Cooperative detection and protection against network attacks using decentralized information sharing

  • Authors:

  • Guangsen Zhang;Manish Parashar

  • Affiliations:

  • The Applied Software Systems Laboratory, Department of Electrical and Computer Engineering, Rutgers, The State University of New Jersey, Piscataway, USA 08854;The Applied Software Systems Laboratory, Department of Electrical and Computer Engineering, Rutgers, The State University of New Jersey, Piscataway, USA 08854

  • Venue:
  • Cluster Computing
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Network attacks, such as distributed denial of service (DDoS) and Internet worms, are highly distributed and well coordinated offensive assaults on services, hosts, and the infrastructure of the Internet, and can have disastrous effects including financial losses and disruption of essential services. Consequently, effective defensive countermeasures against these attacks must provide equally sophisticated and well coordinated mechanisms for monitoring, analysis, and response. In this paper, we investigate techniques for cooperative attack detection and countermeasures using decentralized information sharing. The key underlying idea is the use of epidemic algorithms to share attack information and achieve quasi-global knowledge about attack behaviors. This paper first presents a conceptual model that defines the relationships between the level of knowledge in the distributed system and the accuracy of attack detection. The design of a cooperative attack detection and defense framework is then presented, and its use for detecting and defending against DDoS attacks and Internet worms is described. Simulation results are presented to demonstrate the feasibility and effectiveness of the framework against these attacks.