Reliable DDoS Detection using Multiphase Approach in Distributed Sensor Network

다국어 초록 (Multilingual Abstract)

Recently, the trend in network security is the growing number of malicious attacks which resulted in abnormal network data traffic as well as direct damaging of the system. Specifically, Distributed denial of service (DDoS) attacks use bandwidth flooding of intended victims where the bandwidth consumption of these attacks influences the entire network performance. These attacks aggregate at a target's access router which implies that attacks are most readily detectable at access routers. The accuracy of detection dictates data traffic monitoring but performing such monitoring for the numerous devices in a distributed sensor network presents serious scalability issues. This paper describes the design space for distributed sensor network DDoS detection and propose a multiphase distributed approach that detect DDoS attacks to provide reliability and scalability.

참고문헌 (Reference)

1 H. Burch., "Tracing Anonymous Packets to Their Approximate Source" 319-328, 2000

2 E. Cooke., "The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets" 6-6, 2005

3 A. D. Keromytis., "SOS: Secure Overlay Services" 32 (32): 61-72, 2002

4 R. Vasudevan., "Reval: A Tool for Real-time Evaluation of DDoS Mitigation Strategies" 15-15, 2006

5 K. Xu., "Profiling Internet Backbone Traffic: Behavior Models and Applications" 35 (35): 169-180, 2005

6 R. Kompella., "On Scalable Attack Detection in the Network" 15 (15): 14-25, 2004

7 T. Gil., "MULTOPS: A Data-structure for Bandwidth Attack Detection" 10 : 3-3, 2001

8 "KDD Cup Data"

9 D. Moore., "Inferring Internet Denial-of-Service activity" 24 (24): 115-139, 2006

10 A. C. Snoeren., "Hash-Based IP Traceback" 31 (31): 3-14, 2001

11 M. Roughan., "Experience in Measuring Internet Backbone Traffic Variability: Models, Metrics, Measurements and Meaning" 91-92, 2003

12 A. Lakhina., "Diagnosing Network-wide Traffic Anomalies" 34 (34): 219-230, 2004

13 J. N. Tsitsiklis, "Decentralized Detection" JAI Press 297-344, 1993

14 R. Mahajan., "Controlling High Bandwidth Aggregates in the Network" 32 (32): 62-73, 2002

15 B. Claise, "Cisco Systems NetFlow Services Export Version 9" 3954 : 2004

16 "Captus Networks"

17 "Arbor’s Network"

18 V. H. Poor, "An Introduction to Signal Detection and Estimation" Springer Texts in Electrical Engineering 1994

19 J. Mirkovic., "A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms" 34 (34): 39-53, 2004

20 J. Case., "A Simple Network Management Protocol (SNMP)" 1067 : 1988