Defending Against DDOS Flooding Attacks

Transcription

Baldev Singh et al., International Journal of Computer & IT [ISSN No.(Print):2320-8074]
Defending Against DDOS Flooding Attacks- A Data Streaming
Approach
Baldev Singh
Research Scholar
Punjab Technical University, India
Abstract-
Distributed Denial of Service
(DDOS) attacks can easily exhaust the
computing resources or bandwidth of the
potential targets, by flooding massive packets,
hence these are desirable to be detected and
mitigated at the earliest before reaching the
victim.
Internet
infrastructure
and
communication are under the threat of the
DDOS attack. DDOS attacks is challenging and
glaring day by day, due to Internet of Things,
multifaceted properties of DDOS attacks like
dynamic attack rates, various kinds of targets, a
large scale of botnets, etc. This paper focuses on
Stream-based DDOS defense framework for
early detection of DDOS attacks, keeping in
mind the network-performance-degradation of
the whole system as little as possible.
Keywords:
DDOS
attack,
Intrusion
Detection, Cloud Security, Flooding attacks,
Data streaming.
I.
INTRODUCTION
Cyber criminals acting are the underground
criminals that work to achieve their private
individual goals best known for their keen interest
in spying or for competitive monetary gains or
motives. They are using the disruptive
technologies like DDOS attack. Thus making the
science of DDOS attacks ever evolving and
growing in current context in such a manner that a
continuous
monitoring
with
sophisticated
watchdog capabilities is required as these attacks
continues to create online outrages, customer
inconvenience and reputation damages across all
industries and geographies. The best known
victims of recent moves of these DDOS attacks
[24], [27] and those who have been successfully
being able to mitigate such attacks [20] can never
get a sound sleep as it is apparent from current
incidences of this attack globally.
II.
DDOS ATTACK
A DDOS attack is a malicious attempt to make the
resources (a server or a network resource)
© 2015, IJCIT All Rights Reserved
Dr. S. N. Panda
Director (Research)
Chitkara University Rajpura, India
unavailable to the users usually by blocking or
interrupting the services of a host machine to the
Internet. DDOS attack took place by using many
computers and many Internet connections often
distributed globally. Following figure shows a
simple DDOS attack scenario [17], [18] in which
multiple attacking computers are sending streams
of malicious packets to victim machine. DDOS
attacks attempt to perform various malicious
operations. The operations include: controlling
legitimate network traffic by flooding the network
with malicious traffic, denying access to a service
by way of disrupting communication between
legitimate sender and receiver and blocking the
access of a particular service or an individual.
These attacks lead to disruption of services in
cloud and is considered as one of the important
intrusions in cloud computing.
Intrusion detection and prevention
systems taxonomy attacks are classified as outside
attacks and inside attacks [25],[26]. The attacks
that come from external origins are called outsider
attacks. Insider attacks, involve unauthorized
internal users attempting to gain and misuse nonauthorized access privileges. Intrusion detection is
the mechanism of monitoring computers or
networks for unauthorized entry, activity or ﬁle
modiﬁcation [10],[11]. Attacks may be treated as
incidents. Although many incidents are malicious
in nature, many others are not; for example, a
person might mistype the address of a computer
and accidentally attempt to connect to a different
system without authorization.
III.
CLASSIFICATION OF
ATTACKS
DDOS
DDOS attack results to disruption of services in
cloud and is considered as one of the important
intrusions in cloud computing [7], [8]. The DDOS
attacks [9] can be classified as under :
Bandwidth Attacks: The common reason of
bandwidth attacks is the aspiration to create a
severe problem to someone else's infrastructure by
way of generating a traffic overload. Bandwidth
attacks do vary. These Attacks are anticipated to
overflow and consume available resources of the
P a g e | 38
victim (for example: network bandwidth). Some
examples of Bandwidth chocking in context of
DDOS attacks are TCP SYN Flood, UDP Flood
and ICMP Flood (Ning & Han, 2012), (Retrieved
December
13,
2014,
from
http://www.carbon60.com/the-truth-about-DDOSattacks-part-1).
system and application software) to gain
unauthorized access of the system, attack other
systems, and harm the system. There exists some
software that are itself hostile and do damage.
Without software vulnerabilities, it is very difficult
that viruses would exist and may gain any
unauthorized access to the resources and do any
harm
Protocol Attacks: Protocol Attacks exploit a
specific feature or implementation bug of some
protocol installed at the victim for the purpose of
consuming maximum amount of its resources to
take benefit of protocol intrinsic design. All these
attacks require a lot of attackers (zombies) and are
mitigated by changing the protocol features. Some
examples of popular protocol attacks are as under:
SYN Flood Attack: A SYN flood attack is a form
of DOS attack [21],[22] which occurs when a host
sends a flood of TCP/SYN packets, frequently with
a fake sender address to target's system in an
attempt to consume a huge amount of server
resources to make the system unresponsive to
legitimate traffic (Chuiyi,Yizhi, Yuan, Shuoshan &
Qin, 2011). Each of these packets in TCP
connection is handled like a connection request by
sending a SYN (synchronize) message to the server
, causing the server to spawn a half-open
connection, by sending back a TCP/SYN-ACK
packet (known as acknowledgement), and also
waiting for a packet in response from the sender
address ( as a response to the ACK Packet).
However, the responses never come because the
sender address is fake. Due to these half-open
connections, network congestion occurs that
saturate the number of available connections that
the server is able to make to legitimate requests of
the clients.








