Abstract:DDoS attacks aim to exhaust the resources of victims, such as network bandwidth, computing power and operating system data structures. Early DDoS attacks emerged around the year 2000, and well-known web sites, such as CNN, Amazon and Yahoo, have been the targets of hackers since then. The purpose of early attacks was mainly for fun and curiosity about the technique. However, recently we have witnessed an explosive increase in cyber attacks due to the huge financial or political rewards available to cyber attackers [1]. Botnets are the engines behind major DDoS attacks. Hackers exploit the vulnerability of computers connected to the Internet, and establish an overlay network of compromised computers to commit malicious activities, such as DDoS attacks or information phishing. This kind of malicious network is what we call a botnet [2], [3]. A DDoS attack can be carried out in various forms, such as flooding packets or synchronization attacks [2]. Flooding packets is the most common and effective DDoS attack strategy amongst all the available attack weapons. It is critical for defenders to understand the size of botnets, which helps us to estimate the possible attack volume. There has been plenty of work completed on this issue, such as [1] and [4]. Rajab et al. [5] found the number of active bots a botmaster could manipulate was usually at the hundreds or a few thousands level. This means the resources a botnet owner can use is limited. Based on this fact, Yu et al. [6] proposed a similarity based DDoS detection method to beat flash crowd mimicking attacks. Traditionally, a potential victim would be vulnerable if they were left to deal with a DDoS flooding attack by themselves. As nature of the Internet is anarchical, potential victims, such as popular web sites, are usually left

Threat Assessment of DDoS Attacks based on Rough Set Algorithm

Detection of low-rate DDoS attack based on self-similarity

Quantitative Threat Assessment of Denial of Service Attacks on Service Availability

Network Intrusion Detection Method Based on Rough Set Theory

Risk Assessment and Defense Resource Allocation of Cyber-Physical Distribution Systems under Denial-of-Service Attacks

A Method Based on AMHI for DDoS Attacks Detection and Defense

DDoS detection and analysis system based on comprehensive scoring

On Improving An Algebraic Marking Scheme For Detecting Ddos Attacks

Group Testing Based Detection of Web Service DDoS Attackers.

Detecting DDoS Attacks Based on Network Connection Statistics

DDoS Attack Defense in Big Data-oriented Urban Rail Transit Safety Evaluation System

DDoS flood attack detection based on fractal parameters

Method Research for Defending Against Distributed Denial-of-Service Attacks Based on Dynamic Game Theory

Security Evaluation Method Based on Real Time Traffic of Hosts

Can We Beat DDoS Attacks in Clouds ? ( Supplementary Material )

A New Multistage Approach to Detect Subtle DDoS Attacks.

A Detection Model for Distributed Denial of Service Attacks Based on Network Connection Analysis

On the Performance Evaluation of Congestion Control Algorithms Against DDoS Attacks.

Low-rate DDoS attacks detection method using data compression and behavior divergence measurement

DDoS Attack Detection Method Based on Network Abnormal Behavior in Big Data Environment

An Online Entropy-based DDoS Flooding Attack Detection System with Dynamic Threshold