DDoSniffer: Detecting DDoS attack at the source agents

Authors:
Vicky Laurens;Alexandre Miege;Abdulmotaleb El Saddik;Pulak Dhar
Affiliations:
Multimedia Communications Research Laboratory, University of Ottawa, 161 Louis Pasteur – Colonel By Hall, Ottawa, Ontario K1N 6N5, Canada.;Multimedia Communications Research Laboratory, University of Ottawa, 161 Louis Pasteur – Colonel By Hall, Ottawa, Ontario K1N 6N5, Canada.;Multimedia Communications Research Laboratory, University of Ottawa, SITE, 800 King Edward Ave., Ottawa, Ontario, K1N 6N5, Canada.;Cistech Limited, 210 Colonnade Road, Unit 3, Nepean, ON K2E 7L5, Canada
Venue:
International Journal of Advanced Media and Communication
Year:
2009

Citing 6
Cited 0

TCP/IP illustrated (vol. 1): the protocols

TCP/IP illustrated (vol. 1): the protocols
DDoS attacks and defense mechanisms: classification and state-of-the-art

Computer Networks: The International Journal of Computer and Telecommunications Networking
A taxonomy of DDoS attack and DDoS defense mechanisms

ACM SIGCOMM Computer Communication Review
D-WARD: A Source-End Defense against Flooding Denial-of-Service Attacks

IEEE Transactions on Dependable and Secure Computing
Detecting ddos attacks in stub domains

Detecting ddos attacks in stub domains
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed Denial of Service (DDoS) attacks are an important and challenging security threat. Despite the existing defence mechanisms, attackers manage to build large sets of impersonated hosts. Our approach consists in detecting DDoS directly on these hosts. We classify ongoing attacks as connection attacks or bandwidth attacks. The former are defined as attacks that generate connections with four packets or fewer; the latter as attacks that create connections with traffic ratios larger than usual. We developed a software tool, DDoSniffer, which enforces those principles. We show that it is capable of detecting a broad range of attacks within seconds.