Intrusion detection with CUSUM for TCP-Based DDoS

Authors:
Fang-Yie Leu;Wei-Jie Yang
Affiliations:
Department of Computer Science and Information Engineering, Tunghai University, Taiwan;Department of Computer Science and Information Engineering, Tunghai University, Taiwan
Venue:
EUC'05 Proceedings of the 2005 international conference on Embedded and Ubiquitous Computing
Year:
2005

Citing 9
Cited 1

Network support for IP traceback

IEEE/ACM Transactions on Networking (TON)
An analysis of using reflectors for distributed denial-of-service attacks

ACM SIGCOMM Computer Communication Review
Single-packet IP traceback

IEEE/ACM Transactions on Networking (TON)
Attacking DDoS at the Source

ICNP '02 Proceedings of the 10th IEEE International Conference on Network Protocols
Change-Point Monitoring for the Detection of DoS Attacks

IEEE Transactions on Dependable and Secure Computing
IFTS: Intrusion Forecast and Traceback based on Union Defense Environment

ICPADS '05 Proceedings of the 11th International Conference on Parallel and Distributed Systems - Volume 01
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Defending against flooding-based distributed denial-of-service attacks: a tutorial

IEEE Communications Magazine
On IP traceback

IEEE Communications Magazine

Detecting Ringing-Based DoS Attacks on VoIP Proxy Servers

Information Security Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

DDoS(Distributed Denial of Service) is the most troublesome attack nowadays, especially for those people whose operational environment relies on network services and/or the Internet. However, attackers often penetrate innocent routers and hosts to make them unwittingly participate in such a large scale attack as zombies or reflectors. In this paper, we propose an Intrusion Detection System (IDS), named CUSUM Intrusion Detection System (CIDS), which invokes CUSUM as its detection algorithm and logically divides Internet into many autonomous network management units (NMUs), each deploys a CIDS to discover attacks and identify what role a client in such an attack acts as.