Pi: A path identification mechanism to defend against DDoS attacks

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2003-January, Issue , 2003, Pages 93-107

  Yaar, A ^a   Perrig, A ^a   Song, D ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INTERNET; INTERNET PROTOCOLS; NETWORK SECURITY;

DDOS ATTACK; DETERMINISTIC MECHANISM; DISTRIBUTED DENIAL OF SERVICE ATTACK; INTERNET TOPOLOGIES; IP ADDRESSS; PACKET MARKING; PATH IDENTIFICATIONS; PATH IDENTIFIERS;

DENIAL-OF-SERVICE ATTACK;

EID: 84954422497     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SECPRI.2003.1199330     Document Type: Conference Paper

References (34)

1. Micah Adler. Tradeoffs in probabilistic packet marking for IP traceback. In Proceedings of 34th ACM Symposium on Theory of Computing (STOC), 2002.
2. S. Bellovin, M. Leech, and T. Taylor. The ICMP traceback message. Internet-Draft, draft-ietf-itrace-01.txt, October 2001. Work in progress, available at ftp://ftp.ietf.org/internet-drafts/draft-ietf-itrace-01.txt.
3. Hal Burch and Bill Cheswick. Internet watch: Mapping the Internet. Computer, 32(4):97-98, April 1999.
4. Hal Burch and Bill Cheswick. Tracing anonymous packets to their approximate source. Unpublished paper, December 1999.
5. Caida. Skitter. http://www.caida.org/tools/measurement/skitter/ , 2000.
6. Computer Emergency Response Team (CERT). TCP SYN flooding and IP spoofing attacks. Technical Report CA-96: 21, Carnegie Mellon University Pittsburgh, PA, September 1996.
7. Internet Software Consortium. Internet domain survey host count. http://www.isc.org/ds/hosts.html , July 2002.
8. Drew Dean, Matt Franklin, and Adam Stubblefield. An algebraic approach to IP traceback. In Network and Distributed System Security Symposium (NDSS '01), February 2001.
9. Drew Dean, Matt Franklin, and Adam Stubblefield. An algebraic approach to IP traceback. ACM Transactions on Information and System Security, May 2002.
10. Drew Dean and Adam Stubblefield. Using client puzzles to protect TLS. In Proceedings of the 10th USENIX Security Symposium, August 2001.
11. Nick G. Duffield and Matthias Grossglauser. Trajectory sampling for direct traffic observation. In Proceedings of the 2000 ACM SIGCOMM Conference, August 2000.
12. C. Dwork and M. Naor. Pricing via processing or combatting junk mail. In Ernest F. Brickell, editor, Advances in Cryptology - Crypto '92, pages 139-147, 1992.
13. P. Ferguson and D. Senie. Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing. RFC 2267, January 1998.
14. Internet mapping. http://research.lumeta.com/ches/map/ , 2002.
15. John Ioannidis and Steven M. Bellovin. Implementing Pushback: Router-based defense against DDoS attacks. In Proceedings of the Symposium on Network and Distributed Systems Security (NDSS 2002), February 2002.
16. ICMP traceback (itrace). IETF working group, http://www.ietf.org/html.charters/itrace-charter.html.
17. A. Juels and J. Brainard. Client puzzles: A cryptographic defense against connection depletion attacks. In Proceedings of the 1999 Network and Distributed System Security Symposium (NDSS '99), pages 151-165, 1999.
18. Jaeyeon Jung, Balachander Krishnamurthy, and Michael Rabinovich. Flash crowds and denial ofservice attacks: Characterization and implications for CDNs and web sites. In The Eleventh International World Wide Web Conference (WWW 11), May 2002.
19. Jun Li, Jelena Mirkovic, Mengqiu Wang, Peter Reiher, and Lixia Zhang. SAVE: Source address valididty enforcement protocol. In Proceedings of IEEE INFO- COMM 2001, April 2001.
20. Ratul Mahajan, Steven M. Bellovin, Sally Floyd, John Ioannidis, Vern Paxson, and Scott Shenker. Controlling high bandwidth aggregates in the network. CCR, 32(3):62-73, July 2002.
21. A. Mankin, D. Massey, C.L. Wu, S.F. Wu, and L. Zhang. On design and evaluation ofintention-driven ICMP traceback. In Proceedings of the IEEE International Conference on Computer Communications and Networks, October 2001.
22. David McGuire and Brian Krebs. Attack on internet called largest ever. washingtonpost.com, October 2002. http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html.
23. David Moore, Geoffrey Voelker, and Stefan Savage. Inferring internet denial of service activity. In Proceedings of the 10th USENIX Security Symposium, August 2001.
24. Vern Paxson. An analysis ofusing reflectors for distributed denial-of-service attacks. Computer Communication Review, 31(3), 2001.
25. Associated Press. Internet attack was much worse than anticipated. foxnews.com, January 2003. http://www.foxnews.com/story/0,2933,76804,00.html.
26. R. L. Rivest. The MD5 message digest algorithm. RFC 1321, Internet Activities Board, Internet Privacy Task Force, April 1992.
27. Stefan Savage, David Wetherall, Anna Karlin, and Tom Anderson. Practical network support for IP traceback. In Proceedings of the 2000 ACM SIGCOMM Conference, August 2000.
28. Stefan Savage, David Wetherall, Anna Karlin, and Tom Anderson. Network support for IP traceback. ACM/ IEEE Transactions on Networking, 9(3), June 2001.
29. Christoph L. Schuba, Ivan V. Krsul, Markus G. Kuhn, Eugene H. Spafford, Aurobindo Sundaram, and Diego Zamboni. Analysis ofa denial ofservice attack on TCP. In Proceedings of the IEEE Symposium on Research in Security and Privacy, May 1997.
30. Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Stephen T. Kent, and W. Timothy Strayer. Hash-based IP traceback. In Proceedings of the ACM SIGCOMM 2001 Conference, pages 3-14, August 2001.
31. Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Beverly Schwartz, Stephen T. Kent, and W. Timothy Strayer. Single-packet IP traceback. IEEE/ ACM Transactions on Networking (ToN), 10(6), December 2002.
32. Dawn X. Song and Adrian Perrig. Advanced and authenticated marking schemes for IP traceback. In Proceedings of IEEE INFOCOMM 2001, April 2001.
33. Robert Stone. CenterTrack: An IP overlay network for tracking DoS floods. In Proceedings of the 9th USENIX Security Symposium, Denver, Colorado, August 2000. USENIX.
34. Minho Sung and Jun Xu. IP traceback-based intelligent packet filtering: A novel technique for defending against internet DDoS attacks. In Proceedings of the 10th IEEE International Conference on Network Protocols (ICNP'02), November 2002.