Smurf Attack
UDP Attack
ICMP Attack
SYN attack
Attack using DNS systems.
CGI request attack
Attack using spoofed address in ping
Authentication server attack etc.
Software
Vulnerability
Attacks:
Software
Vulnerability Attacks allows an attacker to exploit
a software program design flaw that may be a Land
attack, Ping of Death or Fragmentation etc.
Vulnerability in software means a weakness which
permits an attacker to lessen a system's information
assurance. Software vulnerabilities can be into
design, implementation and configuration of the
software.
Vulnerability comprises of three
elements that are: system susceptibility, attacker
access to the flaw, and capability of attacker to
make use of the flaw. To make use of
vulnerability, an attacker must have at least one
applicable tool or technique that set up the
connection to a system flaw. Software
vulnerability is also considered as the attack
surface. Software vulnerability control is must in
computer and network security because of the
following reasons:
Virus programs are major organs to make the
system vulnerable. These programs make use of
vulnerabilities in software (operating system and
application software) to gain unauthorized access,
spread and then harm the system. Intruders also
make use of vulnerabilities in software (operating
Fig 1.: DDOS Attack Network
Smurf Attack: A smurf attack is a distributed
denial-of-service attack in which a system is
flooded with spoofed ping messages. These
flooded spoofed ping messages create high
computer network traffic on the victim’s network,
which repeatedly make it unresponsive. In this type
of attack, ICMP echo request (ping) packets
addressed to an IP broadcast address that creates a
large number of responses (Retrieved December
13, 2014 from http://www.cert.org/advisories/CA1996-21.html). Hence each host on the subnet
P a g e | 39
replies to the same ping request and the huge
responses can consume all available network
bandwidth, particularly if data is appended to the
ping request. Large number of pings and the
resulting echoes can make the network
unresponsive for legitimate traffic and prevent
legitimate traffic from being transmitted during the
attack.
ICMP Flood: An ICMP Flood is like the other
flooding attack [23] that sends peculiarly large
number of ICMP packets (Udhayan & Anitha
2009). This flood of packets can overwhelm a
target server that attempts to process every
incoming ICMP request, and can be the cause of
denial-of-service condition for the target server.
This attack is accomplished by broadcasting a lot
of ICMP packets, usually the ping packets. The
main aim to send large amount of data to the target
server is to slow down it so much and get
disconnected due to timeouts. Mainly, Ping flood
attacks causes the saturation of a network by
sending a continuous series of ICMP echo requests
over a high-bandwidth connection to a target
system on a lower bandwidth connection.
Ping of death: A ping of death is a denial of
service attack that sends a malformed or otherwise
malicious ping to a computer. Normally a ping is
of 32 bytes in size. This type of attack is caused by
an attacker intentionally sending an IP packet
larger than the 65,536 bytes allowed by the IP
protocol. When such a packet is sent to a system
with a vulnerable TCP/IP stack, it will cause the
system to crash. Most modern day firewalls are
capable of filtering such oversized packets. Now a
different type of ping attack are prevailing like
ping flooding that simply floods the victim with so
much ping traffic that normal traffic fails to reach
the system.
LAND Attack: A LAND (Local Area Network
Denial) attack is a kind of denial of service attack
that consists of sending a special poison (spoofed
packet) to a computer, causing it to lock up. A
LAND attack consists of a stream of SYN attack
with IP spoofing that occurs when an attacker
sends spoofed SYN packets containing the IP
address of the victim as both the destination and
the source IP address. Therefore the receiving
system responds by sending the SYN-ACK packet
to itself, creating an empty connection that lasts
until the idle timeout value is reached. If the
system is flooded with such empty connections, it
can overwhelm the system that may result a denial
of service.
Teardrop: Teardrop attack is an Operating System
specific denial-of-service (DOS) attack [1], [3].
These attacks exploit the reassembly of fragmented
IP packets. The Teardrop, though, is an old attack
that relies on poor TCP/IP implementation that is
still around. This kind of attack involves sending
fragmented packets to a target machine. Since the
machine receiving such packets cannot reassemble
them due to a bug in TCP/IP fragmentation
reassembly, the packets overlap one another,
crashing the target network device. In an IP header,
