Statistical approaches to DDoS attack detection and response

Proceedings - DARPA Information Survivability Conference and Exposition, DISCEX 2003

Volumn 1, Issue , 2003, Pages 303-314

  Feinstein, L ^a   Schnackenberg, D ^a   Balupari, R ^b   Kindred, D ^b  

^a BOEING COMPANY   (United States)

^b Network Associates Laboratories   (United States)

Author keywords

Computer crime; Computer networks; Distributed computing; Entropy; Frequency; IP networks; Performance analysis; Prototypes; Telecommunication traffic; Web and internet services

Indexed keywords

COMPUTER AIDED NETWORK ANALYSIS; COMPUTER CRIME; COMPUTER NETWORKS; DISTRIBUTED COMPUTER SYSTEMS; DISTRIBUTED PARAMETER NETWORKS; ENTROPY; INTERNET; INTERNET PROTOCOLS; NETWORK SECURITY; TELECOMMUNICATION NETWORKS; TELECOMMUNICATION SERVICES; TELECOMMUNICATION TRAFFIC;

FREQUENCY; INTERNET SERVICES; IP NETWORKS; PERFORMANCE ANALYSIS; PROTOTYPES;

DENIAL-OF-SERVICE ATTACK;

EID: 84942256107     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DISCEX.2003.1194894     Document Type: Conference Paper

References (17)

1. D. Dittrich, "The 'Stacheldraht' Distributed Denial of Service Attack Tool", http://staff.washington.edu/dittrich/misc/stacheldraht.analysis, 1999.
2. C. Faloutsos, M. Faloutsos, and P. Faloutsos, "On Power-Law Relationships of the Internet Topology," Proc. of ACM SIGCOMM, Aug. 1999, pp. 251-262.
3. T.M. Gil, M.A. Poletto and E.W. Kohler, Jr. "Statistics Collection for Network Traffic", United States Patent Application, March 21, 2002.
4. B. Hubert, "Linux Advanced Routing and Traffic Control HOWTO", http://lartc.org/howto/.
5. D. Knuth, The Art of Computer Programming: Seminumerical Algorithms, Third edition, Vol. 2, Addison- Wesley, Reading, Massachusetts, 1997.
6. M.V. Mahoney and P.K. Chan, "Learning Nonstationary Models of Normal Network Traffic for Detecting Novel Attacks", SIGKDD '02, Edmonton, Alberta, Canada, July 23-26, 2002, pp. 376-385.
7. R. Manajan, et al., "Controlling High Bandwidth Aggregates in the Network", SIGCOMM Computer Communications Review, 32(3), July 2002.
8. D. Moore, G. Voelker, and S. Savage, "Inferring Internet Denial-of-Service Activity", Proceedings of USENIX Security Symposium 2001, pp. 9-22.
9. E. Mouw, "Linux Kernel Procfs Guide", http://www.kernelnewbies.org/documents/kdoc/procfs-guide/lkprocfsguide.html.
10. Netflood Infosec Tools & Resources, Source Code to Stacheldraht, http://netflood.net/files/Dos/DDoS.
11. O. Pomerantz, "Linux Kernel Module Programming Guide", http://www.tldp.org/LDP/lkmpg/mpg.html.
12. P.A. Porras, and P.G. Neumann, "EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances," Proceedings of the National Information Systems Security Conference (NISSC), October 1997, pp. 353-365.
13. M. Roesch, (March 2002), "Snort Users Manual: Snort Release 1.8.5", http://www.snort.org/documentation.html, March 2002.
14. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks" Proceedings of the 13th Systems Administration Conference (LISA'99), USENIX Association, 1999, pp. 229-238, http://www.snort.org/docs/lisapaper.txt.
15. R. Russell and H. Welte, "Linux Netfilter Hacking HOWTO", http://cvs.netfilter.org/cgi-bin/cvsweb/netfilter/documentation/HOWTO/.
16. D. Schnackenberg, K. Djahandari, and D. Sterne, "Infrastructure for Intrusion Detection and Response", DISCEX 2000, January 2000, pp. 1003-1011.
17. C.E. Shannon, and W. Weaver, The Mathematical Theory of Communication, University of Illinois Press, 1963.