A framework for classifying denial of service attacks

By Alefiya Hussain, John S. Heidemann, Christos Papadopoulos. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2003

599 citations recorded by the source corpus.

Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, and novel techniques such as transient ramp-up behavior and spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlying reasons for the characteristics observed. In addition to helping understand attack dynamics, classification mechanisms such as ours are important for the development of realistic models of DoS traffic, can be packaged as an automated tool to aid in rapid response to attacks, and can also be used to estimate the level of DoS activity on the Internet.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/1a45d036bda620342d40eb81948dcbb14f1d5b14

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Survey of network-based defense mechanisms countering the DoS and DDoS problems (2007, background): “Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or direct commercial advantage and that copies show this notice on the .rst page or initial screen of a display…”
A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods (2006, background): “Many attacks start gradually, as illustrated in Section V and described in [13], where the authors analyze the onset features of a large number of real DOS attacks.”
Mining anomalies using traffic feature distributions (2005, background): “Much of the work in anomaly detection and identiﬁcation has been restricted to point-solutions for speciﬁc types of anomalies, e.g. , portscans [14], worms [17,32], DOS attacks [11], and ﬂash crowds [12].”
A taxonomy of DDoS attack and DDoS defense mechanisms (2004, methodology): “Hussain et al. [ 37 ] classify ∞ooding (in our terminology brute-force) DDoS attacks based on number of agent machines performing the attack and whether the attack was re∞ected or not.”
Remote physical device fingerprinting (2005, background): “Hussain et al. [ 17 ] use the power distribution in the Fourier spectrum of autocorrelation functions of binned packet traffic to distinguish between multiple-source and single-source denial-of-service attacks.”
Defense Against Spoofed IP Traffic Using Hop-Count Filtering (2007, background): “… and Kang G. Shin, Fellow, IEEE Abstract IP spoo.ng has often been exploited by Distributed Denial of Service (DDoS) attacks to: 1) conceal .ooding sources and dilute localities in .ooding traf.c, and 2) coax legitimate hosts into becoming re.ectors, redirecting and amplifying .ooding traf.c.”
Characterization of network-wide anomalies in traffic flows (2004, background): “Researchers have characterized Internet intrusion activity [24], failure events in IP networks [17], and also constructed taxonomies for Internet worms [23], denial of service attacks [9] and defenses [18].”
Sizing router buffers (2004, background): “Congestion can also be caused by denial of service (DOS) [31] attacks that attempt to ﬂood hosts or routers with large amounts of network traﬃc.”
Change-point monitoring for the detection of DoS attacks (2004, background): “THE growing number of denial of service (DoS) attacks impose a significant threat on the availability of network services, and the vulnerability of the Internet to DoS attacks has been witnessed by the frequent attacks on Internet servers and their resultant disruption of services [15], [21], [37].”