one of the fields is the “fragment offset” field,
specifying the starting position, or offset, of the
data enclosed in a fragmented packet relative to the
data in the original packet. In case the sum of the
offset and size of one fragmented packet varies
from that of the next fragmented packet, the
packets overlap. If this occurs, a system vulnerable
to teardrop attacks is unable to reassemble the
packets and results in a denial-of-service.
IV.
DDOS ATTACKS AND CLOUD SECURITY
Technology of cloud computing provides a way of
using computing and storage resources by using
Internet and remote servers. It presents a new way
of using remote resources.
The usage of
computing resources is charged on usage basis
where a user contracts services from a service
provider by paying according to what it uses.
Cloud computing makes it happen to use the
applications without particular installation on
personal computers, it is only by accessing and
using the services by way of Internet. Cloud
computing is an enabled service that may be used
for various benefits to its like ease of deploying
computer and information technology resources for
fresh business, a lesser amount of system operating
and
maintenance costs and lessening of
deployment time in any setup.
The National Institute of Standard and
Technology (NIST) defines Cloud Computing as
the model for enabling convenient, on-demand
network access to a shared pool of configurable
computing resources (e.g., Networks, servers,
storage, applications, and services) that can be
rapidly provisioned and released with minimal
management effort or service provider interaction
[16]. Cloud Computing is one of the fastest
growing service models on the Internet. Various
large scale IT service providers, like Amazon and
IBM, share their data centers, by using
virtualization concepts, for the public usage of
their computational resources. By using cloud
computing, the users of cloud can minimize many
startup financial overheads as well as obtain an
increase in the availability and scalability for their
cloud-hosted applications. In addition, cloud users
can avail on-demand service with the ease of PayAs-You-Go subscription.
Security is one of important issues
prevailing in the cloud environment. Cyber attacks
P a g e | 40
[2],[4] against large internet ventures keep on
rising and they directly affect the cloud users[5].
Cloud customers (organizations) are questioning
the security of moving their computational assets
toward the cloud. These improper operations are
generally conducted for a number of reasons.
Financial gain can also be a motivation to steal
valuable information from sensitive organizations
such as those in the banking sector. Cyber
surveillance operations typically conducted to
gather information about financial or industrial
adversaries are some of the new trends over the
internet. Existing network security mechanisms
face new challenges in the cloud such as DDOS
attacks [14], virtual machine intrusion attacks and
malicious user activities. Hence, new security
methods [7],[9] are required to increase users'
level of trust in clouds. Presently, cloud service
providers implement data encryption for the data
centers, virtual firewalls and access control lists.
DDOS attack statistics: The following table
shows a brief statistics of various attacks.
Y
ea
r
Attack Description
20
14
114 percent increase in average peak
bandwidth of DDOS attacks in Q1 vs. Q4
2013. The Media and Entertainment
industry was the target of the majority of
malicious attacks.
(Retrieved December 05, 2014 from
http://www.akamai.com/html/about/press/
releases/2014/press-041714.html)
20
13
20
12
20
11
20
10
20
09
20
08
20
07
20
06
20
DDOS attack on stock exchange websites
in London.
DDOS Attack on Canadian Political Party
Elections and on US and UK Government
Sites
DDOS attack on Sony.
DDOS—December 3-5, 2010 on PayPal.
DDOS flooding attacks on South Korea
and the United States in July 2009 against
government news media and financial
websites.
DDOS Attack on BBC, Amazon.com
and eBuy.
Estonia Cyber Attack
Target US Banks for financial gain.
Attack on SCO Group website to make it
04
20
03
20
02
20
01
inaccessible to valid users.
Attack on SCO and Microsoft.
20
00
One of the first major DDOS flooding on
Yahoo
DDOS flooding attack thru Domain
Name System (DNS) service.
DNS servers attack as reflectors. DOS
attack on Irish Government’s Department
of Finance server. The target was
Register.com
Table 1: DDOS attack statistics (Retrieved
December
05,
2014
from
http://www.cloudsecurityalliance.org/topthreats/cs
athreats.v1.0.pdf), (Tripathi,Gupta, & Veluru,
2013)
Since, the target of the any DDOS
attackers is normally to block or oversubscribe a
resources in such a way that it leads to degraded
service performance time , long response time
matching the demand of processing the incoming
