Investigating unique flow marking for tracing back DDoS attacks

Aghaei-Foroushani, Vahid; Zincir-Heywood, A. Nur

doi:10.1109/inm.2015.7140370

Cited by 4 publications

(1 citation statement)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Aiming at enhancing client identification, the methods in [20], [21] utilize packet header fields as marking fields to distinguish between different clients per-IP. However, assuming modification of core routers hinders deployment.…”

Section: Related Workmentioning

confidence: 99%

Trustworthy DDoS Defense: Design, Proof of Concept Implementation and Testing

Eid

Aida

2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks based on HTTP and HTTPS (i.e., HTTP(S)-DDoS) are increasingly popular among attackers. Overlay-based mitigation solutions attract small and mediumsized enterprises mainly for their low cost and high scalability. However, conventional overlay-based solutions assume content inspection to remotely mitigate HTTP(S)-DDoS attacks, prompting trust concerns. This paper reports on a new overlay-based method which practically adds a third level of client identification (to conventional per-IP and per-connection). This enhanced identification enables remote mitigation of more complex HTTP(S)-DDoS categories without content inspection. A novel behaviorbased reputation and penalty system is designed, then a simplified proof of concept prototype is implemented and deployed on DeterLab. Among several conducted experiments, two are presented in this paper representing a single-vector and a multi-vector complex HTTP(S)-DDoS attack scenarios (utilizing LOIC, Slowloris, and a custom-built attack tool for HTTPS-DDoS). Results show nearly 99.2% reduction in attack traffic and 100% chance of legitimate service. Yet, attack reduction decreases, and cost in service time (of a specified file) rises, temporarily during an approximately 2 minutes mitigation time. Collateral damage to non-attacking clients sharing an attack IP is measured in terms of a temporary extra service time. Only the added identification level was utilized for mitigation, while future work includes incorporating all three levels to mitigate switching and multi-request per connection attack categories.

show abstract

Section: Related Workmentioning

confidence: 99%