A taxonomy of DDoS attack and DDoS defense mechanisms

Authors:
Jelena Mirkovic;Peter Reiher
Affiliations:
University of Delaware, Newark, DE;UCLA, Los Angeles, CA
Venue:
ACM SIGCOMM Computer Communication Review
Year:
2004

Citing 29
Cited 149

Cyberpunk: outlaws and hackers on the computer frontier

Cyberpunk: outlaws and hackers on the computer frontier
An analysis of security incidents on the Internet 1989-1995

An analysis of security incidents on the Internet 1989-1995
Defending against denial of service attacks in Scout

OSDI '99 Proceedings of the third symposium on Operating systems design and implementation
Towards a taxonomy of intrusion-detection systems

Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on computer network security
Practical network support for IP traceback

Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Protecting web servers from distributed denial of service attacks

Proceedings of the 10th international conference on World Wide Web
Hash-based IP traceback

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications
Resilient overlay networks

SOSP '01 Proceedings of the eighteenth ACM symposium on Operating systems principles
An analysis of using reflectors for distributed denial-of-service attacks

ACM SIGCOMM Computer Communication Review
Controlling high bandwidth aggregates in the network

ACM SIGCOMM Computer Communication Review
Practical automated detection of stealthy portscans

Journal of Computer Security
SOS: secure overlay services

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
A signal analysis of network traffic anomalies

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Attacking DDoS at the Source

ICNP '02 Proceedings of the 10th IEEE International Conference on Network Protocols
A Method to Implement a Denial of Service Protection Base

ACISP '97 Proceedings of the Second Australasian Conference on Information Security and Privacy
Towards Network Denial of Service Resistant Protocols

Proceedings of the IFIP TC11 Fifteenth Annual Working Conference on Information Security for Global Information Infrastructures
How to Own the Internet in Your Spare Time

Proceedings of the 11th USENIX Security Symposium
DOS-Resistant Authentication with Client Puzzles

Revised Papers from the 8th International Workshop on Security Protocols
Internet intrusions: global characteristics and prevalence

SIGMETRICS '03 Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
Throttling Viruses: Restricting propagation to defeat malicious mobile code

ACSAC '02 Proceedings of the 18th Annual Computer Security Applications Conference
A Formal Framework and Evaluation Method for Network Denial of Service

CSFW '99 Proceedings of the 12th IEEE workshop on Computer Security Foundations
A framework for classifying denial of service attacks

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Analysis of a Denial of Service Attack on TCP

SP '97 Proceedings of the 1997 IEEE Symposium on Security and Privacy
D-ward: source-end defense against distributed denial-of-service attacks

D-ward: source-end defense against distributed denial-of-service attacks
Analyzing Distributed Denial of Service Tools: The Shaft Case

LISA '00 Proceedings of the 14th USENIX conference on System administration
Inferring internet denial-of-service activity

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
MULTOPS: a data-structure for bandwidth attack detection

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Mayday: distributed filtering for internet services

USITS'03 Proceedings of the 4th conference on USENIX Symposium on Internet Technologies and Systems - Volume 4

A framework for malicious workload generation

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Characterization of network-wide anomalies in traffic flows

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Denial-of-service resistant quality-of-service signaling for mobile ad hoc networks

Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks
On the robustness of router-based denial-of-service (DoS) defense systems

ACM SIGCOMM Computer Communication Review
Exploiting open functionality in SMS-capable cellular networks

Proceedings of the 12th ACM conference on Computer and communications security
Denial-of-Service Attack-Detection Techniques

IEEE Internet Computing
Mitigating denial of service attacks: a tutorial

Journal of Computer Security
Tracers placement for IP traceback against DDoS attacks

Proceedings of the 2006 international conference on Wireless communications and mobile computing
On the Effectiveness of Secure Overlay Forwarding Systems under Intelligent Distributed DoS Attacks

IEEE Transactions on Parallel and Distributed Systems
DDoS defense by offense

Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications
Mitigating attacks on open functionality in SMS-capable cellular networks

Proceedings of the 12th annual international conference on Mobile computing and networking
Evaluation of secure peer-to-peer overlay routing for survivable SCADA systems

WSC '04 Proceedings of the 36th conference on Winter simulation
Towards scalable and robust distributed intrusion alert fusion with good load balancing

Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense
One step ahead to multisensor data fusion for DDoS detection

