Survey of network-based defense mechanisms countering the DoS and DDoS problems
ACM Computing SurveysPublished 9 April 2007
Tao Peng, Christopher Leckie, Kotagiri Ramamohanarao
Citations759
SJR quartileQ1
SJR score5.80
SNIP11.03
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This survey analyzes the design decisions in the Internet that have created the potential for denial of service attacks and the methods that have been proposed for defense against these attacks, and discusses potential countermeasures against each defense mechanism.
Abstract
This article presents a survey of denial of service attacks and the methods that have been proposed for defense against these attacks. In this survey, we analyze the design decisions in the Internet that have created the potential for denial of service attacks. We review the state-of-art mechanisms for defending against denial of service attacks, compare the strengths and weaknesses of each proposal, and discuss potential countermeasures against each defense mechanism. We conclude by highlighting opportunities for an integrated solution to solve the problem of distributed denial of service attacks.
Keywords
Computer Science
Communications of the ACMSpace/time trade-offs in hash coding with allowable errors
7,507 Citations1970Burton H. Bloom
Analysis of the paradigm problem demonstrates that allowing a small number of test messages to be falsely identified as members of the given set will permit a much smaller hash area to be used without increasing reject time.
Journal of Natural Resources Policy ResearchThe Tragedy of the Commons*
6,408 Citations2009Garrett Hardin
IEEE/ACM Transactions on NetworkingRandom early detection gateways for congestion avoidance
6,255 Citations1993Sally Floyd, Van Jacobson
Red gateways are designed to accompany a transport-layer congestion control protocol such as TCP and have no bias against bursty traffic and avoids the global synchronization of many connections decreasing their window at the same time.
IEEE Transactions on Software EngineeringAn Intrusion-Detection Model
3,358 Citations1987Dorothy E. Denning
Border Gateway Protocol 3 (BGP-3)
1,990 Citations1991K. Lougheed, Y. Rekhter
This memo, together with its companion document, "Application of the Border Gateway Protocol in the Internet", define an inter-autonomous system routing protocol for the Internet.
ACM SIGCOMM Computer Communication ReviewA taxonomy of DDoS attack and DDoS defense mechanisms
1,986 Citations2004Jelena Mirković, Peter Reiher
This paper presents two taxonomies for classifying attacks and defenses in distributed denial-of-service (DDoS) and provides researchers with a better understanding of the problem and the current solution space.
Internet Protocol, Version 6 (IPv6) Specification
1,475 Citations2017S. Deering, R. Hinden
This document specifies version 6 of the Internet Protocol (IPv6), also sometimes referred to as IP Next Generation or IPng.
Domain names - concepts and facilities
1,446 Citations1983Paul V. Mockapetris
Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
1,317 Citations2000Patricia Ferguson, D. Senie
ACM SIGCOMM Computer Communication ReviewPractical network support for IP traceback
1,133 Citations2000Stefan Savage, David Wetherall +2 more
IEEE/ACM Transactions on NetworkingLink-sharing and resource management models for packet networks
978 Citations1995Sally Floyd, Van Jacobson
It is argued that controlled link-sharing is an essential component that can provide gateways with the flexibility to accommodate emerging applications and network protocols.
Evolutionary ComputationArchitecture for an Artificial Immune System
867 Citations2000Steven Hofmeyr, Stephanie Forrest
In this paper, ARTIS is applied to computer security in the form of a network intrusion detection system called LISYS, which is shown to be effective at detecting intrusions, while maintaining low false positive rates.
Advanced and authenticated marking schemes for IP traceback
755 Citations2002Dawn Song, Adrian Perrig
Two new schemes are presented, the advanced marking scheme and the authenticated marking scheme, which allow the victim to trace-back the approximate origin of spoofed IP packets and provide efficient authentication of routers' markings such that even a compromised router cannot forge or tamper markings from other uncompromised routers.