workload remains a constant headache. Many
methods have been evolved over a considerable
time now and all these methods or technologies
that claim to safeguard us from DDOS attacks also
consider the various possible correlations that
might be working to advantage of the attackers.
V.
DETECTION OF DDOS FLOODING
ATTACKS – A REVIEW
(1) The research work of L. Jun-Ho et.al. has
presented in the [12] is based on intrusion
detection at multiple levels. As above research
work has proposed intrusion detection on basis of
fast attacks and slow attacks, the later is based on
security implementation at multiple levels. [12]
proposed different anomaly levels in cloud
environment that are authentication, authorization
and accounting (AAA). They also proposed three
security levels for effective intrusion detection
system that are High, Medium and Low. In case of
High level of security requirement, they has
suggested that- the patterns of all the known
attacks are to be considered and the requisite rules
for higher level security are to be implemented.
They were of the opinion that when the user
accesses the cloud environment first time, the multi
level intrusion detection system (IDS) must judge
the anomaly level of the user. For judgment of
anomaly level, [12] suggested various parameters
like vulnerable ports attack, IP address coverage of
user, attack success possibilities, attack occurrence
P a g e | 41
possibilities etc. They suggested risk points for
different security groups. If the risk points are
greater than six, the anomaly level is of High level,
risk points between 3-5 (both inclusive), the
anomaly level is of medium level and for risk
points 0-2, the anomaly level is of low level and
accordingly IDS [29] is required to be imposed.
(2) “Defending Web services against denial of
service attacks using client puzzle” was suggested
by [26]. The effectiveness of defending web
services from DOS attacks using client puzzles a
cryptographic counter measure which provides a
form of gradual authentication by requiring the
client to solve some computationally difficult
problem before access is granted. Hash based
puzzle is integrated into existing web service (i)
framework. Client puzzles are an effective defense
against flooding and DDOS attacks.
(ii)
(3) “A Detection scheme for flooding attack on
application layer based on semantic concept” was
propounded by [27]. Flooding attack on cloud
application layer [19] does not cause complete
denial of service to a Web server. In this paper
semantic concept is used to identify malicious
browsing behaviour to improve performance and
cut down the cost.
(4) Static threshold based intrusion detection
system[6] was proposed by Kim et al. (2004),
Gates and Damon (2005), Leckie et al (2002) and
Faizal et al (2009). Network IDS technique
proposed by (Abdollah, Masud, Shahrin & Robiah,
2009) has used the concept of static threshold [28]
although dynamic threshold is better solution. The
threshold is used to differentiate between normal
traffic and abnormal traffic [17] in the network.
This threshold value is acquired by using
observation and experimental technique and the
verified by using statistical process control
approach [13].
As per our systematic review of related works in
the field of DDOS attacks detection [], there are
many techniques which can be used to detect
intruders or malicious behavior in the network are
reviewed. These techniques have their own
negatives and positives. To comprehend this field
of attacks detection, we must look at what each
technique holds in its favour and what trade-offs it
must make to achieve its goals particularly to make
out the abnormal behavior which seems to be
flooding DDOS attack.
VI.
PROPOSED STREAM-BASED DDOS
DEFENSE FRAMEWORK
Data streaming queries are referred to as
continuous as they are constantly “standing” over
the streaming tuples and continuously producing
output results. Data streaming is proposed for
DDOS detection at high-speed network links [15]
[16], where streams of packets are processed by
continuous queries to find anomalous DDOSrelated traffic patterns in real time. Various
challenges in employing streaming for DDOS
detection and mitigation comprise:
Identification of characteristics that signify
attacks and that can be detected in a streaming
manner
Designing
appropriate
stream-based
processing methods that can execute the above
on large volumes of data given the time and
other resources constraints.
Motivated by the above challenges, we
propose signature based and anomaly based
DDOS detection mechanisms for monitoring
traffic and detecting DDOS-anomalies from
high-speed network links in an efficient data
streaming fashion. Fig.2 shows the streambased DDOS defense framework.
Fig.2: Stream-based DDOS defense framework
Proposed stream-based
framework provides:

