DDoS attack detection and wavelets

Proceedings - International Conference on Computer Communications and Networks, ICCCN

Volumn 2003-January, Issue , 2003, Pages 421-427

  Li, Lan ^a   Lee, Gyungho ^a  

^a 1120 Science and Engineering Offices   (United States)

Author keywords

Computational complexity; Computer crime; Energy capture; Filtering; IP networks; Power generation economics; Telecommunication traffic; Traffic control; Wavelet analysis; Web and internet services

Indexed keywords

COMPLEX NETWORKS; COMPUTATIONAL COMPLEXITY; DENIAL-OF-SERVICE ATTACK; ELECTRIC POWER DISTRIBUTION; FILTRATION; INTERNET; INTERNET PROTOCOLS; TELECOMMUNICATION SERVICES; TELECOMMUNICATION TRAFFIC; TRAFFIC CONTROL; WAVELET ANALYSIS;

ENERGY CAPTURE; ENERGY DISTRIBUTIONS; INTERNET SERVICES; IP NETWORKS; LOW COMPUTATIONAL COMPLEXITY; NETWORK TRAFFIC CHARACTERIZATIONS; POWER GENERATION ECONOMICS; TEMPORAL CORRELATIONS;

COMPUTER CRIME;

EID: 84952326439     PISSN: 10952055     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICCCN.2003.1284203     Document Type: Conference Paper

References (26)

1. Rocky K. C. Chang, "Defending against flooding-based distributed denial-of-service attack: a tutorial," IEEE Comm. Magazine, Vol.40 No.10, Oct. 2002, pp. 42-51.
2. M.E. Crovella and A. Bestavros, "Self-similarity in World Wide Web traffic: evidence and possible causes," IEEE/ACM Trans. on Networking, Vol.5 No.6, Dec. 1997, pp.835-846.
3. M. LaMonica, "Microsoft releases anti-Slammer tools," http://zdnet.com.com/2100-1105-983603.html, Feb. 6, 2003.
4. CERT, "Overview of attack trends," http://www.cert.org/archive/pdf/attack-trends.pdf, Apr. 8, 2002.
5. V. Paxson and S. Floyd, "Wide Area Traffic: The Failure of Poisson Modeling," IEEE/ACM Trans. on Networking, Vol. 3 No. 3, June 1995, pp.226-244.
6. S. Sarvotham, R. Riedi, and R. Baranuik, "Connection-Level Analysis and Modeling of Network Traffic," in Proc. of the ACM SIGCOMM IMW, Nov. 2001.
7. P. Ferguson and D. Senie, "Network ingress filtering: defeating denial of service attacks which employ IP address spoofing," Internet Draft, Jan. 1998.
8. W. Leland, M. Taqqu, W. Willinger and D. Wilson, "On the self-similar nature of Ethernet traffic," In Proc. ACM SIGCOMM, Vol.23 No.4, Aug. 1993, pp.183-193.
9. W. Leland, M. Taqqu, W. Willinger, and D. Wilson, "On the self-similar nature of Ethernet traffic (Extended Version)," IEEE/ACM Trans. on Networking, Vol. 2 No.1, Feb. 1994, pp.1-15.
10. K. Park and H. Lee, "On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack," in Proc. of IEEE INFOCOM'01, Apr. 2001, pp. 338-347.
11. K. Fox, R. Henning, J. Reed, and R. Simonian, "A Neural network approach towards intrusion detection," Technical Report, Harris Corporation, July 1990.
12. P. Abry and D.Veitch, "Wavelet analysis of long range dependent traffic," IEEE Trans. on Infor. Theory, Vol. 44, No. 1, Jan. 1998, pp.2-15.
13. The Network Simulator-ns-2. Available from "http://www.isi.edu/nsnam/ns/"
14. The Internet traffic archive. "http://ita.ee.lbl.gov/", Apr. 2000.
15. CERT Advisory CA-2001-23, Continued Threat of the "Code Red" Worm, Jan. 17, 2002.
16. D. Moore, C. Shannon, and J. Brown, "Code-Red: a case study on the spread and victims of an Internet worm," In Proc. Internet Measurement Workshop, 2002.
17. P. Abry, D. Veitch, and P. Flandrin, "Long-range dependence: revisiting aggregation with wavelets," Journal of Time Series Analysis, Vol. 19, May 1998. pp. 253-266.
18. X. Tian, J. Wu, C. Ji, "A unified framework for understanding network traffic using independent wavelet models," In Proc. IEEE INFOCOM, June 2002.
19. S. Ma and C. Ji, "Modeling heterogeneous network traffic in wavelet domain," IEEE/ACM Trans. Networking, Vol.9, No. 5, October 2001, pp. 634-649.
20. P. Barford and M.E. Crovella, "Generating representative Web workloads for network and server performance evaluation," in ACM SigMetrics, 1998, pp.151-160.
21. R. Ritke, X. Hong, and M. Gerla, "Contradictory relationship between Hurst parameter and queuing performance (extended version)," Telecommunication Systems, Vol 16, Feb. 2001, pp.159-175.
22. N. Ye, "A Markov chain model of temporal behavior for anomaly detection," in Workshop on Information Assurance and Security, June 2000.
23. P. Barford, J. Kline, D. Plonka and A.Ron, "A signal analysis of network traffic anomalies," Internet Measurement Workshop, Nov. 2002.
24. M. Roghan, D. Veitch, and P. Abry. "Real-time estimation of the parameters of long-range dependence," IEEE/ACM Trans. on Networking, Vol.8, Aug. 2000, pp 467-478.
25. R. Riedi, M. S. Crouse, V. Ribeiro, and R. G. Baraniuk, "A multifractal wavelet model with application to TCP network traffic," IEEE Trans. Info. Theory, Special issue on multiscale statistical signal analysis and its applications, vol. 45, pp. 992-1018, April 1999.
26. Z. Zhang, V. J. Ribeiro, S. Moon, and C. Diot, "Small-time scaling behaviors of Internet backbone traffic: an empirical study," In Proc. IEEE INFOCOM, April 2003.