ACM SIGCOMM Computer Communication ReviewControlling high bandwidth aggregates in the network
747 Citations2002Ratul Mahajan, Steven M. Bellovin +4 more
The design involves both a local mechanism for detecting and controlling an aggregate at a single router, and a cooperative pushback mechanism in which a router can ask upstream routers to control an aggregate.
Hash-based IP traceback
735 Citations2001Alex C. Snoeren, Craig Partridge +5 more
This work presents a hash-based technique for IP traceback that generates audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past and is implementable in current or next-generation routing hardware.
ACM SIGCOMM Computer Communication ReviewA survey of web caching schemes for the Internet
683 Citations1999Jia Wang
This paper first describes the elements of a Web caching system and its desirable properties, then the state-of-art techniques which have been used in Web caching systems are surveyed, and the research frontier in Web cache is discussed.
The design philosophy of the DARPA internet protocols
644 Citations1988David D. Clark
This paper attempts to capture some of the early reasoning which shaped the Internet protocols.
Nonparametric Methods in Change-Point Problems
617 Citations1993Boris Brodsky, B. S. Darkhovsky
This work presents a state-of-the-art review of nonparametric change point detection methods used in the detection of disorder detection of random fields and some applications of these methods.
On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets
579 Citations2001Ki‐Hong Park, Heejo Lee
This paper describes and evaluates route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention, and shows that DPF achieves proactiveness and scalability, and there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.
Detecting SYN flooding attacks
571 Citations2003Haining Wang, Danlu Zhang +1 more
A simple and robust mechanism that not only sets alarms upon detection of ongoing SYN flooding attacks, but also reveals the location of the flooding sources without resorting to expensive IP traceback.
Columbia Academic Commons (Columbia University)ICMP Traceback Messages
564 Citations2003Tom Taylor, M. Leech +1 more
Distributed denial of service attacks
560 Citations2002Felix Lau, Stuart H. Rubin +2 more
A framework for classifying denial of service attacks
488 Citations2003Alefiya Hussain, John Heidemann +1 more
A framework for classifying DoS attacks based on header content, and novel techniques such as transient ramp-up behavior and spectral analysis are introduced, showing that characteristics of attack ramps-up and attack spectrum are more difficult to spoof.
IEEE Communications MagazineDefending against flooding-based distributed denial-of-service attacks: a tutorial
486 Citations2002Rocky K. C. Chang
Various DDoS attack methods are described, and a longer-term solution that attempts to intercept attack packets in the Internet core, well before reaching the victim is discussed, dubbed the Internet-firewall approach.
Analysis of a denial of service attack on TCP
485 Citations1997Christoph Schuba, Ivan Krsul +4 more
A new solution approach is introduced that offers protection against SYN flooding for all hosts connected to the same local area network, independent of their operating system or networking stack implementation, and requires neither special hardware, nor modifications in routers or protected end systems.
USENIX Large Installation Systems Administration ConferenceTracing Anonymous Packets to Their Approximate Source
482 Citations2000Hal Burch
This work outlines a technique for tracing spoofed packets back to their actual source host without relying on the cooperation of intervening ISPs, and assumes that routes are largely symmetric, can be discovered, are fairly consistent, and the attacking packet stream arrives from a single source network.
IEEE SoftwareImproving security using extensible lightweight static analysis
470 Citations2002David Evans, David Larochelle
This article describes an extensible tool that uses lightweight static analysis to detect common security vulnerabilities (including buffer overflows and format string vulnerabilities).
Requirements for IP Version 4 Routers
456 Citations1995
This memo defines and discusses requirements for devices that perform the network layer forwarding function of the Internet protocol suite.
Attacking DDoS at the source
434 Citations2003Jelena Mirković, G. Prier +1 more
D-WARD is proposed, a DDoS defense system deployed at source-end networks that autonomously detects and stops attacks originating from these networks that offers good service to legitimate traffic even during an attack, while effectively reducing DDoS traffic to a negligible level.
