Defending Against Denial of Service Attacks

Yin Qin,Xue Zhi

DOI: https://doi.org/10.3969/j.issn.1009-8054.2006.12.055

2006-01-01

Abstract:DDoS attacks in the Internet have produced new challenges to network and system security. Many mecha- nisms have been designed to address this problem in recent years. This paper surveys these techniques and analyses them.

What problem does this paper attempt to address?

Survey of Network-Based Defense Mechanisms Countering the DoS and DDoS Problems

Tao Peng,Christopher Leckie,Kotagiri Ramamohanarao

DOI: https://doi.org/10.1145/1216370.1216373

IF: 16.6

2007-01-01

ACM Computing Surveys

Abstract:This article presents a survey of denial of service attacks and the methods that have been proposed for defense against these attacks. In this survey, we analyze the design decisions in the Internet that have created the potential for denial of service attacks. We review the state-of-art mechanisms for defending against denial of service attacks, compare the strengths and weaknesses of each proposal, and discuss potential countermeasures against each defense mechanism. We conclude by highlighting opportunities for an integrated solution to solve the problem of distributed denial of service attacks.
Defense Technology of DDoS Attacks

Zhang jing,Hu huaping,Liu bo,Xiao fengtao,Chen xin

DOI: https://doi.org/10.3969/j.issn.1674-9456.2010.07.011

2010-01-01

Abstract:Because of the present architecture of Internet and the lack mechanism of certifi cation making DDoS attacks occurs very easy. And the fast development of botnet has been offered powerful tool for DDoS attacks. DDoS attack is one of major threat of network security, so how to defend DDoS attacks become a hot point of network security research. Based on the model of DDoS attacks and analyzing the reason of attacks’ occur, we introduce the defense technology of DDoS attacks from four aspects: attack prevention, attack detection, attack response and attack source tracking. In the last, we suggest the worthy research points.
Defending against Distributed Denial of Service Attacks: Issues and Challenges

B. B. Gupta,R. C. Joshi,Manoj Misra

DOI: https://doi.org/10.1080/19393550903317070

2009-11-06

Information Security Journal: A Global Perspective

Abstract:Distributed Denial of Service (DDoS) attacks on user machines, organizations, and infrastructures of the Internet have become highly publicized incidents and call for immediate solution. It is a complex and difficult problem characterized by an explicit attempt of the attackers to prevent access to resources by legitimate users for which they have authorization. Several schemes have been proposed on how to defend against these attacks, yet the problem still lacks a complete solution. The main purpose of this paper is therefore twofold. First is to present a comprehensive study of a wide range of DDoS attacks and defense methods proposed to combat them. This provides better understanding of the problem, current solution space, and future research scope to defend against DDoS attacks. Second is to propose an integrated solution for completely defending against flooding DDoS attacks at the Internet Service Provider (ISP) level.
Technical Analysis and Defendable Policy of Distributed Denial of Service Attack

Luo Zhen,Pei Changxing,Zhu Changhua

DOI: https://doi.org/10.3969/j.issn.1007-7820.2006.12.020

2006-01-01

Abstract:This paper makes a systematic analysis of the implementation theory of DDoS(Distributed Denial of Service) attack, presents the tools commonly used to start a DDOS and proposes a detailed and feasible policy which can defend the DDOS based on the method of DDOS. The major properties of the popular and typical detection and response system of DDOS is given. Finally the future research on the defense of DDoS is presented.
Research on Safeguard Techniques against DoS and DDoS Attacks

He LI,Shu-yang WANG

DOI: https://doi.org/10.3969/j.issn.1003-3033.2009.01.021

2009-01-01

Abstract:The common means for DoS (denial-of-service attack) and DDoS (distributed denial-of-service) attack were studied, and all kinds of related defense techniques were deeply analyzed. A thread for the defense techniques through reinforcing the equipment and distributed detection, which combined technology and management, was put forward. And then, a comprehensive solution to the open network problems was presented, which was involved in security assessment, attack detection, flux laundering, security management and corresponding job responsibilities. This study may provide a guide for the enterprises to defense DoS and DDoS attacks.
Analysis and Defense for Application Layer DDoS Attacks in the Novel Network Environment

Xie Yi,Yu Shunzheng

DOI: https://doi.org/10.3969/j.issn.1000-0801.2007.01.023

2007-01-01

Abstract:Distributed denial of service (DDoS) attacks bring a very serious threat to the stability of Internet. DDoS attack methods and tools are becoming more sophisticated, effective and also more difficult to be traced. New forms of DDoS attacks on application layer cause current defense technologies working on TCP or IP level unable to withstand them, which makes a new challenge to the traditional anomaly detection techniques. In this paper, we discuss the rationale of application layer DDoS attacks and the disadvantages of current DDoS detection schemes in dealing with such attacks. At last, a new detection scheme focusing on application layer DDoS attacks defense based on user behavior is proposed. Filtering and blocking are also carried out for the malicious HTTP requests over the application level and TCP level.
Research on Distributed Denial-of-service Attacks:a Survey