Journal of Computer Security - Special issue on security track at ACM symposium on applied computing 2004
Protecting mobile devices from TCP flooding attacks

Proceedings of first ACM/IEEE international workshop on Mobility in the evolving internet architecture
Survey of network-based defense mechanisms countering the DoS and DDoS problems

ACM Computing Surveys (CSUR)
Design and Analysis of an Adaptive, Global Strategy for Detecting and Mitigating Distributed DoS Attacks in GRID Environments

ANSS '06 Proceedings of the 39th annual Symposium on Simulation
A practical and robust inter-domain marking scheme for IP traceback

Computer Networks: The International Journal of Computer and Telecommunications Networking
Evaluation of a low-rate DoS attack against iterative servers

Computer Networks: The International Journal of Computer and Telecommunications Networking
Honeypot back-propagation for mitigating spoofing distributed Denial-of-Service attacks

Journal of Parallel and Distributed Computing - Special issue: Security in grid and distributed systems
Analysis of area-congestion-based DDoS attacks in ad hoc networks

Ad Hoc Networks
Combining filtering and statistical methods for anomaly detection

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement
Adaptive defense against various network attacks

SRUTI'05 Proceedings of the Steps to Reducing Unwanted Traffic on the Internet on Steps to Reducing Unwanted Traffic on the Internet Workshop
A Divide-and-Conquer Strategy for Thwarting Distributed Denial-of-Service Attacks

IEEE Transactions on Parallel and Distributed Systems
A methodology for verification of digital items in fair exchange protocols with active trustee

Electronic Commerce Research
A taxonomy for denial of service attacks in content-based publish/subscribe systems

Proceedings of the 2007 inaugural international conference on Distributed event-based systems
On the Design and Performance of an Adaptive, Global Strategy for Detecting and Mitigating Distributed DoS Attacks in GRID and Collaborative Workflow Environments

Simulation
Implementing and testing dynamic timeout adjustment as a dos counter-measure

Proceedings of the 2007 ACM workshop on Quality of protection
Robust and efficient detection of DDoS attacks for large-scale internet

Computer Networks: The International Journal of Computer and Telecommunications Networking
Bio-inspired promoters and inhibitors for self-organized network security facilities

Proceedings of the 1st international conference on Bio inspired models of network, information and computing systems
Rishi: identify bot contaminated hosts by IRC nickname evaluation

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
A router-based technique to mitigate reduction of quality (RoQ) attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Information Assurance: Dependability and Security in Networked Systems

Information Assurance: Dependability and Security in Networked Systems
Wireless client puzzles in IEEE 802.11 networks: security by wireless

WiSec '08 Proceedings of the first ACM conference on Wireless network security
Power to the people: securing the internet one edge at a time

Proceedings of the 2007 workshop on Large scale attack defense
Extracting hidden anomalies using sketch and non Gaussian multiresolution statistical detection procedures

Proceedings of the 2007 workshop on Large scale attack defense
Detailed DoS attacks in wireless networks and countermeasures

International Journal of Ad Hoc and Ubiquitous Computing
Secure communication method in mobile wireless networks

Proceedings of the 1st international conference on MOBILe Wireless MiddleWARE, Operating Systems, and Applications
On attack causality in internet-connected cellular networks

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Evaluating the partial deployment of an AS-level IP traceback system

Proceedings of the 2008 ACM symposium on Applied computing
Network Security: Know It All: Know It All

Network Security: Know It All: Know It All
Using Identity-Based Privacy-Protected Access Control Filter (IPACF) to against denial of service attacks and protect user privacy

SpringSim '07 Proceedings of the 2007 spring simulation multiconference - Volume 3
Queueing Analysis for Networks Under DoS Attack

ICCSA '08 Proceedings of the international conference on Computational Science and Its Applications, Part II
Hacking the Nation-State: Security, Information Technology and Policies of Assurance

Information Security Journal: A Global Perspective
Fidelity of network simulation and emulation: A case study of TCP-targeted denial of service attacks

ACM Transactions on Modeling and Computer Simulation (TOMACS)
Towards a taxonomy of network scanning techniques

Proceedings of the 2008 annual research conference of the South African Institute of Computer Scientists and Information Technologists on IT research in developing countries: riding the wave of technology
Exploiting open functionality in SMS-capable cellular networks