DDOS
defense
Protection against different types of
DDOS attacks: a small set of traffic
features are identified to capture the
P a g e | 42

anomalies reflecting most of important
types of DDOS attacks, including
bandwidth flooding attacks and SYNflooding attacks.
Joint process of profiling and monitoring:
anomaly-based DDOS detections usually
address online detection and referenced
profile training separately. However, it is
desirable to keep the referenced profile
updating with the evolution of normal
traffic. As a consequence, it can be
employed to detect and mitigate DDOS
attacks at high-speed network links
making early DDOS detection possible.
Although considerable effort has been
made to understand, detect and prevent
these attacks, since it is a continuously evolving as
technology, new ways are found by anti
development sources to compromise the Cloud
based Systems, therefore methods that are based on
single, multi range thresholds for detection, require
constant upgradation as well refinement in terms
of the algorithms for accuracy and robustness. The
threshold based algorithms for detection of DDOS
attack must always numerically stable as well as
must not depend on predefined thresholds.
VII. CONCLUSION
There will be increase in the frequency of the
DDOS attacks due to multifold increase in the
online activities and wireless Internet of things. It
is also apparent that the very idea of building
defending lines of action against such act of
destruction depends on computations coming out
of the stream of the traffic at different ends of the
network of networks. In our research work we
intend to analyze methods that can deal with
skewed datasets (the ratio of data-row of normal
behaviour (benign traffic) to abnormal behaviour
(malignant traffic) rows in the profiling session of
virtual machines) (trace files or profile files) for
detection of DDOS attacks, since the thresholds
cannot be static in nature (the statistical behaviour)
in any way in network (may be cloud environment)
for parameters that are critical to analyze for
identification of DDOS Attacks. The signature
based and anomaly based DDOS detection
mechanism is proposed which encompasses the use
of dynamic and multi threshold based algorithmic
approach.
REFERENCES
[1] Ahmed Patel et. al., “An intrusion detection and
prevention system in cloud computing: A systematic
review”, Journal of Network and Computer Applications
(2012), http://dx.doi.org/10.1016/j.jnca.2012.08.007
[2] Vincenzo Gulisano, Zhang Fu, Mar Callau-Zori,
Ricardo Jimenes-Peris, Marina Papatraintafilou, Marta
Patino-Martinez
“STONE: A Stream-based DDoS
Defense Framework Technical Report” no. 2012-07,
ISSN 1652-926X, Chalmers University of Technology,
Sweden, 2012
[3] B. B. Gupta, R. C. Joshi and M. Misra, “Defending
against Distributed Denial of Service Attacks: Issues and
Challenges,” Information Security Journal: A Global
Perspective, Vol. 18, No. 5, 2009, pp. 224-247.
[4] “CERT Advisory: SYN Flooding and IP Spoofing
