DDoS attacks are highly distributed, well coordinated, offensive assaults on services, hosts, and infrastructure of the Internet. Effective defensive countermeasures to DDoS attacks will require equally sophisticated, well coordinated, monitoring, analysis, and response. The Cossack project is developing an architecture to explore such coordination using multicast, annotated topology informatio...

A novel detection scheme against DDoS attack is proposed from a distributed perspective. The distributed end-hosts in the Internet are organized into a P2P network by Chord protocol for detection. The detection algorithm based on CUSUM and space similarity is deployed at each node in the P2P detection network. The P2P-based detection network is adopted, which makes the scheme be able to scale t...

Recently high-speed networks have been utilized by attackers as Distributed Denial of Service (DDoS) attack infrastructure. Services on high-speed networks also have been attacked by successive waves of the DDoS attacks. How to sensitively and accurately detect the attack traffic, and quickly filter out the attack packets are still the major challenges in DDoS defense. Unfortunately most curren...

With the rapid growth of networks in size and complexity, netwok administrators today are facing more and more challenges for protecting their networked computers and other devices from all kinds of attacks. Unlike the traditional methods of analyzing textual log data, a visual interactive system called DDoSViewer is proposed in this paper for detecting DDoS kind of network attacks. DDoSViewer ...

Distributed Denial of Service (DDoS) attacks represent a major threat to uninterrupted and efficient Internet service. In this paper, we empirically evaluate several major information metrics, namely, Hartley entropy, Shannon entropy, Renyi’s entropy, generalized entropy, Kullback–Leibler divergence and generalized information distance measure in their ability to detect both low-rate and high-r...

DistributedDenial-of-Service (DDoS) attacks seriously threat the servers in the Internet.Most of current research is focused on the detection and preventionmethods at the victim side or the source side. However, defense at the innocent side, whose IP is used as the spoofed IP by the attacker, is always ignored. In this paper, a novelmethod at the innocent side has been proposed. Our detection s...

Distributed Denial of Service (DDoS) attack is one of the greatest threats to connectivity, continuity, and availability of the Internet. In this paper, two typical types of DDoS attacks, high-rate (Flood) and low-rate (Shrew), are studied on their generation principles, mechanism utilizations, behaviors, signatures, and attack performances. Experiment results show that: (I) high-rate DDoS send...

This paper presents a systematic method for DDoS attack detection. DDoS attack can be considered system anomaly or misuse from which abnormal behavior is imposed on network traffic. Attack detection can be performed via abnormal behavior identification. Network traffic characterization with behavior modeling could be a good guidance of attack detection. Aggregated traffic has been found to be s...

Distributed denial of service (DDoS) attacks, which are a major threat on the Internet, have recently become more sophisticated as a result of their ability to exploit application-layer vulnerabilities. Most defense methods are designed for detecting DDoS attacks on IP and TCP layers and consequently have difficulty in detecting this new type of DDoS attack. With the profiling of web browsing b...

Title of dissertation: DETECTING DDoS ATTACKS IN STUB DOMAINS Christopher Kommareddy, Doctor of Philosophy, 2006 Dissertation directed by: Prof. Samrat Bhattacharjee Department of Computer Science Dr. Richard La Department of Electrical & Computer Engineering DoS attacks have least impact when detected and mitigated close to the attacks’ source. This is more important for Distributed DoS (DDoS)...