Journal of Computer Security
Correlation-based load balancing for network intrusion detection and prevention systems

Proceedings of the 4th international conference on Security and privacy in communication netowrks
Using mobile agents to recover from node and database compromise in path-based DoS attacks in wireless sensor networks

Journal of Network and Computer Applications
Fast autonomous system traceback

Journal of Network and Computer Applications
Mitigating attacks on open functionality in SMS-capable cellular networks

IEEE/ACM Transactions on Networking (TON)
An efficient analytical solution to thwart DDoS attacks in public domain

Proceedings of the International Conference on Advances in Computing, Communication and Control
P2P Networking and Applications

P2P Networking and Applications
Bunker: a privacy-oriented platform for network tracing

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
DDoSniffer: Detecting DDoS attack at the source agents

International Journal of Advanced Media and Communication
An auto-responsive honeypot architecture for dynamic resource allocation and QoS adaptation in DDoS attacked networks

Computer Communications
Spatio-temporal network anomaly detection by assessing deviations of empirical measures

IEEE/ACM Transactions on Networking (TON)
Intrusion Detection System for Denial-of-Service flooding attacks in SIP communication networks

International Journal of Security and Networks
Detecting DDoS Attacks Using Dispersible Traffic Matrix and Weighted Moving Average

ISA '09 Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance
A prediction-based detection algorithm against distributed denial-of-service attacks

Proceedings of the 2009 International Conference on Wireless Communications and Mobile Computing: Connecting the World Wirelessly
A DoS-resilient information system for dynamic data management

Proceedings of the twenty-first annual symposium on Parallelism in algorithms and architectures
TrueIP: prevention of IP spoofing attacks using identity-based cryptography

Proceedings of the 2nd international conference on Security of information and networks
Modelling and simulations for Identity-Based Privacy-Protected Access Control Filter (IPACF) capability to resist massive denial of service attacks

International Journal of Information and Computer Security
Practical utilities for monitoring multicast service availability

Computer Communications
Mathematical model for low-rate DoS attacks against application servers

IEEE Transactions on Information Forensics and Security
On cellular botnets: measuring the impact of malicious devices on a cellular network core

Proceedings of the 16th ACM conference on Computer and communications security
Network anomaly detection and classification via opportunistic sampling

IEEE Network: The Magazine of Global Internetworking - Special issue title on recent developments in network intrusion detection
Towards behavioral control in multi-player network games

GameNets'09 Proceedings of the First ICST international conference on Game Theory for Networks
Security Notions and Generic Constructions for Client Puzzles

ASIACRYPT '09 Proceedings of the 15th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Detecting Ringing-Based DoS Attacks on VoIP Proxy Servers

Information Security Applications
Review: A review of DoS attack models for 3G cellular networks from a system-design perspective

Computer Communications
Communities of interest for internet traffic prioritization

INFOCOM'09 Proceedings of the 28th IEEE international conference on Computer Communications Workshops
DDoS defense by offense

ACM Transactions on Computer Systems (TOCS)
WTR: a reputation metric for distributed hash tables based on a risk and credibility factor

Journal of Computer Science and Technology - Special section on trust and reputation management in future computing systmes and applications
A bidirectional-based DDoS detection mechanism

WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
Traceback-based Bloomfilter IPS in defending SYN flooding attack

WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
Defending DDoS attacks using hidden Markov models and cooperative reinforcement learning

PAISI'07 Proceedings of the 2007 Pacific Asia conference on Intelligence and security informatics
Highspeed and flexible source-end DDoS protection system using IXP2400 network processor

IPOM'07 Proceedings of the 7th IEEE international conference on IP operations and management
The curse of ease of access to the internet

ICISS'07 Proceedings of the 3rd international conference on Information systems security
Simulation of dynamic honeypot based redirection to counter service level DDoS attacks

ICISS'07 Proceedings of the 3rd international conference on Information systems security
DDoS mitigation in non-cooperative environments

NETWORKING'08 Proceedings of the 7th international IFIP-TC6 networking conference on AdHoc and sensor networks, wireless networks, next generation internet
Secured and trusted three-tier grid architecture

International Journal of Ad Hoc and Ubiquitous Computing
Towards a unifying approach in understanding security problems

ISSRE'09 Proceedings of the 20th IEEE international conference on software reliability engineering
Resilience and survivability in communication networks: Strategies, principles, and survey of disciplines

