Fool me if you can: Mimicking attacks and anti-attacks in cyberspace

IEEE Transactions on Computers

Volumn 64, Issue 1, 2015, Pages 139-151

  Yu, Shui ^a   Guo, Song ^b   Stojmenovic, Ivan ^a,c,d  

^a DEAKIN UNIVERSITY   (Australia)

^b UNIVERSITY OF AIZU   (Japan)

^c KING ABDULAZIZ UNIVERSITY   (Saudi Arabia)

^d UNIVERSITY OF OTTAWA   (Canada)

Author keywords

detection; flash crowd attack; Mimicking; second order metrics

Indexed keywords

COMPUTERS; ERROR DETECTION; MARKOV PROCESSES; SOCIAL NETWORKING (ONLINE); VIRTUAL REALITY;

ANOMALY DETECTION; BROWSING BEHAVIOR; CRITICAL CHALLENGES; FLASH CROWD ATTACKS; MALICIOUS ACTIVITIES; MIMICKING; SECOND ORDERS; SEMI MARKOV MODEL;

MALWARE;

EID: 84919476166     PISSN: 00189340     EISSN: None     Source Type: Journal    
DOI: 10.1109/TC.2013.191     Document Type: Article

References (49)

1. T. Peng, C. Leckie, and K. Ramamohanarao, "Survey of networkbased defense mechanisms countering the DOS and DDoS problems," ACM Comput. Surv., vol. 39, no. 1, 2007.
2. M. Edman and B. Yener, "On anonymity in an electronic society: A survey of anonymous communication systems," ACM Comput. Surv., vol. 42, no. 1, 2009.
3. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna, "Your botnet is my botnet: Analysis of a botnet takeover," in Proc.ACMConf. Comput. Commun. Security, 2009.
4. Z. Li, A. Goyal, Y. Chen, and V. Paxson, "Towards situational awareness of large-scale botnet probing events," IEEE Trans. Inf. Forensics Security, vol. 6, no. 1, pp. 175-188, Mar. 2011.
5. C. A. Shue, A. J. Kalafut, and M. Gupta, "Abnormally malicious autonomous systems and their internet connectivity," IEEE/ACM Trans. Netw., vol. 20, no. 1, pp. 220-230, Feb. 2012.
6. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, "My botnet is bigger than yours (maybe, better than yours): Why size estimates remain challenging," in Proc. 1st Conf. Workshop Hot Topics Understanding Botnets (HotBots'07), 2007.
7. N. Jiang, J. Cao, Y. Jin, L. E. Li, and Z.-L. Zhang, "Identifying suspicious activities through DNS failure graph analysis," in Proc. IEEE Int. Conf. Netw. Protocols, 2010, pp. 144-153.
8. S. Yadav, A. K. K. Reddy, A. L. N. Reddy, and S. Ranjan, "Detecting algorithmically generated malicious domain names," in Proc. Internet Meas. Conf., 2010, pp. 48-61.
9. V. L. L. Thing, M. Sloman, and N. Dulay, "A survey of bots used for distributed denial of service attacks," in SEC, 2007, pp. 229-240.
10. N. Ianelli and A. Hackworth, "Botnets as vehicle for online crime," in Proc. 18th Annu. 1st Conf., 2006.
11. P. Wang, S. Sparks, and C. C. Zou, "An advanced hybrid peer-topeer botnet," IEEE Trans. Dependable Secure Comput., vol. 7, no. 2, pp. 113-127, Mar./Apr. 2010.
12. M. Bailey, E. Cooke, F. Jahanian, Y. Xu, and M. Karir, "A survey of botnet technology and defenses," in Proc. Cybersecurity Appl. Technol. Conf. Homeland Security, 2009.
13. S. Yu, W. Zhou, and R. Doss, "Information theory based detection against network behavior mimicking DDoS attack," IEEE Commun. Lett., vol. 12, no. 4, pp. 319-321, Apr. 2008.
