Distributed Denial of Service (DDoS) attacks pose one of the most serious security threats to the Internet. We examine the drawbacks of existing defense schemes. To combat these deficiencies, we propose a credit-based defense system: TrustGuard. Essentially, flows accumulate credit based on the diversity of their packet-size distribution. The more diverse the flow, the more credit it has. Since DDoS attacks demonstrate low diversity they accumulate less credit and are likely to be dropped by the system. Naturally, the performance of TrustGuard greatly depends on the choice of credit accumulation and flow selection methods. We derive our solution by identifying the essential characteristics of DDoS attacks. Our analysis accounts for both micro and macro behaviors of DDoS attacks. The primary goal of this work is to not only detect the occurrence of a DDoS attack, but to also identify the attackers and victims involved. Experimental results demonstrate that TrustGuard performs admirably in both cases.

Network simulation and emulation environments play a crucial role in evaluating proposed protocols, applications, and networked systems. In such settings, the ability to scalably and efficiently generate traffic that has characteristics similar to those measured in the live Internet is of great importance. A key aspect of generating realistic traffic is to assign source and destination IP addresses to traffic flows such that the statistical structure of the addresses is similar to what would be seen in a live Internet setting. In this paper, we propose and evaluate an algorithm and data structure for efficient and realistic generation of IP addresses. We describe our new method and compare it with existing and prior work, while also showing that our technique is far more efficient-both in terms of memory consumed and computation time required. We also show that the statistical structure of the generated addresses is similar to what would be measured in the live Internet. Our results show that it is possible to efficiently generate addresses over the entire IPv4 address space, and that it is feasible to generate addresses from a /64 IPv6 subnet.

No abstract

Many network security applications in today's networks are based on deep packet inspection, checking not only the header portion but also the payload portion of a packet. For example, traffic monitoring, layer-7 filtering, and network intrusion detection all require an accurate analysis of packet content in search for predefined patterns to identify specific classes of applications, viruses, attack signatures, etc. Regular expressions are often used to represent such patterns. They are implemented using finite automata, which take the payload of a packet as an input string. However, existing approaches, both non-deterministic finite automata (NFA) and deterministic finite automata (DFA), have limitations; NFAs have excessive time complexity while DFAs have excessive space complexity. In this paper, we propose an efficient algorithm for regular expression matching to implement deep packet inspection on multi-core architecture. A regular expression is split into NFAfriendly components and DFA-friendly components, which are then assigned to different cores. This hybrid method combines the merits of NFA and DFA implementations, and efficiently takes advantage of multi-core architecture. We evaluate our algorithm using rule sets provided by Snort, a popular opensource intrusion detection system. The simulation results show that our approach outperforms existing NFA/DFA and hybrid approaches. Furthermore, our algorithm performs well on the important issues on multi-core architecture design, such as load balancing, data locality and communication between cores.

No abstract