A novel rate limit algorithm against meek DDoS attacks

Authors:
Yinan Jing;Xueping Wang;Xiaochun Xiao;Gendu Zhang
Affiliations:
School of Information Science & Engineering, Fudan University, Shanghai, China;School of Information Science & Engineering, Fudan University, Shanghai, China;School of Information Science & Engineering, Fudan University, Shanghai, China;School of Information Science & Engineering, Fudan University, Shanghai, China
Venue:
ATC'06 Proceedings of the Third international conference on Autonomic and Trusted Computing
Year:
2006

Citing 8
Cited 0

An analysis of using reflectors for distributed denial-of-service attacks

ACM SIGCOMM Computer Communication Review
Controlling high bandwidth aggregates in the network

ACM SIGCOMM Computer Communication Review
IP Traceback-Based Intelligent Packet Filtering: A Novel Technique for Defending against Internet DDoS Attacks

ICNP '02 Proceedings of the 10th IEEE International Conference on Network Protocols
A taxonomy of DDoS attack and DDoS defense mechanisms

ACM SIGCOMM Computer Communication Review
Defending against distributed denial-of-service attacks with max-min fair server-centric router throttles

IEEE/ACM Transactions on Networking (TON)
Active internet traffic filtering: real-time response to denial-of-service attacks

ATEC '05 Proceedings of the annual conference on USENIX Annual Technical Conference
Inferring internet denial-of-service activity

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
On IP traceback

IEEE Communications Magazine

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed denial-of-service attack is one of major threats to Internet today. Rate limit algorithm with max-min fairness is an effective countermeasure to defeat flooding-style DDoS attacks under the assumption that attackers are more aggressive than legitimate users. However, under a “meek” DDoS attack where such an assumption is no longer valid, it will fail to protect legitimate traffic effectively. In order to improve the survival ratio of legitimate packets, an IP traceback based rate limit algorithm is proposed. Simulation results show that it could not only mitigate the DDoS attack effect, but also improve the throughput of legitimate traffic even under a meek attack.