Centertrack: an IP overlay network for tracking DoS floods
421 Citations2000Robert W. Stone
This system simplifies the work required to determine the ingress adjacency of a flood attack while bypassing any equipment which may be incapable of performing the necessary diagnostic functions.
ACM SIGCOMM Computer Communication ReviewAn analysis of using reflectors for distributed denial-of-service attacks
398 Citations2001Vern Paxson
This paper argues in conclusion in support of "reverse ITRACE" [Ba00] and for the utility of packet traceback techniques that work even for low volume flows, such as SPIE.
Practical network support for IP traceback
382 Citations2000Stefan Savage, David Wetherall +2 more
A general purpose traceback mechanism based on probabilistic packet marking in the network that allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs).
On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack
372 Citations2002Ki‐Hong Park, Heejo Lee
It is shown that probabilistic packet marking-of interest due to its efficiency and implementability vis-a-vis deterministic packet marking and logging or messaging based schemes-suffers under spoofing of the marking field in the IP header by the attacker which can impede traceback by the victim.
MULTOPS: A Data-Structure for Bandwidth Attack Detection
367 Citations2001Thomer M. Gil, Massimiliano Poletto
This work proposes a heuristic and a data-structure that network devices (such as routers) can use to detect (and eliminate) denial-of-service bandwidth attacks.
TCP/IP Illustrated, Volume 2: The Implementation
353 Citations1995W. Richard Stevens, Gary R. Wright
Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds
328 Citations2004Srikanth Kandula, Dina Katabi +2 more
SAVE: source address validity enforcement protocol
259 Citations2003Jun Li, Jelena Mirković +3 more
A new protocol is described, named SAVE, that can provide routers with the information needed for source address validation, and its correctness and performance are evaluated by simulation experiments.
IEEE Communications MagazineNetwork intrusion and fault detection: a statistical anomaly approach
255 Citations2002C.N. Manikopoulos, Symeon Papavassiliou
The proposed methodology can reliably detect attacks with traffic anomaly intensity as low as 3-5 percent of the typical background traffic intensity, thus promising to generate an effective early warning.
Protection from distributed denial of service attacks using history-based IP filtering
237 Citations2004Tao Peng, Christopher Leckie +1 more
This paper introduces a practical scheme to defend against distributed denial of service (DDoS) attacks based on IP source address filtering, and presents several heuristic methods to make the IP address database accurate and robust.
CERN Document Server (European Organization for Nuclear Research)Internet denial of service : attack and defense mechanisms
215 Citations2005Jelena Mirković
Use of spectral analysis in defense against DoS attacks
204 Citations2003Chen-Mou Cheng, H. T. Kung +1 more
Using spectral analysis to identify normal TCP traffic so that it will not be dropped or rate-limited in defense against denial of service (DoS) attacks can reduce false positives of attacker identification schemes and thus decrease the associated unnecessary slowdown or stoppage of legitimate traffic.
Proactive detection of distributed denial of service attacks using MIB traffic variables-a feasibility study
174 Citations2002J.B.D. Cabrera, L. Lewis +5 more
It is shown that statistical tests applied in the time series of MIB traffic at the target and the attacker are effective in extracting the correct variables for monitoring in the attacker machine and suggest the possibility of an entirely automated procedure centered on network management systems for detecting precursors of distributed denial of service attacks, and responding to them.
Security considerations for Voice Over IP Systems
173 Citations2005D. Richard Kuhn, Thomas J. Walsh +1 more
Syntax notation one (ASN.1) is a standard, flexible method that describes data structures for representing, encoding, transmitting, and decoding data and is a precise, formal notation that removes ambiguities.
Extension Mechanisms for DNS (EDNS0)
162 Citations1999Paul Vixie
This document describes backward compatible mechanisms for allowing the Domain Name System's wire protocol to grow.