Computer Networks: The International Journal of Computer and Telecommunications Networking
A novel DDOS attack defending framework with minimized bilateral damages

CCNC'10 Proceedings of the 7th IEEE conference on Consumer communications and networking conference
Deciding optimal entropic thresholds to calibrate the detection mechanism for variable rate DDoS attacks in ISP domain: honeypot based approach

Journal of Intelligent Manufacturing
Defense techniques for low-rate DoS attacks against application servers

Computer Networks: The International Journal of Computer and Telecommunications Networking
Range hash for regular expression pre-filtering

Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
On modeling and simulation of game theory-based defense mechanisms against DoS and DDoS attacks

SpringSim '10 Proceedings of the 2010 Spring Simulation Multiconference
A queue model to detect DDos attacks

CTS'05 Proceedings of the 2005 international conference on Collaborative technologies and systems
Multi-agent reinforcement learning for intrusion detection

ALAMAS'05/ALAMAS'06/ALAMAS'07 Proceedings of the 5th , 6th and 7th European conference on Adaptive and learning agents and multi-agent systems: adaptation and multi-agent learning
Honeypot back-propagation for mitigating spoofing distributed denial-of-service attacks

IPDPS'06 Proceedings of the 20th international conference on Parallel and distributed processing
Detect DDoS flooding attacks in mobile ad hoc networks

International Journal of Security and Networks
The dark side of the Internet: Attacks, costs and responses

Information Systems
Modeling DNS activities based on probabilistic latent semantic analysis

ADMA'10 Proceedings of the 6th international conference on Advanced data mining and applications - Volume Part II
WDA: A Web farm Distributed Denial Of Service attack attenuator

Computer Networks: The International Journal of Computer and Telecommunications Networking
DDoS detection and traceback with decision tree and grey relational analysis

International Journal of Ad Hoc and Ubiquitous Computing
Intrusion-tolerant fine-grained authorization for Internet applications

Journal of Systems Architecture: the EUROMICRO Journal
Analyzing network behaviors with knowledge acquisition and data warehousing

ICCOMP'06 Proceedings of the 10th WSEAS international conference on Computers
On detecting active worms with varying scan rate

Computer Communications
Network attack detection at flow level

NEW2AN'11/ruSMART'11 Proceedings of the 11th international conference and 4th international conference on Smart spaces and next generation wired/wireless networking
Efficient defence against misbehaving TCP receiver DoS attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking
Review: A survey on content-centric technologies for the current Internet: CDN and P2P solutions

Computer Communications
Combat model-based DDoS detection and defence using experimental testbed: a quantitative approach

International Journal of Intelligent Engineering Informatics
Detecting DDoS attacks with Hadoop

Proceedings of The ACM CoNEXT Student Workshop
Packet marking based cooperative attack response service for effectively handling suspicious traffic

Inscrypt'06 Proceedings of the Second SKLOIS conference on Information Security and Cryptology
A cost-optimized detection system location scheme for DDoS attack

PDCAT'04 Proceedings of the 5th international conference on Parallel and Distributed Computing: applications and Technologies
Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

ICCS'06 Proceedings of the 6th international conference on Computational Science - Volume Part IV
Detection of DDoS attacks using optimized traffic matrix

Computers & Mathematics with Applications
A novel rate limit algorithm against meek DDoS attacks

ATC'06 Proceedings of the Third international conference on Autonomic and Trusted Computing
Detection of unknown dos attacks by kolmogorov-complexity fluctuation

CISC'05 Proceedings of the First SKLOIS conference on Information Security and Cryptology
Addressing malicious code in COTS: a protection framework

ICCBSS'05 Proceedings of the 4th international conference on COTS-Based Software Systems
Intra-domain IP traceback using OSPF

Computer Communications
Pervasive random beacon in the internet for covert coordination

IH'05 Proceedings of the 7th international conference on Information Hiding
Public-key cryptography and availability

SAFECOMP'05 Proceedings of the 24th international conference on Computer Safety, Reliability, and Security
Botnet tracking: exploring a root-cause methodology to prevent distributed denial-of-service attacks

ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security
Assessment of a vulnerability in iterative servers enabling low-rate dos attacks

ESORICS'06 Proceedings of the 11th European conference on Research in Computer Security
HTTPHunting: an IBR approach to filtering dangerous HTTP Traffic

