A Model to Partly but Reliably Distinguish DDOS Flood Traffic from Aggregated One
نویسندگان
چکیده
Reliable distinguishing DDOS flood traffic from aggregated traffic is desperately desired by reliable prevention of DDOS attacks. By reliable distinguishing, we mean that flood traffic can be distinguished from aggregated one for a predetermined probability. The basis to reliably distinguish flood traffic from aggregated one is reliable detection of signs of DDOS flood attacks. As is known, reliably distinguishing DDOS flood traffic from aggregated traffic becomes a tough task mainly due to the effects of flash-crowd traffic. For this reason, this paper studies reliable detection in the underlying DiffServ network to use static-priority schedulers. In this network environment, we present a method for reliable detection of signs of DDOS flood attacks for a given class with a given priority. There are two assumptions introduced in this study. One is that flash-crowd traffic does not have all priorities but some. The other is that attack traffic has all priorities in all classes, otherwise an attacker cannot completely achieve its DDOS goal. Further, we suppose that the protected site is equipped with a sensor that has a signature library of the legitimate traffic with the priorities flash-crowd traffic does not have. Based on those, we are able to reliably distinguish attack traffic from aggregated traffic with the priorities that flash-crowd traffic does not have according to a given detection probability.
منابع مشابه
F-STONE: A Fast Real-Time DDOS Attack Detection Method Using an Improved Historical Memory Management
Distributed Denial of Service (DDoS) is a common attack in recent years that can deplete the bandwidth of victim nodes by flooding packets. Based on the type and quantity of traffic used for the attack and the exploited vulnerability of the target, DDoS attacks are grouped into three categories as Volumetric attacks, Protocol attacks and Application attacks. The volumetric attack, which the pro...
متن کاملReliably Identifying Traffic Abnormality under DDOS Flood Attacks in Differentiated Services Environment Based on Traffic Constraint
This paper presents a reliable approach to identifying signs of traffic abnormality under DDOS flood attacks in static-priority scheduling networks with differentiated services (DiffServ) at connection level. The probability formulas in terms of identification, miss, and false alarm, as well as identification threshold, are derived. A case study is demonstrated.
متن کاملDDoS: Flood vs. Shrew
Distributed Denial of Service (DDoS) attack is one of the greatest threats to connectivity, continuity, and availability of the Internet. In this paper, two typical types of DDoS attacks, high-rate (Flood) and low-rate (Shrew), are studied on their generation principles, mechanism utilizations, behaviors, signatures, and attack performances. Experiment results show that: (I) high-rate DDoS send...
متن کاملDetection of Variations of Local Irregularity of Traffic under DDOS Flood Attack
The aim of distributed denial-of-service DDOS flood attacks is to overwhelm the attacked site or to make its service performance deterioration considerably by sending flood packets to the target from the machines distributed all over the world. This is a kind of local behavior of traffic at the protected site because the attacked site can be recovered to its normal service state sooner or later...
متن کاملAn approach to reliably identifying signs of DDOS flood attacks based on LRD traffic pattern recognition
In the aspect of intrusion detection, reliable detection remains a challenge issue as stated in Kemmrer and Vigna (Suppl IEEE Comput (IEEE Secur Priv) 35(4) (2002) 28). ‘‘The challenge is to develop a system that detects close to 100% of attacks with minimal false positives. We are still far from achieving this goal.’’ Hence, reliable detection of distributed denial-of-service (DDOS) attacks is...
متن کامل