Abstract:By penetrating into a large number of machines and stealthily installing malicious pieces of code, a distributed denial of service (DDoS) attack constructs a hierarchical network and uses it to launch coordinated assaults. DDoS attacks often exhaust the network bandwidth, processing capacity and information resources of victims, thus, leading to unavailability of computing systems services. Various defense mechanisms for the detection, mitigation and/or prevention of DDoS attacks have been suggested including resource redundancy, traceback of attack origins and identification of programs with suspicious behavior. Contemporary DDoS attacks employ sophisticated techniques including formation of hierarchical networks, one-way communication channels, encrypted messages, dynamic ports allocation and source address spoofing to hide the attackers' identities; such techniques make both detection and tracing of DDoS activities a challenge and render traditional DDoS defense mechanisms ineffective. In this paper, we propose the DDoS Container, a comprehensive framework that uses network-based detection methods to overcome the above complex and evasive types of attacks; the framework operates in 'inline' mode to inspect and manipulate ongoing traffic in real-time. By keeping track of connections established by both potential DDoS attacks and legitimate applications, the suggested DDoS Container carries out stateful inspection on data streams and correlates events among sessions. The framework performs stream re-assembly and dissects the resulting aggregations against protocols followed by various known DDoS attacks facilitating their identification. The traffic pattern analysis and data correlation of the framework further enhance its detection accuracy on DDoS traffic camouflaged with encryption. Actions available on identified DDoS traffic range from simple alerting to message blocking and proactive session termination. Experimentation with the prototype of our DDoS Container shows its effectiveness in classifying DDoS traffic.

A Blocking-Free Shared-Media Terminal Connection Setup Method

A novel mechanism to defend against low-rate denial-of-service attacks

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

A Deep ConvNet-Based Countermeasure to Mitigate Link Flooding Attacks Using Software-Defined Networks

Channel Surfing and Spatial Retreats

A New Countermeasure for Protecting Authentication Protocols against Denial of Service Attack

DoS and DDoS Attack's Possibility Verification on Streaming Media Application

Analysis on Streaming Media Service's DoS and DDoS Attacks

A Novel Router-based Scheme to Mitigate SYN Flooding DDoS Attacks

Mitigate DoS and DDoS Attack in Ad Hoc Networks

A Broadcasting Authentication Protocol With Dos And Fault Tolerance For Wireless Ad Hoc Networks

On Denial of Service Attacks in Software Defined Networks

DoS Attacks and Countermeasures on Network Devices

FloodShield: Securing the SDN Infrastructure Against Denial-of-Service Attacks.

An Inline Detection and Prevention Framework for Distributed Denial of Service Attacks

Defense Scheme of DoS,DDoS Attack in Streaming Media Service

Research on an Effective Approach Against DDoS Attacks

NetFence: Preventing Internet Denial of Service from Inside Out

DoS attack defense framework for SDN infrastructure

HTTP DDoS Flooding Attack Mitigation in Software-Defined Networking

DDoS Attack and Defense Scheme in Wireless Ad hoc Networks