Denial of Service (DOS) Attack Assessment Analysis Report

Abstract

Public reporting burden lor this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)Johns Hopkins University Applied Physics Laboratory 111O0 Johns Hopkins Road Laurel, MD 20723-6099 SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)Defense Advanced This effort applied modeling and simulation techniques to the analysis of denial of service attacks on a target network. Attack models were quantified and mitigation techniques were examined and analyzed with possible adaptations of the attacker. The analyses revealed that attack classes and their dependence on network topology can be identified.

Characterizing stateful resource attacks using modeling and simulation

“…Twenty stochastic runs on a model of the same network were analyzed to compare modelgenerated behavior with live network behavior. A series of formal assertions about TCP were checked against both live network and model data to test protocol validity [2]. In addition, traffic statistics were compared between the live network and model for HTTP, FTP and Telnet [2].…”

“…A series of formal assertions about TCP were checked against both live network and model data to test protocol validity [2]. In addition, traffic statistics were compared between the live network and model for HTTP, FTP and Telnet [2]. Figures 1 and 2 show two such comparisons for HTTP.…”