ICDM'06 Proceedings of the 6th Industrial Conference on Data Mining conference on Advances in Data Mining: applications in Medicine, Web Mining, Marketing, Image and Signal Mining
Path attestation scheme to avert DDoS flood attacks

NETWORKING'10 Proceedings of the 9th IFIP TC 6 international conference on Networking
A flooding-based DoS/DDoS detecting algorithm based on traffic measurement and prediction

IWSEC'06 Proceedings of the 1st international conference on Security
LoRDAS: a low-rate dos attack against application servers

CRITIS'07 Proceedings of the Second international conference on Critical Information Infrastructures Security
DDoS defense mechanisms: a new taxonomy

DPM'09/SETOP'09 Proceedings of the 4th international workshop, and Second international conference on Data Privacy Management and Autonomous Spontaneous Security
Low rate dos attack to monoprocess servers

SPC'06 Proceedings of the Third international conference on Security in Pervasive Computing
Classification of UDP traffic for DDoS detection

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
Tracking DDoS attacks: insights into the business of disrupting the web

LEET'12 Proceedings of the 5th USENIX conference on Large-Scale Exploits and Emergent Threats
A traffic regulation method based on MRA signatures to reduce unwanted traffic from compromised end-user machines

DPM'11 Proceedings of the 6th international conference, and 4th international conference on Data Privacy Management and Autonomous Spontaneus Security
Characterizing DDoS attack distributions from emulation based experiments on DETER testbed

ADCONS'11 Proceedings of the 2011 international conference on Advanced Computing, Networking and Security
Review: Analyzing well-known countermeasures against distributed denial of service attacks

Computer Communications
Securing cloud infrastructure against co-resident DoS attacks using game theoretic defense mechanisms

Proceedings of the International Conference on Advances in Computing, Communications and Informatics
Genetic algorithm combined with support vector machine for building an intrusion detection system

Proceedings of the International Conference on Advances in Computing, Communications and Informatics
Towards a bayesian network game framework for evaluating DDoS attacks and defense

Proceedings of the 2012 ACM conference on Computer and communications security
Thwarting DDoS attacks in grid using information divergence

Future Generation Computer Systems
A denial-of-service resistant DHT

DISC'07 Proceedings of the 21st international conference on Distributed Computing
Queue management as a DoS counter-measure?

ISC'07 Proceedings of the 10th international conference on Information Security
Adding resilience to message oriented middleware

Proceedings of the 2nd International Workshop on Software Engineering for Resilient Systems
AK-PPM: an authenticated packet attribution scheme for mobile ad hoc networks

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses
N-Gram against the machine: on the feasibility of the n-gram network analysis for binary protocols

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses
An event buffer flooding attack in DNP3 controlled SCADA systems

Proceedings of the Winter Simulation Conference
Survey Cyber security in the Smart Grid: Survey and challenges

Computer Networks: The International Journal of Computer and Telecommunications Networking
Maygh: building a CDN from client web browsers

Proceedings of the 8th ACM European Conference on Computer Systems
IRIS: a robust information system against insider dos-attacks

Proceedings of the twenty-fifth annual ACM symposium on Parallelism in algorithms and architectures
Survey and taxonomy of botnet research through life-cycle

ACM Computing Surveys (CSUR)
A mechanism for achieving a bound on execution performance of process group to limit CPU abuse

The Journal of Supercomputing
POSTER: Reflected attacks abusing honeypots

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
DDoS mitigation in content distribution networks

International Journal of Wireless and Mobile Computing
Towards adaptive character frequency-based exclusive signature matching scheme and its applications in distributed intrusion detection

Computer Networks: The International Journal of Computer and Telecommunications Networking
FaceDCAPTCHA: Face detection based color image CAPTCHA

Future Generation Computer Systems
An extensible pattern-based library and taxonomy of security threats for distributed systems

Computer Standards & Interfaces
sShield: small DDoS defense system using RIP-based traffic deflection in autonomous system

The Journal of Supercomputing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents two taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria was selected to highlight commonalities and important features of attack strategies, that define challenges and dictate the design of countermeasures. The defense taxonomy classifies the body of existing DDoS defenses based on their design decisions; it then shows how these decisions dictate the advantages and deficiencies of proposed solutions.