徐恪,徐明伟,吴建平

DOI: https://doi.org/10.3969/j.issn.1000-1220.2004.03.005

2004-01-01

Abstract:Distributed denial-of-service attack (DDoS) brings a very serious threat to the stability of the Internet. In a typical DDoS attack, a large number of compromised hosts are amassed to send useless packets to jam the CPU or Internet connection of victim. In the last two years, it is discovered that DDoS attack methods and tools are becoming more sophisticated, effective, and also more difficult to trace to the real attackers. On the defense side, current technologies are still unable to withstand large-scale attacks. In this paper, we first describe various DDoS attack methods, and then present a discussion and review of current defense mechanisms such as IP traceback. Then we emphasis discuss a long-term solution, the Internet firewall approach, that attempts to intercept attack packets in the Internet core, well before reaching the victim.
A Comprehensive Survey on Ddos Defense Systems: New Trends and Challenges

Qing Li,He Huang,Ruoyu Li,Jianhui Lv,Zhenhui Yuan,Lianbo Ma,Yi Han,Yong Jiang

DOI: https://doi.org/10.1016/j.comnet.2023.109895

IF: 5.493

2023-01-01

Computer Networks

Abstract:In the past ten years, the source of DDoS has migrated to botnets composed of IoT devices. The scale of DDoS attacks increases dramatically with the number of IoT devices.New variants of DDoS attacks using different system vulnerabilities emerge in an endless stream. In response to this situation, researchers have made significant contributions to the field of DDoS defense by applying modern programmable network technology and network-level resource scheduling management technology. However, the existing review articles need more research on these technologies. After investigating the development trend of DDoS attacks in recent years and the new challenges caused by them, this paper classifies the new technologies that have emerged in the field of DDoS defense in the past ten years. Among them, the collaboration between domains and inter-domain resource scheduling is one of the critical challenges in designing a large-scale distributed DDoS cooperative defense system. In addition, modern programmable network technology has dramatically expanded network systems' functional diversity and deployment flexibility. We will discuss building a defense system based on programmable networks and focus on SOTA defense solutions based on programmable switches. Finally, developing DDoS defense mechanisms with broad-spectrum detection capabilities, robustness against adversarial attacks, and cost-effective and collaborative DDoS defense mechanisms for establishing the Internet are future research directions in network security.
The Technical Analysis and Security Countermeasure of DoS-based Network Attacks

濮青

DOI: https://doi.org/10.3969/j.issn.1001-3695.2003.03.023

2003-01-01

Abstract:Denial of Sevice (DoS) attack on the Internet now has become a ordinary network attack method.DoS attack is a malicious action that exhausts victim hosts resources and prevents them from serving any other legal users by exploiting software bugs or system leaks.In this paper,we discuss the theory of DoS attack,analyze some potential leaks in TCP/IP protocol set,and introduce some new progress such as DDos .We also show how to make security plans to defense the DoS attacks by using Firewalls or IDS.
Research on P2P-based DDoS Attacks and Their Defense Mechanism

Zhixin Chen

2011-01-01

Abstract:This paper first introduced the principle of exploiting P2P systems to perform DDoS attacks,and then classified existing researches as two types: active attacks and passive attacks.Summarized the defense solutions and described them from four aspects: validation-based method,membership-based method,reputation-based method and victim method.Finally,discussed the further directions of P2P-based attacks and their defense mechanism from the view of promoting the safety of P2P network and Internet.
Research on Defense System Against DDoS Attacks

Hu Youzhi,Lu Yuliang

DOI: https://doi.org/10.3969/j.issn.1627-9730.2006.04.021

2006-01-01

Abstract:DDoS is a very effective network attack technique,which is called the "supreme weapen" of hachers.The defense against DDoS attacks is very difficult as the attacks often occurs suddenly and the zombies distribute widely.This paper analyses the characteristics of DDos attacks,and then brings forward a defense system.
A Defense Mechanism for Distributed Denial of Service Attack in Software-Defined Networks