Lecture notes in computer scienceProactively Detecting Distributed Denial of Service Attacks Using Source IP Address Monitoring
161 Citations2004Tao Peng, Christopher Leckie +1 more
This paper proposes a simple but robust scheme to detect denial of service attacks by monitoring the increase of new IP addresses and demonstrates that with the combination of monitoring per flow speed, this scheme can detect all types of DDoS attacks.
COSSACK: Coordinated Suppression of Simultaneous Attacks
160 Citations2004Christos Papadopoulos, Robert Lindell +3 more
The Cossack project is developing technology to thwart distributed denial of service (DDoS) attacks by deploying a set of watchdogs at edge networks, which employ distributed coordination to rapidly detect, and neutralize attacks.
Using graphic turing tests to counter automated DDoS attacks against web servers
156 Citations2003William G. Morein, Angelos Stavrou +4 more
This work presents WebSOS, a novel overlay-based architecture that provides guaranteed access to a web server that is targeted by a denial of service (DoS) attack, and determines the end-to-end latency using both a Chord-based approach and a shortcut extension.
Communications of the ACMDenial of service
155 Citations1994Roger M. Needham
The &jectiw of the pre sent article is to consider a particular instance of a denial of service problem and to look at engineering considerations relevant to an appropriate defensr.
Protecting web servers from distributed denial of service attacks
152 Citations2001Frank Kargl, Joern Maier +1 more
A solution based on Class Based Routing mechanisms in the Linux kernel that will prevent the most severe impacts of DDoS on clusters of web servers with a prepended load balancing server is presented.
Operating Systems Design and ImplementationDefending against denial of service attacks in Scout
139 Citations1999Oliver Spatscheck, Larry Peterson
The paper describes the Escort architecture and its implementation in Scout, and reports a collection of experiments that measure the costs and benefits of using Escort to protect a web server from denial of service attacks.
Prentice Hall PTR eBooksInternet Denial of Service: Attack and Defense Mechanisms (Radia Perlman Computer Networking and Security)
132 Citations2004Jelena Mirković, Sven Dietrich +2 more
IEEE Transactions on Software EngineeringA Note on Denial-of-Service in Operating Systems
129 Citations1984Virgil D. Gligor
A simple and general definition of denial-of-service in operating systems is presented and the notion of interuser dependency is introduced and identified as the common cause for all problem instances.
OPAL (Open@LaTrobe) (La Trobe University)Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues
124 Citations2002Howard F. Lipson
A closer look at technical and policy considerations for next-generation Internet protocols to enhance track and trace capabilities is taken.
Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles
110 Citations2003David K. Y. Yau, John C. S. Lui +1 more
Th throttling can regulate the experienced server load to below its design limit - in the presence of user dynamics - so that the server can remain operational during a DDoS attack, and gives better good-user protection than recursive pushback of max-min fair rate limits proposed in the literature.
IT ProfessionalDefeating distributed denial of service attacks
109 Citations2000Xianjun Geng, Andrew B. Whinston
A brief introduction to network weaknesses that DDoS attacks exploit; the technological futility of addressing the problem solely at the local level; potential global solutions; and why global solutions require an economic incentive framework are given.
Analyzing Distributed Denial of Service Tools: The Shaft Case
107 Citations2000Sven Dietrich, Neil Long +1 more
A comparative analysis of several distributed denial of service tools, including Trinoo, TFN, Stacheldraht, and Mstream, look at emerging countermeasures against some of these tools and talk about future trends of these distributed tools.
Journal of Network and Systems ManagementDetecting Distributed Denial-of-Service Attacks Using Kolmogorov Complexity Metrics
107 Citations2006Amit Kulkarni, Stephen F. Bush
A distributed active network-based algorithm that exploits this property to correlate arbitrary traffic flows in the network to detect possible denial-of-service attacks and shows that DDoS attacks can be detected in a manner that is not sensitive to legitimate background traffic.
