Detection and defense of application-layer DDoS attacks in backbone web traffic

Future Generation Computer Systems

Volumn 38, Issue , 2014, Pages 36-46

  Zhou, Wei ^a   Jia, Weijia ^b   Wen, Sheng ^c   Xiang, Yang ^c   Zhou, Wanlei ^c  

^a CENTRAL SOUTH UNIVERSITY   (China)

^b CITY UNIVERSITY OF HONG KONG   (Hong Kong)

^c DEAKIN UNIVERSITY   (Australia)

Author keywords

Backbone; DDoS attack; Model mining

Indexed keywords

DENIAL-OF-SERVICE ATTACK; FILTRATION; INTERNET; WEB SERVICES;

ATTACK DETECTION; BACKBONE; DDOS ATTACK; DEFENSE ARCHITECTURE; DETECTION METHODS; DETECTION MODULES; DETECTION SPEED; FREQUENCY VECTOR;

ALUMINUM;

EID: 84901410507     PISSN: 0167739X     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.future.2013.08.002     Document Type: Article

References (36)

1. Y. Xie, and S. Zheng Yu Monitoring the application-layer ddos attacks for popular websites IEEE/ACM Trans. Netw. 17 1 2009 15 25
2. Arbor. Networks, Worldwide network infrastructure security report, Tech. Rep., Arbor Networks 2011
3. Y. Xie, and S. Zheng Yu A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors IEEE/ACM Trans. Netw. 17 1 2009 54 65
4. L. von Ahn, M. Blum, N.J. Hopper, J. Langford, Captcha: using hard ai problems for security, in: EUROCRYPT, 2003, pp. 294-311.
5. S. Kandula, D. Katabi, M. Jacob, and A. Berger Botz-4-sale: surviving organized ddos attacks that mimic flash crowds Proceedings of the 2nd Conference on Symposium on Networked Systems Design and Implementation NSDI'05 2005 USENIX Association Berkeley, CA, USA 287 300
6. P. Barford, J. Kline, D. Plonka, and A. Ron A signal analysis of network traffic anomalies Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurement IMW '02 2002 ACM New York, NY, USA 71 82
7. M. Walfish, M. Vutukuru, H. Balakrishnan, D. Karger, and S. Shenker Ddos defense by offense ACM Trans. Comput. Syst. 28 1 2010 1 54
8. S. Ranjan, R. Swaminathan, M. Uysal, E. Knightly, Ddos-resilient scheduling to counter application layer attacks under imperfect detection, in: Proceedings. INFOCOM 2006. 25th IEEE International Conference on Computer Communications, 2006, pp. 1-13.
9. T. Peng, C. Leckie, and K. Ramamohanarao Survey of network-based defense mechanisms countering the dos and ddos problems ACM Comput. Surv. 39 1 2007
10. G. Thatte, U. Mitra, and J. Heidemann Parametric methods for anomaly detection in aggregate traffic IEEE/ACM Trans. Netw. 19 2 2011 512 525
11. Y. Xie, S. Tang, Y. Xiang, and J. Hu Resisting web proxy-based http attacks by temporal and spatial locality behavior IEEE Trans. Parallel Distrib. Syst. 24 7 2013 1401 1410
12. Y. Xie, J. Hu, S. Tang, and X. Huang A structural approach for modelling the hierarchical dynamic process of web workload in a large-scale campus network J. Netw. Comput. Appl. 35 6 2012 2081 2091
13. G. Oikonomou, J. Mirkovic, Modeling human behavior for defense against flash-crowd attacks, in: IEEE International Conference on Communications, 2009, pp. 1-6.
14. B. Krishnamurthy, and J. Wang On network-aware clustering of web clients Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication SIGCOMM'00 2000 ACM New York, NY, USA 97 110
15. S. Yu, W. Zhou, W. Jia, S. Guo, Y. Xiang, and F. Tang Discriminating ddos attacks from flash crowds using flow correlation coefficient IEEE Trans. Parallel Distrib. Syst. 23 6 2012 1073 1080
16. S. Khanna, S.S. Venkatesh, O. Fatemieh, F. Khan, and C.A. Gunter Adaptive selective verification: an efficient adaptive countermeasure to thwart dos attacks IEEE/ACM Trans. Netw. 20 3 2012 715 728
