Controlling High-Bandwidth Flows at the Congested Router
ICNP '01 Proceedings of the Ninth International Conference on Network Protocols
Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain
IAS '07 Proceedings of the Third International Symposium on Information Assurance and Security
| Hi-index | 0.00 |
DDoS has become one of the thorniest problems in the Internet, and aims to deny legitimate users of the services they should have. In this paper, we introduce novel dual - level attack defense against the DDoS attacks. The macroscopic level detectors attempt to detect voluminous congestion inducing attacks which cause apparent slowdown in network functionality. The subsequent characterization process identifies these large volumes attacks that have been detected early in transit domain. The microscopic level detectors detect sophisticated attacks that cause network performance to degrade gracefully and remain undetected in transit domain. The subsequent characterization process identifies such attacks that have been detected at border routers in stub domain near the victim. We employ the concepts of change point detection on entropy with time to improve the detection rate. Honeypots help achieve high detection and filtering accuracy. In addition to being competitive than other techniques, the defense works well in the presence of different DDoS attacks. The compromise of detection and characterization accuracy and time of confirming is a critical aspect and the proposed technique provides the quite demanded solution.