Attacks,” CERT® Coordination Center Software
Engineering Institute, Carnegie Mellon, 2010.
http://www.cert.org/advisories/CA-1996-21.html
[5] Cloud Security Alliance, March 2010 ―Top Threats
to
Cloud
Computing
at
(http://www.cloudsecurityalliance.org/topthreats/csathre
ats.v1.0.pdf)
[6] Faizal M.A., and Zaki M.M., and Shahrin S., and
Robiah Y., and Rahayu S.S., (2010) Statistical Approach
for Validating Static Threshold in Fast Attack Detection.
Journal of Advanced Manufacturing.
[7] Felix Lau Simon , Stuart H. Rubin , H. Smith ,
Trajkovic , “Distributed Denial of Service Attacks”;
http://www2.ensc.sfu.ca/~ljilja/papers/smc00_edited.pdf,
2000.
[8]SUNET. The Swedish University Computer Network
OptoSUNET, www.basun.sunet.se/engelska.html.
H. Jin, G. Xiang, D. Zou, “A VMM-based intrusion
prevention system in cloud computing environment,”The
Journal of Supercomputing, pp. 1–19, 2011.
[9] I.S. Institute, DDOS Attack Categorization,
University of Southern California. DDOS Bechmarks;
(http://www.isi.edu/~mirkovic/bench/), 2015.
[10] Jagadeeshraj.V.S , Lijoy C. George , Thenmozhi.S,
“Attaining Pre-Eminent Cloud Security Using Intrusion
Detection Systems, International Journal of Emerging
Technology and Advanced Engineering, Volume 3, Issue
2, February 2013.
[11] Kelly Beardmore, “The Truth about DDoS Attacks:
Part1, TheCarbon60Blog. http://www.carbon60.com/th
e-truth-about-DDOS-attacks-part-1/Nov.21, 2013.
[12] L. Jun-Ho et.al. “Multi-level intrusion detection
system and log management in cloud computing,”
Proceedings of the13th International Conf. pp. 552–
555,
Feb. 2011
[13] Mohd Faizal Abdollah, Mohd Zaki Masud, Shahrin
S., Robiah Y. , Siti Rahayu S. “Threshold verification
using Statistical Approach for Fast Attack Detection”
Intl. Journal of Computer Science and Information
Security, Vol.2, No 1, 2009.
[14] Monowar H. Bhuyan, H. J. Kashyap, D. K.
Bhattacharyya and J. K. Kalita. Detecting Distributed
Denial of Service Attacks: Methods, Tools and Future
Directions . The Computer Journal, 2013.
P a g e | 43
[15] Nathalie Weiler, Computer Engineering and
Networks Laboratory (TIK), “Honeypots for Distributed
Denial of Service Attacks”, Eleventh IEEE International
Workshops on Enabling Technologies: Infrastructure for
Collaborative Enterprises, 2002.
[16] Peter Mell and Tim Grance, October 7, 2009 The
NIST Definition of Cloud Computing version 15,
National Institutes of Standards and
Technology
(NIST), Information Technology Laboratory-Intrusion
Detection
(http://en.wikipedia.org/wiki/Intrusion_detection_system
)
[17] R. C. R. Bhadauria, N. Chaki, and S. Sanyal, “A
survey on security issues in cloud computing, 2011”
(http://arxiv.org/abs/1109.5388).
[18] Sanchika Gupta, Padam Kumar, and Ajith
Abraham., A Profile Based Network Intrusion Detection
and Prevention System for Securing Cloud Environment,
International Journal
of Distributed Sensor Network,
Volume 2013 (2013),
[19] Shicong Meng; Iyengar, Arun K.; Rouvellou, I.M.;
Ling Liu; Kisung Lee; Palanisamy, B.; Yuzhe Tang,