14. A. Scherrer, N. Larrieu, P. Owezarski, P. Borgnat, and P. Abry, "Non-Gaussian and long memory statistical characterizations for internet traffic with anomalies," IEEE Trans. Dependable Secure Comput., vol. 4, no. 1, pp. 56-70, Jan./Mar. 2007.
15. A. El-Atawy, E. Al-Shaer, T. Tran, and R. Boutaba, "Adaptive early packet filtering for protecting firewalls againstDOSattacks," in Proc. IEEE Conf. Comput. Commun. (INFOCOM), 2009.
16. J. Jung, B. Krishnamurthy, and M. Rabinovich, "Flash crowds and denial of service attacks: Characterization and implications for CDNS and web sites," in Proc. World Wide Web (WWW), 2002, pp. 252-262.
17. G. Carl, G. Kesidis, R. Brooks, and S. Rai, "Denial-of-service attack-detection techniques," IEEE Internet Comput., vol. 10, no. 1, pp. 82-89, Jan./Feb. 2006.
18. Y. Chen and K. Hwang, "Collaborative detection and filtering of shrew DDoS attacks using spectral analysis," J. Parallel Distrib. Comput., vol. 66, no. 9, pp. 1137-1151, 2006.
19. S. Kandula, D. Katabi, M. Jacob, and A. Berger, "Botz-4-sale: Surviving organized DDoS attacks that mimic flash crowds (awarded best student paper)," in Proc. Symp. Netw. Syst. Des. Implement. (NSDI), 2005.
20. Y. Xie and S.-Z. Yu, "A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors," IEEE/ACM Trans. Netw., vol. 17, no. 1, pp. 54-65, Feb. 2009.
21. M. A. Awad and I. Khalil, "Prediction of user's web-browsing behavior: Application of Markov model," IEEE Trans. Syst. Man Cybern. B, vol. 42, no. 4, pp. 1131-1142, Feb. 2012.
22. G. Oikonomou and J. Mirkovic, "Modeling human behavior for defense against flash-crowd attacks," in Proc. IEEE Conf. Comput. Commun., 2009.
23. S. Yu, S. Guo, and I. Stojmenovic, "Can we beat legitimate cyber behavior mimicking attacks from botnets," in Proc. IEEE Conf. Comput. Commun. (INFOCOM), 2012, pp. 3133-3137.
24. Z. K. Silagadze, "Citations and the Zipf-Mandelbrot's law," Complex Syst., vol. 11, p. 487, 1997.
25. M. E. Crovella and A. Bestavros, "Self-similarity in world wide web traffic: Evidence and possible causes," IEEE/ACM Trans. Netw., vol. 5, no. 6, pp. 835-846, 1997.
26. L. Breslau, P. Cao, L. Fan, G. Phillips, and S. Shenker, "Web caching and Zipf-like distributions: Evidence and implications," in Proc. IEEE Conf. Comput. Commun. (INFOCOM), 1999, pp. 126-134.
27. P. Borgnat, G. Dewaele, K. Fukuda, P. Abry, and K. Cho, "Seven years and one day: Sketching the evolution of internet traffic," in Proc. IEEE Conf. Comput. Commun. (INFOCOM), 2009, pp. 711-719.
28. M. Fomenkov, K. Keys, D. Moore, and K. Claffy, "Longitudinal study of internet traffic in 1998-2003," in Proc. Int. Symp. Inf. Commun. Technol. (WISICT), 2004.
29. WorldCup98 [Online]. Available: http://ita.ee.lbl.gov/html/contrib/WorldCup.html
30. NLANR. Passive measurement and analysis (PMA) project auckland-viii [Online]. Available: http://pma.nlanr.net/Special/auck8.html
31. S. Yu, G. Zhao, S. Guo, Y. Xiang, and A. Vasilakos, "Browsing behavior mimicking attacks on popular websites," in Proc. IEEE Conf. Comput. Commun. (INFOCOM) Workshops, 2011.
32. Z. Duan, X. Yuan, and J. Chandrashekar, "Controlling IP spoofing through interdomain packet filters," IEEE Trans. Dependable Secure Comput., vol. 5, no. 1, pp. 22-36, Jan./Mar. 2008.