On scalable attack detection in the network
92 Citations2004Ramana Rao Kompella, Sumeet Singh +1 more
This paper examines a wide variety of DoS and scanning attacks and shows that several categories (bandwidth based, claim-and-hold, port-scanning) can be scalably detected and proposes a novel data structure called partial completion filters (PCFs) that can detect claim- and-hold attacks scalably in the network.
Detecting DoS attacks on SIP systems
90 Citations2006E.Y. Chen
A method to detect DoS attacks that involve flooding SIP entities with illegitimate SIP messages by modifying the original finite-state machines for SIP transactions in such a way that transaction anomalies can be detected in a stateful manner.
Lecture notes in computer scienceAdjusted Probabilistic Packet Marking for IP Traceback
86 Citations2002Tao Peng, Christopher Leckie +1 more
This paper presents a packet marking algorithm which allows the victim to traceback the approximate origin of spoofed IP packets, and develops three techniques to adjust the packet marking probability, which significantly reduces the number of packets needed by the Victim to reconstruct the attack path.
IEEE/ACM Transactions on NetworkingOn Scalable Attack Detection in the Network
82 Citations2007Ramana Rao Kompella, Sumeet Singh +1 more
This paper examines a wide variety of DoS and scanning attacks and shows that several categories (bandwidth based, claim-and-hold, port-scanning) can be scalably detected and proposes a novel data structure called partial completion filters (PCFs) that can detect claim- and-hold attacks scalably in the network.
Alliance formation for DDoS defense
81 Citations2003Jelena Mirković, Max Robinson +1 more
This paper shows how the paradigm shift can be accomplished quickly and painlessly through the design of DefCOM, a distributed framework that enables the exchange of information and services between existing defense nodes.
Communications of the ACMWith microscope and tweezers: the worm from MIT's perspective
79 Citations1989Jon A. Rochlis, Mark W. Eichin
The actions taken by a group of computer scientists at MIT during the worm invasion represents a study of human response to a crisis.
A resource allocation model for denial of service
77 Citations2003Jonathan K. Millen
A denial-of-service protection base (DPB) is characterized as a resource monitor closely related to a TCB, supporting a waiting-time policy for benign processes.
Lecture notes in computer scienceCDIS: Towards a Computer Immune System for Detecting Network Intrusions
77 Citations2001Paul Williams, Kevin P. Anchor +3 more
This research investigates the feasibility of using evolutionary search techniques, in the context of a computer immune system, to detect computer network intrusions, with particular emphasis on developing techniques for catching new attacks.
Cossack: coordinated suppression of simultaneous attacks
73 Citations2004Christos Papadopoulos, Robert Lindell +3 more
The Cossack project is developing an architecture to explore coordination using multicast, annotated topology information, and novel blind detection techniques to explore defensive countermeasures to DDoS attacks.
An efficient filter for denial-of-service bandwidth attacks
65 Citations2004S. Abdelsayed, D. Glimsholt +3 more
It is demonstrated that TOPS (tabulated online packet statistics) can detect bandwidth attacks in a standard benchmark dataset with a high accuracy and a low false alarm rate.
A practical method to counteract denial of service attacks
56 Citations2003Udaya Tupakula, Vijay Varadharajan
A Controller-Agent model that would greatly minimize DDoS attacks on Internet with a new packet marking technique and agent design and is able to identify the approximate source of attack (nearest router) with a single packet even in case of attack with spoofed source addresses.
GOSSIB vs. IP traceback rumors
45 Citations2003Marcel Waldvogel
This work analyzes the effects of an attacker using GOSSIB against CEFS and shows that the attacker can seed misinformation much more efficiently than the network is able to contribute real traceback information, rendering PPM effectively useless.
IEEE Security & PrivacyDenial of service against the Domain Name System
11 Citations2006Steven W. Cheung
This article analyzes denial-of-service attacks against the Domain Name System and reviews existing and proposed countermeasures for addressing them.
…