"Reliable State Monitoring in Cloud Datacenters," Cloud
Computing (CLOUD), 2012 IEEE 5th International
Conference on , vol., no., pp.951,958, 24-29 June
2012doi: 10.1109/CLOUD.2012.10
[20] S. M. Specht and R. B. Lee, “Distributed Denial of
Service: Taxonomies of Attacks, Tools, and
Countermeasures,” Proceedings of the International
Workshop on Security in Parallel and Distributed
Systems, San Francisco, 15-17 September 2004, pp. 543550.
[21] Song Ning; Qiu Han, "Design and implementation
of DDOS attack and defense testbed," Wavelet Active
Media Technology and Information
Processing
(ICWAMTIP), 2012 International Conference on , vol.,
no.,
pp.220,223,
17-19
Dec.
2012
doi:
10.1109/ICWAMTIP.2012.6413478
[22] S. Subashini and V. Kavitha, “A survey on security
issues in service delivery models of cloud computing,”
Journal of Network and Computer Applications, vol. 34,
no. 1, pp. 1–11, 2011.
[23] Shweta Tripathi, , Brij Gupta, Ammar Almomani, ,
Anupama Mishra, Suresh Veluru; “Hadoop Based
Defense Solution to Handle Distributed Denial of
Service (DDOS) Attacks” Journal of Information
Security, 2013, 4, 150-164.
[24] Udhayan, J.; Anitha, R., "Demystifying and Rate
Limiting ICMP hosted DoS/DDOS Flooding Attacks
with Attack Productivity Analysis," Advance Computing
Conference, 2009. IACC 2009. IEEE International, vol.,
no., pp.558, 564,
6-7 March
2009
doi:
10.1109/IADCC.2009.4809072
[25] Vasanthi, S.; Chandrasekar, S., "A study on
network intrusion detection and prevention system
current status and challenging issues," Advances in
Recent Technologies in Communication and Computing
(ARTCom 2011), 3rd International Conference on , vol.,
no.,
pp.181,183,
14-15
Nov.
2011
doi:10.1049/ic.2011.0075
[26] Xie Chuiyi; Zhang Yizhi; Bai Yuan; Luo Shuoshan;
Xu Qin, "A Distributed Intrusion Detection System
against flooding Denial of Services attacks," Advanced
Communication Technology (ICACT), 2011. 13th
International Conference on , vol., no., pp.878,881, 1316 Feb. 2011.
[27] Xia Chun-Tao; Du Xue-Hui; Cao Li-Feng; Chen
Hua-Cheng, "An Algorithm of Detecting and Defending
CC Attack in Real Time," Industrial Control and
Electronics Engineering (ICICEE), 2012 International
Conference on , vol., no., pp.1804,1806, 23-25 Aug.
2012,doi:10.1109/ICICEE.2012.477
[28] Yuxin Ding , Dit-Yan Yeung, “User Profiling for
Intrusion Detection Using Dynamic and Static
Behavioral Models”, Springer Berlin Heidelberg, 2002
[29] Daljeet Kaur and Monika Sachdeva” DDoS Attacks
Impact Analysis on Web Service Using Emulation”,
International
Conference
on
Communication,
Computing & Systems (ICCCS–2014)
P a g e | 44

Defending Against DDOS Flooding Attacks

Transcription

Similar documents

Mark Shtern

Protecting Our Customers from Massive or Advanced DDoS Attacks

Marc Lampo - Principal Security Consultant

warrior woman flyer - Global One Defense

- Andrisoft

Towards Data-Oriented and User-Centric Network Architecture

DETECTING DDoS

Bots, DDoS and Ground Truth

Switzerland under Attack