Bayes Optimal DDoS Mitigation by Adaptive History-Based IP Filtering

Goldstein, Markus; Lampert, Christoph H.; Reif, Matthias; Stahl, Armin; Breuel, Thomas M.

doi:10.1109/icn.2008.64

Cited by 18 publications

(15 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There have been several attempts to improve on the history‐based method using clustering techniques . One of the most important aspects of a clustering process is to select a distance measurement between objects.…”

Section: Resultsmentioning

confidence: 99%

“…According to a recent report, DDoS mitigation approaches are divided into three main categories: packet marking where routers along the path add their identity to the packet; hop counting filtering: IP addresses along with hop count are stored. Deviation from expected hop counts serves to detect spoofed IP addresses; history‐based approaches which include our work and works by for example …”

Section: Related Workmentioning

confidence: 98%

“…For a recent survey on the usage of of Bloom Filter for DDoS mitigation we refer the reader to Reference . To put it in a nutshell, although there is a stream of history‐based approaches in the literature such as References , , and , those approaches rely merely on distance between IP addresses ignoring actual geographical proximity. In our work, we account for the fact that two IP addresses that are far apart in the address space, using for example Xor, Xor+, or hamming distance, might be close to each other in terms of geographical distance .…”

Section: Related Workmentioning

confidence: 99%

“…Peng et al proposed a mechanism termed history‐based IP filtering (HIF) for the edge router to admit the incoming packets according to a prebuilt IP address database. This was the first approach in this direction and since then there have been several attempts to improve on this method …”

Section: Introductionmentioning

confidence: 99%

“…The most used distance measurement in this context is the Euclidean distance which in our case simply reduces to the distance between two IP addresses, that is, the absolute value of the arithmetic difference of the two numbers. Given two 32‐bit IP addresses IP i and IP j , the Euclidean distance between them is formally defined as:

△ eucl ({IP}_{i}, {IP}_{j}) = | {IP}_{i} - {IP}_{j} | .

A different measurement used by Goldstein et al is to employ a matching prefix between addresses, specifically 24 bit‐prefixes. According to this measure, the distance between two IP addresses IP i and IP j given a prefix p is defined as 1 if the IP addresses share the same prefix and infinite otherwise.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Mitigating DDoS using weight‐based geographical clustering

Kongshavn¹,

Haugerud

Yazidi

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks have for the last two decades been among the greatest threats facing the internet infrastructure. Mitigating DDoS attacks is a particularly challenging task as an attacker tries to conceal a huge amount of traffic inside a legitimate traffic flow. This article proposes to use data mining approaches to find unique hidden data structures which are able to characterize the normal traffic flow. This will serve as a mean for filtering illegitimate traffic under DDoS attacks. In this endeavor, we devise three algorithms built on previously uncharted areas within mitigation techniques where clustering techniques are used to create geographical clusters in regions which are likely to contain legitimate traffic. We argue through extensive experimental results that establishing clusters around this narrative is a superior solution to clustering algorithms which rely on bitwise distances between IP addresses. In addition, the DDoS filtering algorithm is deployed in a virtual Linux environment using Nfqueue and tested in a simulated real-life DDoS attack.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 98%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

△ eucl ({IP}_{i}, {IP}_{j}) = | {IP}_{i} - {IP}_{j} | .

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Mitigating DDoS using weight‐based geographical clustering

Kongshavn¹,

Haugerud

Yazidi

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

A Novel Big Data Analytics Approach for Supporting Cyber Attack Detection via Non-linear Analytic Prediction of IP Addresses

Cuzzocrea

Mumolo

Fadda

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Computer network systems are often subject to several types of attacks. For example the distributed Denial of Service (DDoS) attack introduces an excessive traffic load to a web server to make it unusable. A popular method for detecting attacks is to use the sequence of source IP addresses to detect possible anomalies. With the aim of predicting the next IP address, the Probability Density Function of the IP address sequence is estimated. Prediction of source IP address in the future access to the server is meant to detect anomalous requests. In other words, during an access to the server, only predicted IP addresses are permitted and all others are blocked. The approaches used to estimate the Probability Density Function of IP addresses range from the sequence of IP addresses seen previously and stored in a database to address clustering, normally used by combining the K-Means algorithm. Instead, in this paper we consider the sequence of IP addresses as a numerical sequence and develop the nonlinear analysis of the numerical sequence. We used nonlinear analysis based on Volterra’s Kerners and Hammerstein’s models. The experiments carried out with datasets of source IP address sequences show that the prediction errors obtained with Hammerstein models are smaller than those obtained both with the Volterra Kernels and with the sequence clustering by means of the K-Means algorithm.

show abstract

Mitigation and Prevention Methods for Distributed Denial-of-Service Attacks on Network Servers

Gaylah

Vaghela

2022

Advancements in Smart Computing and Information Security

View full text Add to dashboard Cite

Bayes Optimal DDoS Mitigation by Adaptive History-Based IP Filtering

Cited by 18 publications

References 10 publications

Mitigating DDoS using weight‐based geographical clustering

Mitigating DDoS using weight‐based geographical clustering

A Novel Big Data Analytics Approach for Supporting Cyber Attack Detection via Non-linear Analytic Prediction of IP Addresses

Mitigation and Prevention Methods for Distributed Denial-of-Service Attacks on Network Servers

Contact Info

Product

Resources

About