Protection from distributed denial of service attacks using history-based IP filtering
Published 1 March 2004
Tao Peng, Christopher Leckie, Kotagiri Ramamohanarao
Citations237
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This paper introduces a practical scheme to defend against distributed denial of service (DDoS) attacks based on IP source address filtering, and presents several heuristic methods to make the IP address database accurate and robust.
Abstract
In this paper, we introduce a practical scheme to defend against distributed denial of service (DDoS) attacks based on IP source address filtering. The edge router keeps a history of all the legitimate IP addresses which have previously appeared in the network. When the edge router is overloaded, this history is used to decide whether to admit an incoming Ip packet. Unlike other proposals to defend against DDoS attacks, our scheme works well during highly-distributed DDoS attacks, i.e., from a large number of sources. We present several heuristic methods to make the IP address database accurate and robust, and we present experimental results that demonstrate the effectiveness of our scheme in defending against highly-distributed DDoS attacks.
Keywords
Computer Science
Communications of the ACMSpace/time trade-offs in hash coding with allowable errors
7,507 Citations1970Burton H. Bloom
Analysis of the paradigm problem demonstrates that allowing a small number of test messages to be falsely identified as members of the given set will permit a much smaller hash area to be used without increasing reject time.
Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
1,317 Citations2000Patricia Ferguson, D. Senie
ACM SIGCOMM Computer Communication ReviewPractical network support for IP traceback
1,133 Citations2000Stefan Savage, David Wetherall +2 more
Advanced and authenticated marking schemes for IP traceback
755 Citations2002Dawn Song, Adrian Perrig
Two new schemes are presented, the advanced marking scheme and the authenticated marking scheme, which allow the victim to trace-back the approximate origin of spoofed IP packets and provide efficient authentication of routers' markings such that even a compromised router cannot forge or tamper markings from other uncompromised routers.
ACM SIGCOMM Computer Communication ReviewControlling high bandwidth aggregates in the network
747 Citations2002Ratul Mahajan, Steven M. Bellovin +4 more
The design involves both a local mechanism for detecting and controlling an aggregate at a single router, and a cooperative pushback mechanism in which a router can ask upstream routers to control an aggregate.
Hash-based IP traceback
735 Citations2001Alex C. Snoeren, Craig Partridge +5 more
This work presents a hash-based technique for IP traceback that generates audit trails for traffic within the network, and can trace the origin of a single IP packet delivered by the network in the recent past and is implementable in current or next-generation routing hardware.
Flash crowds and denial of service attacks
636 Citations2002Jaeyeon Jung, Balachander Krishnamurthy +1 more
An enhancement to CDNs is proposed that offers better protection to Web sites against flash events and trace-driven simulations are used to study the effect of the enhancement on CDNs and Web sites.
On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets
579 Citations2001Ki‐Hong Park, Heejo Lee
This paper describes and evaluates route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention, and shows that DPF achieves proactiveness and scalability, and there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.
ACM SIGCOMM Computer Communication ReviewAn analysis of using reflectors for distributed denial-of-service attacks
398 Citations2001Vern Paxson
This paper argues in conclusion in support of "reverse ITRACE" [Ba00] and for the utility of packet traceback techniques that work even for low volume flows, such as SPIE.
Practical network support for IP traceback
382 Citations2000Stefan Savage, David Wetherall +2 more
A general purpose traceback mechanism based on probabilistic packet marking in the network that allows a victim to identify the network path(s) traversed by attack traffic without requiring interactive operational support from Internet Service Providers (ISPs).
MULTOPS: A Data-Structure for Bandwidth Attack Detection
367 Citations2001Thomer M. Gil, Massimiliano Poletto
This work proposes a heuristic and a data-structure that network devices (such as routers) can use to detect (and eliminate) denial-of-service bandwidth attacks.
Flash crowds and denial of service attacks
230 Citations2002Jaeyeon Jung, Balachander Krishnamurthy +1 more
Analyzing Distributed Denial of Service Tools: The Shaft Case
107 Citations2000Sven Dietrich, Neil Long +1 more
A comparative analysis of several distributed denial of service tools, including Trinoo, TFN, Stacheldraht, and Mstream, look at emerging countermeasures against some of these tools and talk about future trends of these distributed tools.
ACM Transactions on Information and System SecurityAn algebraic approach to IP traceback
96 Citations2002Drew Dean, Matthew Franklin +1 more
The traceback problem is reframed as a polynomial reconstruction problem and algebraic techniques from coding theory and learning theory are used to provide robust methods of transmission and reconstruction.
A probabilistic approach to detecting network scans
89 Citations2003Christopher Leckie, R Kotagiri
This paper presents a probabilistic approach for detecting network scans in real-time that takes into consideration both the number of destinations or ports accessed by a source, as well as how unusual these accesses are.
Lecture notes in computer scienceAdjusted Probabilistic Packet Marking for IP Traceback
86 Citations2002Tao Peng, Christopher Leckie +1 more
This paper presents a packet marking algorithm which allows the victim to traceback the approximate origin of spoofed IP packets, and develops three techniques to adjust the packet marking probability, which significantly reduces the number of packets needed by the Victim to reconstruct the attack path.