Shibo Luo,Jun Wu,Jianhua Li,Bei Pei

DOI: https://doi.org/10.1109/FCST.2015.11

2015-01-01

Abstract:Distributed Denial of Service (DDoS) attack is a major threat to Internet based killer applications, such as independent news web sites, e-business and online games. Detecting and blocking such clever attacks has become difficult. Software-Defined Networks (SDN) has emerged as a future communication network architecture which decouples network control and forwarding. It has some particular features such as central control and programmability to combat against DDoS attack. In this paper, we survey DDoS attacks and existing defense mechanisms, and draw a conclusion of the needs of defense mechanism for successful combating against DDoS. Then, we analyze the particular features of SDN and conclude it is conducive to countermeasure DDoS attack. According the analysis, we construct a defense mechanism for DDoS in SDN. At last, we illustrate how this mechanism could combat against DDoS attacks through a working example.
DDoS Attack and Defense: Review of Some Traditional and Current Techniques

Muhammad Aamir,Mustafa Ali Zaidi

DOI: https://doi.org/10.48550/arXiv.1401.6317

2014-03-22

Abstract:Distributed Denial of Service (DDoS) attacks exhaust victim's bandwidth or services. Traditional architecture of Internet is vulnerable to DDoS attacks and an ongoing cycle of attack & defense is observed. In this paper, different types and techniques of DDoS attacks and their countermeasures are reviewed. The significance of this paper is the coverage of many aspects of countering DDoS attacks including new research on the topic. We survey different papers describing methods of defense against DDoS attacks based on entropy variations, traffic anomaly parameters, neural networks, device level defense, botnet flux identifications and application layer DDoS defense. We also discuss some traditional methods of defense such as traceback and packet filtering techniques so that readers can identify major differences between traditional and current techniques of defense against DDoS attacks. Before the discussion on countermeasures, we mention different attack types under DDoS with traditional and advanced schemes while some information on DDoS trends in the year 2012 Quarter-1 is also provided. We identify that application layer DDoS attacks possess the ability to produce greater impact on the victim as they are driven by legitimate-like traffic making it quite difficult to identify and distinguish from legitimate requests. The need of improved defense against such attacks is therefore more demanding in research. The study conducted in this paper can be helpful for readers and researchers to recognize better techniques of defense in current times against DDoS attacks and contribute with more research on the topic in the light of future challenges identified in this paper.

Cryptography and Security
Survey of DOS Defense Mechanisms

Samuel Pierre,Mudhakar Srivatsa,Arun Iyengar,Jian Yin,Ling Liu,Alberto Compagno,Mauro Conti,Paolo Gasti,Tian Zhihong,Ritu Maheshwari,Ashok Singh Sairam,Thomas Dubendorfer,Matthias Bossardt

2015-01-01

Abstract:The Denial of Service (DOS) attacks hinder the availability of service to the genuine client from the server. The DOS attacks can cause severe damage to the interconnected systems such as web servers, database servers, cloud computing servers, etc. This paper surveys the different defense mechanisms available for the denial of service attacks.
A Simple DDoS Defense Method Based SDN

Chen Runze,Ruan Fangming,Li Yidan,Yin Lan,Chen Yanli

DOI: https://doi.org/10.1109/ASID52932.2021.9651724

2021-01-01

Abstract:DDoS attacks have been one of the major threats to the Internet since their emergence. With the rapid development of the Internet, the number of network users is increasing rapidly. Thus, the existing network based on TCP\IP protocol is increasingly complex and rigid; it is difficult to add new functions, which greatly restricts the development of network technology. The emergence of SDN provides ...
Defense study and implementation mechanism of distributed denial of service attack

杨余旺,杨静宇,孙亚民

DOI: https://doi.org/10.3969/j.issn.1000-7024.2004.05.001

2004-01-01

Abstract:Formulation mechanism,operation tools and latest development of distributed denial of service(DDoS)were analyzed. Based on the mechanism of this kind of attack,general defense strategy and mechanism taxonomy of DDoS attack were provided, as well as some kinds of mechanism in details.Finally,some representative DDoS detection and response application systems in the IT market were described briefly with their important relative performance,moverover some research direction on this topic was listed in the conclusion part.
A Ddos Attack Defending Scheme Based on Network Processor

Li Xinlei,Zheng Kangfeng,Yang Yixian

DOI: https://doi.org/10.1109/icie.2009.107

2009-01-01

Abstract:The distributed denial of service attacks have become more and more frequent and caused some fatal problems. Many researches have been done to detect and defend such attacks, however, many solutions are still in the phase of theoretical studies. Some of them may have certain practical value, but they have to reconstruct the existing network and the routing instruments with great cost. This paper proposes a DDoS attack defending scheme based on network processor. The scheme takes advantage of network processor's powerful process ability to divide the network flow into different types firstly, and then uses a QoS mechanism to ensure essential communications as well as to eliminate the attack flow to the greatest extent. Experiment results show that the scheme can provide enough bandwidth for high priority flow, and effectively weaken the attack flow.
A DDOS Defence Scheme Based on Two-Stage Traffic Flow Control.