33. H. Wang, C. Jin, and K. G. Shin, "Defense against spoofed IP traffic using hop-count filtering," IEEE/ACM Trans. Netw., vol. 15, no. 1, pp. 40-53, Feb. 2007.
34. Y. Kim, W. C. Lau, M. C. Chuah, and H. J. Chao, "Packetscore: A statistics-based packet filtering scheme against distributed denialof-service attacks," IEEE Trans. Dependable Secure Comput., vol. 3, no. 2, pp. 141-155, Apr./Jun. 2006.
35. C. Y. Cho, J. Caballero, C. Grier, V. Paxson, and D. Song, "Insights from the inside: A view of botnet management from infiltration," in Proc. USENIX Workshop Large-Scale Exploits Emergent Threats (LEET), 2010.
36. C. V. Zhou, C. Leckie, and S. Karunasekera, "Collaborative detection of fast flux phishing domains," J. Netw., vol. 4, no. 1, pp. 75-84, 2009.
37. S. Yu, S. Zhou, and S. Wang, "Fast-flux attack network identification based on agent lifespan," in Proc. IEEE Int. Conf. Wireless Commun. Netw. Inf. Security (WCNIS), Jun. 2010, pp. 658-662.
38. D. Dagon, C. Zou, and W. Lee, "Modeling botnet propagation using time zones," in Proc. 13th Netw. Distrib. Syst. Security Symp. (NDSS), 2006.
39. A. Klemm, C. Lindemann, M. K. Vernon, and O. P. Waldhorst, "Characterizing the query behavior in peer-to-peer file sharing systems," in Proc. 4th ACM SIGCOMM Conf. Internet Meas., 2004, pp. 55-67.
40. M. Hefeeda and O. Saleh, "Traffic modeling and proportional partial caching for peer-to-peer systems," IEEE/ACM Trans. Netw., vol. 16, no. 6, pp. 1447-1460, Dec. 2008.
41. M. Mitzenmacher, "A brief history of generative models for power law and lognornal distributions," Internet Math., vol. 1, 2004.
42. W. J. Reed and M. Jorgensen, "The double pareto-lognormal distribution-A new parametric model for size distributions," Commun. Stat. Theory Methods, vol. 33, no. 8, pp. 1733-1753, 2003.
43. B. A. Huberman, P. L. T. Pirolli, J. E. Pitkow, and R. M. Lukose, "Strong regularities in world wide web surfing," Science, vol. 280, no. 3, 1998.
44. W. Liu, P. P. Pokharel, and J. C. Principe, "Correntropy: Properties and applications in non-Gaussian signal processing," IEEE Trans. Signal Process., vol. 55, no. 11, pp. 5286-5298, Nov. 2007.
45. R. He, W.-S. Zheng, and B.-G. Hu, "Maximum correntropy criterion for robust face recognition," IEEE Trans. Pattern Anal. Mach. Intell., vol. 33, no. 8, pp. 1561-1576, Aug. 2011.
46. S. Burklen, P. J. Marron, S. Fritsch, and K. Rothermel, "User centric walk: An integrated approach for modeling the browsing behavior of users on the web," in Proc. 38th Annu. Symp. Simul. (ANSS'05), 2005 pp. 149-159.
47. Y. Xiang, W. Zhou, and M. Guo, "Flexible deterministic packet marking: An IP traceback system to find the real source of attacks," IEEETrans. Parallel Distrib. Syst., vol. 20, no. 4, pp. 567-580, June 2009.
48. S. Yu, W. Zhou, R. Doss, and W. Jia, "Traceback of DDoS attacks using entropy variations," IEEE Trans. Parallel Distrib. Syst., vol. 22, no. 3, pp. 412-425, Mar. 2011.
49. S. Yu, W. Zhou, S. Guo, and M. Guo, "A dynamical deterministic packet marking scheme for DDoS traceback," in Proc. IEEE Global Telecommun. Conf. (Globecom), 2013.