17. J. Jung, B. Krishnamurthy, and M. Rabinovich Flash crowds and denial of service attacks: characterization and implications for CDNs and web sites Proceedings of the 11th International Conference on World Wide Web WWW'02 2002 ACM New York, NY, USA 293 304
18. D. Das, U. Sharma, and D.K. Bhattacharyya Detection of http flooding attacks in multiple scenarios Proceedings of the 2011 International Conference on Communication, Computing and Security ICCCS'11 2011 ACM New York, NY, USA 517 522
19. S. Byers, A.D. Rubin, and D. Kormann Defending against an internet-based attack on the physical world ACM Trans. Internet Technol. 4 3 2004 239 254
20. T. Yatagai, T. Isohara, I. Sasase, Detection of http-get flood attack based on analysis of page access behavior, in: IEEE Pacific Rim Conference on Communications, Computers and Signal Processing, 2007, pp. 232-235.
21. J. Yu, Z. Li, H. Chen, and X. Chen A detection and offense mechanism to defend against application layer DDoS attacks Proceedings of the Third International Conference on Networking and Services ICNS'07 2007 IEEE Computer Society Washington, DC, USA 54 66
22. S. Khattab, S. Gobriel, R. Melhem, and D. Mosse Live baiting for service-level DoS attackers INFOCOM 2008. The 27th Conference on Computer Communications 2008 IEEE 171 175
23. M. Srivatsa, A. Iyengar, J. Yin, and L. Liu Mitigating application-level denial of service attacks on web servers: a client-transparent approach ACM Trans. Web 2 3 2008 1 49
24. G. Yan, R. Lee, A. Kent, and D. Wolpert Towards a Bayesian network game framework for evaluating ddos attacks and defense Proceedings of the 2012 ACM Conference on Computer and Communications Security CCS'12 2012 ACM 553 566
25. M.E. Crovella, and A. Bestavros Self-similarity in world wide web traffic: evidence and possible causes IEEE/ACM Trans. Netw. 5 6 1997 835 846 (Pubitemid 127768491)
26. M. Handley, Internet architecture wg: DoS-resistant internet subgroup report, Tech. Rep., University College London, 2007.
27. H. Project, Know your enemy: tracking botnets, Published on the Web, URL: http://www.honeynet.org/papers/bots/.
28. A. Sharad, D. Travis, T. Christos, Ddos mitigation via regional cleaning centers, Tech. Rep., Sprint Labs, 2004.
29. J. Viinikka, H. Debar, L. Mé, A. Lehikoinen, and M. Tarvainen Processing intrusion detection alert aggregates with time series modeling Information Fusion 10 4 2009 312 324
30. W. Lu, and A.A. Ghorbani Network anomaly detection based on wavelet analysis EURASIP J. Adv. Signal Process. 4 2009 1 16
31. CERT, Incident note in-2004-01 w32/novarg.a virus, Tech. Rep., CERT, 2004.
32. CERT, Code red worm crashes iis 4.0 servers with url redirection enabled, Tech. Rep., CERT, 2001.
33. D.S. Yeung, S. Jin, and X. Wang Covariance-matrix modeling and detecting various flooding attacks IEEE Trans. Syst. Man. Cybern. Part A: Systems and Humans 37 2 2007 157 169 (Pubitemid 46485241)
34. I. Ioannidis, A. Grama, and M. Atallah Adaptive data structures for ip lookups INFOCOM 2003. Twenty-Second Annual Joint Conference of the IEEE Computer and Communications, Vol. 1 2003 75 84
35. M. Mitzenmacher, and A. Broder Using multiple hash functions to improve ip lookups IN Proceedings of IEEE INFOCOM 2000 IEEE 1454 1463
36. A. Broder, and M. Mitzenmacher Network applications of bloom filters: A survey Internet Math. 2002 636 646