Qingxia Li,Wenhong Wei,Ming Tao,Qian Chen

DOI: https://doi.org/10.1504/ijcnds.2014.064638

IF: 1.3

2014-01-01

International Journal of Communication Networks and Distributed Systems

Abstract:In distributed denial of service (DDoS) attack, the detection techniques have existed for a relatively longer period of time than defence mechanisms, researchers have categorised almost all the existing and expected forthcoming attacks. However, techniques for defence are still nurturing. Researchers have explored that there could be diverse ways of launching DDoS attacks. Consequently, need of defence scheme that adapts and responds autonomously to these variety of attacks is imperative. This paper proposed a distributed defence scheme based on two-stage traffic flow control against DDoS attacks that present the most serious threats to the internet. The defence using this scheme deploys two kinds of coordinated modules through specific mechanism to protect internet servers. And the performance of the scheme was evaluated by network simulation. Simulation results show that the proposed scheme can greatly increase the throughput of legitimate traffic and reduce the attack traffic during DDos attacks, and it performs well even when it is only partially deployed.
DDoS Attack in Software Defined Networks: A Survey

XU Xiaoqiong,YU Hongfang,YANG Kun

DOI: https://doi.org/10.3969/j.issn.1673-5188.2017.03.003

2019-01-01

Abstract:Distributed Denial of Service（DDoS） attacks have been one of the most destructive threats to Internet security. By decoupling the network control and data plane, software defined networking（SDN） offers a flexible network management paradigm to solve DDoS attack in traditional networks. However, the centralized nature of SDN is also a potential vulnerability for DDo S attack. In this paper, we first provide some SDN-supported mechanisms against DDoS attack in traditional networks. A systematic review of various SDN-self DDo S threats are then presented as well as the existing literatures on quickly DDoS detection and defense in SDN. Finally, some promising research directions in this field are introduced.
Distributed Denial-of-Service (DDoS) Attacks and Defense Mechanisms in Various Web-Enabled Computing Platforms: Issues, Challenges, and Future Research Directions

Brij B. Gupta,Anshuman Singh

DOI: https://doi.org/10.4018/ijswis.297143

2022-01-01

Abstract:The demand for Internet security has escalated in the last two decades because the rapid proliferation in the number of Internet users has presented attackers with new detrimental opportunities. One of the simple yet powerful attack, lurking around the Internet today, is the Distributed Denial-of-Service (DDoS) attack. The expeditious surge in the collaborative environments, like IoT, cloud computing and SDN, have provided attackers with countless new avenues to benefit from the distributed nature of DDoS attacks. The attackers protect their anonymity by infecting distributed devices and utilizing them to create a bot army to constitute a large-scale attack. Thus, the development of an effective as well as efficient DDoS defense mechanism becomes an immediate goal. In this exposition, we present a DDoS threat analysis along with a few novel ground-breaking defense mechanisms proposed by various researchers for numerous domains. Further, we talk about popular performance metrics that evaluate the defense schemes. In the end, we list prevalent DDoS attack tools and open challenges.

Computer Science,Engineering

Defending Against Denial of Service Attacks

Survey of Network-Based Defense Mechanisms Countering the DoS and DDoS Problems

Defense Technology of DDoS Attacks

Defending against Distributed Denial of Service Attacks: Issues and Challenges

Technical Analysis and Defendable Policy of Distributed Denial of Service Attack

Research on Safeguard Techniques against DoS and DDoS Attacks

Analysis and Defense for Application Layer DDoS Attacks in the Novel Network Environment

Research on Distributed Denial-of-service Attacks:a Survey

A Comprehensive Survey on Ddos Defense Systems: New Trends and Challenges

The Technical Analysis and Security Countermeasure of DoS-based Network Attacks

Research on P2P-based DDoS Attacks and Their Defense Mechanism

Research on Defense System Against DDoS Attacks

A Defense Mechanism for Distributed Denial of Service Attack in Software-Defined Networks

DDoS Attack and Defense: Review of Some Traditional and Current Techniques

Survey of DOS Defense Mechanisms

A Simple DDoS Defense Method Based SDN

Defense study and implementation mechanism of distributed denial of service attack

A Ddos Attack Defending Scheme Based on Network Processor

A DDOS Defence Scheme Based on Two-Stage Traffic Flow Control.

DDoS Attack in Software Defined Networks: A Survey

Distributed Denial-of-Service (DDoS) Attacks and Defense Mechanisms in Various Web-Enabled Computing Platforms: Issues, Challenges, and Future Research Directions