Stateful DDoS attacks and targeted filtering

Stateful DDoS attacks and targeted filtering

The goal of a distributed denial of service (DDoS) attack is to completely tie up certain resources so that legitimate users are not able to access a service. It has long been an open security problem of the Internet. In this paper, we identify a class of stateful DDoS attacks that defeat the existing cookie-based solutions. To counter these attacks, we propose a new defense mechanism, called t...

Optimal Filtering for DDoS Attacks

Distributed Denial-of-Service (DDoS) attacks are a major problem in the Internet today. In one form of a DDoS attack, a large number of compromised hosts send unwanted traffic to the victim, thus exhausting the victim’s resources and preventing it from serving its legitimate clients. One of the main mechanisms that have been proposed to deal with DDoS is filtering, which allows routers to selec...

Mitigating DDoS attacks with cluster-based filtering

Differential Packet Filtering Against DDoS Flood Attacks

We present a new packet filtering scheme, which is traffic-smart to defend against network worms and flood attacks. The scheme prevents malicious hackers from orchestrating DDoS flooding attacks on any IP-based public network. All packets from each IP source are counted and timed during their life cycles. Special IP counters and timers are used to support the filtering process. This new approac...

Source-Based Filtering Scheme against DDOS Attacks

IP address spoofing is employed by a lot of DDoS attack tools. Most of the current research on DDoS attack packet filtering depends on cooperation among routers, which is hard to achieve in real campaigns. Therefore, in the paper, we propose a novel filtering scheme based on source information in this paper to defend against various source IP address spoofing. The proposed method works independ...