

Proceedings - International Conference on Network Protocols, ICNP

Volumn , Issue , 2011, Pages 37-42

  Kline, Erik ^a   Afanasyev, Alexander ^a   Reiher, Peter ^a  

^a Engineering IV   (United States)

Author keywords

BGP; DDoS; Filtering; IP Anycast; Traffic deflection

Indexed keywords

ANYCAST; AUTONOMOUS SYSTEMS; BGP; DDOS; DEFENSE MECHANISM; DENIAL OF SERVICE ATTACKS; ON-DEMAND SERVICES; ROUTING TECHNIQUES;

FILTRATION; INTERNET; NETWORK PROTOCOLS; ROUTERS;

INTERNET PROTOCOLS;

EID: 84055181443     PISSN: 10921648     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICNP.2011.6089077     Document Type: Conference Paper

References (26)

1. Trustwave SpiderLabs, "The Web hacking incident database. Semiannual report. July to December 2010," 2011.
2. R. Naraine, "Massive DDoS attack hit DNS root servers," InternetNews.com, October 2002, http://www.esecurityplanet.com/trends/article. php/1486981/Massive-DDoS-Attack-Hit-DNS-Root-Servers.htm.
3. J. Mirkovic and P. Reiher, "A taxonomy of DDoS attack and DDoS defense mechanisms," ACM SIGCOMM Computer Communication Review, vol. 34, no. 2, pp. 39-53, 2004.
4. T. Peng, C. Leckie, and K. Ramamohanarao, "Survey of network-based defense mechanisms countering the DoS and DDoS problems,"ACM Computing Surveys (CSUR), vol. 39, no. 1, 2007.
5. E. Kline, M. Beaumont-Gay, J. Mirkovic, and P. Reiher, "RAD: Reflector attack defense using message authentication codes," in Proceedings of Annual Computer Security Applications Conference (ASAC), 2009, pp. 269-278.
6. P. Ferguson and D. Senie, "Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing,"RFC 2827, May 2000.
7. R. Beverly and S. Bauer, "The spoofer project: Inferring the extent of source address filtering on the internet," in Proceedings of USENIX SRUTI, 2005, pp. 53-59.
8. Y. Rekhter, T. Li, and S. Hares, "A Border Gateway Protocol 4 (BGP-4)," RFC 4271, January 2006.
9. C. Partridge, T. Mendez, and W. Milliken, "Host Anycasting Service," RFC 1546, November 1993.
10. H. Ballani and P. Francis, "Towards a global IP anycast service,"in Proceedings of SIGCOMM, vol. 35, no. 4, August 2005, pp. 301-312.
11. D. Farinacci, T. Li, S. Hanks, D. Meyer, and P. Traina, "Generic Routing Encapsulation (GRE)," RFC 2784, March 2000.
12. J. Mirkovic and E. Kissel, "Comparative evaluation of spoofing defenses," IEEE Transactions on Dependable and Secure Computing, pp. 218-232, 2009.
13. J. Postel, "Internet Protocol," RFC 791, September 1981.
14. R. Govindan and H. Tangmunarunkit, "Heuristics for Internet map discovery," in Proceedings of INFOCOM, vol. 3, 2000, pp. 1371-1380.
15. F. Gont, "Security assessment of the Internet protocol version 4 (draft-ietf-opsec-ip-security-07.txt)," Internet Draft, April 2011, http://tools.ietf.org/id/draft-ietf-opsec-ip-security-07.txt.
16. E. Kline and P. Reiher, "Securing data through avoidance routing,"in Proceedings of NSPW, 2009, pp. 115-124.
17. C. Villamizar, R. Chandra, and R. Govindan, "BGP Route Flap Damping," RFC 2439, November 1998.
18. "Akamai," http://www.akamai.com.
19. K. Park and H. Lee, "On the effectiveness of route-based filtering for distributed DoS attack prevention in power-law Internets," in Proceedings of SIGCOMM, vol. 31, no. 4, 2001, pp. 15-26.
20. Z. Duan, X. Yuan, and J. Chandrashekar, "Constructing inter-domain packet filters to control IP spoofing based on BGP updates," in Proceedings of INFOCOM, 2006.
21. X. Yang, D. Wetherall, and T. Anderson, "A DoS-limiting network architecture," in Proceedings of SIGCOMM, 2005, pp. 241-252.
22. A. Perrig, D. Song, and A. Yaar, "StackPi: New packet marking and filtering mechanisms for DDoS and IP spoofing defense,"IEEE Journal on Selected Areas in Communications, vol. 24, no. 10, pp. 1853-1863, October 2006. (Pubitemid 44559599)
23. X. Liu, X. Yang, and Y. Lu, "To filter or to authorize: Networklayer DoS defense against multimillion-node botnets," in Proceedings of SIGCOMM, 2008, pp. 195-206.
24. J. Mirkovic, G. Prier, and P. Reiher, "Attacking DDoS at the source," in Proceedings of ICNP, 2002, pp. 312-321.
25. J. Mirkovic, M. Robinson, and P. Reiher, "Alliance formation for DDoS defense," in Proceedings of NSPW, 2003, pp. 11-18.
26. A. Keromytis, V. Misra, and D. Rubenstein, "SOS: Secure overlay services," in Proceedings of SIGCOMM, 2002, pp. 61-72.