The effects of DDoS attacks on flow monitoring applications

Proceedings of the 2012 IEEE Network Operations and Management Symposium, NOMS 2012

Volumn , Issue , 2012, Pages 269-277

  Sadre, Ramin ^a   Sperotto, Anna ^a   Pras, Aiko ^a  

^a UNIVERSITY OF TWENTE   (Netherlands)

Author keywords

[No Author keywords available]

Indexed keywords

DDOS ATTACK; DISTRIBUTED DENIAL OF SERVICE ATTACK; FLOW DATA; FLOW MONITORING; MONITORING APPLICATIONS; MONITORING SYSTEM; ON FLOW; QUEUEING MODEL; SIMULATION EXPERIMENTS; UNIVERSITY OF TWENTE;

NETWORK MANAGEMENT; NETWORK SECURITY; QUEUEING THEORY; TRACE ANALYSIS;

MONITORING;

EID: 84864235747     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NOMS.2012.6211908     Document Type: Conference Paper

References (22)

1. J. Quittek, T. Zseby, B. Claise, and S. Zander, "Requirements for IP Flow Information Export (IPFIX)," RFC 3917 (Informational).
2. Cisco.com, "Cisco IOS NetFlow Configuration Guide, Release 12.4," http://www.cisco.com, Sept. 2010.
3. A. Pras, R. Sadre, A. Sperotto, T. Fioreze, D. Hausheer, and J. Schoenwaelder, "Using NetFlow/IPFIX for Network Management," Journal of Network and Systems Management, vol. 17, no. 4, p. 6, 2009.
4. A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An Overview of IP Flow-Based Intrusion Detection," IEEE Communications Surveys & Tutorials, vol. 12, no. 3, pp. 343-356, 2010.
5. A. Sperotto, "Flow-based intrusion detection," Ph.D. dissertation, University of Twente, October 2010.
6. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, and A. Lakhina, "Impact of packet sampling on anomaly detection metrics," in Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, ser. IMC '06, 2006, pp. 159-164.
7. J. Mai, C.-N. Chuah, A. Sridharan, T. Ye, and H. Zang, "Is sampled data sufficient for anomaly detection?" in Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, ser. IMC '06, 2006, pp. 165-176.
8. Z. Li, Y. Gao, and Y. Chen, "HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency," Computer Networks, vol. 54, no. 8, pp. 1282-1299, 2010.
9. M. Molina, A. Chiosi, S. D'Antonio, and G. Ventre, "Design principles and algorithms for effective high-speed IP flow monitoring," Computer Communications, vol. 29, no. 10, pp. 1653-1664, 2006.
10. N. Duffield and C. Lund, "Predicting resource usage and estimation accuracy in an IP flow measurement collection infrastructure," in Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement (IMC '03). ACM, 2003, pp. 179-191.
11. C. Estan, K. Keys, D. Moore, and G. Varghese, "Building a better NetFlow," SIGCOMM Comput. Commun. Rev., vol. 34, pp. 245-256, 2004.
12. Y. Hu, D. M. Chiu, and J. C. Lui, "Adaptive Flow Aggregation - A New Solution for Robust Flow Monitoring under Security Attacks," in In IEEE/IFIP Network Operations and Management Symposium (NOMS '06), 2006, pp. 424-435.
13. Y. Wang, C. Lin, Q.-L. Li, and Y. Fang, "A queueing analysis for the denial of service (DoS) attacks in computer networks," Computer Networks, vol. 51, pp. 3564-3573, August 2007.
14. M. Long, C.-H. Wu, and J. Hung, "Denial of service attacks on network-based control systems: impact and mitigation," IEEE Transactions on Industrial Informatics, vol. 1, no. 2, pp. 85-96, 2005.
15. S. Khan and I. Traore, "Queue-based analysis of DoS attacks," in Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop (IAW '05), 2005, pp. 266-273.
16. Cisco.com, "Cisco White Paper "NetFlow Performance Analysis"," May 2007.
17. T. Fioreze, "Self-management of hybrid optical and packet switching networks," Ph.D. dissertation, University of Twente, February 2010.
18. B. Haverkort, "QNAUT: Approximately analyzing networks of PH|PH|1|K queues," Proceedings of the 1996 International Computer Performance and Dependability Symposium, p. 57, 1996.
19. R. Sadre, B. Haverkort, and A. Ost, "An efficient and accurate decomposition method for open finite- and infinite-buffer queueing networks," in Proc. 3rd Int. Workshop on Numerical Solution of Markov Chains, 1999, pp. 1-20.
20. INVEA-TECH.com, "INVEA-TECH - High-Speed Networking and FPGA Solutions," http://www.invea-tech.com, May 2011.
21. Tcpdump.org, "TCPDUMP & LIBPCAP," http://www.tcpdump.org/, May 2011.
22. B. Trammell, B. Tellenbach, D. Schatzmann, and M. Burkhart, "Peeling Away Timing Error in NetFlow Data," in Passive and Active Measurement conference (PAM 2011), March 2011.