ICNP '02 Proceedings of the 10th IEEE International Conference on Network Protocols
BLINC: multilevel traffic classification in the dark
Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Analyzing large DDoS attacks using multiple data sources
Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense
Towards user-centric metrics for denial-of-service measurement
Proceedings of the 2007 workshop on Experimental computer science
Statistical techniques for detecting traffic anomalies through packet header data
IEEE/ACM Transactions on Networking (TON)
TVA: a DoS-limiting network architecture
IEEE/ACM Transactions on Networking (TON)
Monitoring the application-layer DDoS attacks for popular websites
IEEE/ACM Transactions on Networking (TON)
An Entropy-Based Countermeasure against Intelligent DoS Attacks Targeting Firewalls
POLICY '09 Proceedings of the 2009 IEEE International Symposium on Policies for Distributed Systems and Networks
Defending against flooding-based distributed denial-of-service attacks: a tutorial
IEEE Communications Magazine
| Hi-index | 0.00 |
In July 2009, surprising large-scale Distributed Denial-of-Service (DDoS) attacks simultaneously targeted US and South Korean government, military, and commercial websites. Initial speculation was that this was well-designed cyber warfare from North Korea, but the truth is still unknown. What was even more surprising was how these critical infrastructures were still vulnerable after a decade of research on DDoS attacks. These particular incidents, the so-called 7.7 (July 7th) DDoS attacks, were highlighted not just because of their success but also because of their well-coordinated strategy. The 3.3 (March 3rd, 2011) DDoS attacks had similar characteristics to the 7.7 DDoS attacks, but they were not as successful because of the rapid vaccination of the zombie hosts. In this paper, we suggest that it is worthwhile to take a step back from the target side of the DDoS attacks and look at the problem in terms of network traffic from the attacker's side. We collected a unique large-scale sample of DDoS attack traffic from the two real-world incidents (not simulated), and we provide an analysis of traffic patterns from the perspective of the attacker's hosting network.