An efficient filter for denial-of-service bandwidth attacks
Published 13 August 2004
S. Abdelsayed, D. Glimsholt, Christopher Leckie, Stewart D. Ryan, Abdallah Shami
Citations65
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
It is demonstrated that TOPS (tabulated online packet statistics) can detect bandwidth attacks in a standard benchmark dataset with a high accuracy and a low false alarm rate.
Abstract
In this paper, we present an efficient method for detecting and filtering denial-of-service bandwidth attacks. Our system called TOPS (tabulated online packet statistics) can monitor a large number of network addresses in a compact, fixed-size structure using several effective heuristics. We demonstrate that TOPS can detect bandwidth attacks in a standard benchmark dataset with a high accuracy and a low false alarm rate. A key benefit of TOPS is that it uses few computational resources and does not slow down during an attack.
Keywords
Computer Science
Communications of the ACMSpace/time trade-offs in hash coding with allowable errors
7,507 Citations1970Burton H. Bloom
Analysis of the paradigm problem demonstrates that allowing a small number of test messages to be falsely identified as members of the given set will permit a much smaller hash area to be used without increasing reject time.
Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
1,317 Citations2000Patricia Ferguson, D. Senie
Advanced and authenticated marking schemes for IP traceback
755 Citations2002Dawn Song, Adrian Perrig
Two new schemes are presented, the advanced marking scheme and the authenticated marking scheme, which allow the victim to trace-back the approximate origin of spoofed IP packets and provide efficient authentication of routers' markings such that even a compromised router cannot forge or tamper markings from other uncompromised routers.
IEEE/ACM Transactions on NetworkingNetwork support for IP traceback
679 Citations2001Stefan Savage, David Wetherall +2 more
A general purpose traceback mechanism based on probabilistic packet marking in the network that allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs).
Columbia Academic Commons (Columbia University)Implementing Pushback: Router-Based Defense Against DDoS Attacks
550 Citations2002John P. A. Ioannidis, Steven M. Bellovin
This paper presents an architecture for Pushback, its implementation under FreeBSD, and suggestions for how such a system can be implemented in core routers.
IEEE Communications MagazineDefending against flooding-based distributed denial-of-service attacks: a tutorial
486 Citations2002Rocky K. C. Chang
Various DDoS attack methods are described, and a longer-term solution that attempts to intercept attack packets in the Internet core, well before reaching the victim is discussed, dubbed the Internet-firewall approach.
A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems
380 Citations1999K. R. Kendall
The focus of this thesis is the attacks that were developed for use in the 1998 DARPA intrusion detection evaluation and included older, well-known attacks, newer attacks that have recently been released to publicly available forums, and some novel attacks developed specifically for this evaluation.
On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack
372 Citations2002Ki‐Hong Park, Heejo Lee
It is shown that probabilistic packet marking-of interest due to its efficiency and implementability vis-a-vis deterministic packet marking and logging or messaging based schemes-suffers under spoofing of the marking field in the IP header by the attacker which can impede traceback by the victim.
MULTOPS: A Data-Structure for Bandwidth Attack Detection
367 Citations2001Thomer M. Gil, Massimiliano Poletto
This work proposes a heuristic and a data-structure that network devices (such as routers) can use to detect (and eliminate) denial-of-service bandwidth attacks.
Protection from distributed denial of service attacks using history-based IP filtering
237 Citations2004Tao Peng, Christopher Leckie +1 more
This paper introduces a practical scheme to defend against distributed denial of service (DDoS) attacks based on IP source address filtering, and presents several heuristic methods to make the IP address database accurate and robust.
Lecture notes in computer scienceAnalysis and Results of the 1999 DARPA Off-Line Intrusion Detection Evaluation
230 Citations2000Richard P. Lippmann, Joshua Haines +3 more
Eight sites participated in the second DARPA off-line intrusion detection evaluation in 1999 and best detection was provided by network-based systems for old probe and old denial-of-service (DoS) attacks and by host- based systems for Solaris user-to-root (U2R) attacks.
Lecture notes in computer scienceAdjusted Probabilistic Packet Marking for IP Traceback
86 Citations2002Tao Peng, Christopher Leckie +1 more
This paper presents a packet marking algorithm which allows the victim to traceback the approximate origin of spoofed IP packets, and develops three techniques to adjust the packet marking probability, which significantly reduces the number of packets needed by the Victim to reconstruct the attack path.