On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

By Kihong Park, Heejo Lee. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2001

735 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/5cdae78edecac70c1b7a44330b3cc3aa74cb0805

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

A Survey of Man In The Middle Attacks (2016, methodology): “1) Router-Based Solutions: Distributed Packet Filtering (DPF) [122] is a method that ﬁlters packets based on the binding between preﬁx/ﬂow and interface.”
Evolution and Structure of the Internet: Index (2004, background): “However, it turns out that their performance can be very sensitive to topological details (Tangmunarunkit et al., 2002a; Labovitz, Ahuja, Wattenhofer, and Srinivasan, 2001; Park and Lee, 2001).”
SAVE: source address validity enforcement protocol (2002, methodology): “However, research h as s hown that unless ingress filtering is deployed almost everywhere, nearly arbitrary forgery is s till possible [ 17 ].”
Accountable internet protocol (aip) (2008, background): “Installing these filters in the middle of the network is fundamentally difficult [9, 32].”
The internet AS-level topology: three data sources and one definitive metric (2005, background): “smaller, which is important for applications such as traffic monitoring [24] and prevention of DoS attack [25].”
Power laws and the AS-level internet topology (2003, background): “There may be more topological properties of the Internet topology that are not captured by our power laws [45], [54].”
Defending against flooding-based distributed denial-of-service attacks: a tutorial (2002, methodology): “The route-based packet filtering (RPF) approach, proposed by Park and Lee, essentially extends the ingress packet filtering function to the Internet core [12].”
Survey of network-based defense mechanisms countering the DoS and DDoS problems (2007, background): “Simulation results show that a signi.cant fraction of spoofed IP addresses can be .ltered if RPF is implemented in at least 18% of ASs in the Internet [Park and Lee 2001b].”
Defense Against Spoofed IP Traffic Using Hop-Count Filtering (2007, background): “As a proactive solution to DDoS attacks, these filtering schemes [15], [29], [36], [55], which must execute”
Detecting SYN flooding attacks (2002, background): “Given the reachability constraints imposed by routing and network topology, route-based distributed packet filtering (DPF) [22] exploits routing information to determine if a packet arriving at the router is valid with respect to its inscribed source/destination addresses.”
Measuring ISP topologies with Rocketfuel (2004, background): “Topology influences the dynamics of routing protocols [3], [11], the scalability of multicast [19], the efficacy of denial-of-service tracing and response [12], [18], [23], [24], and other aspects of protocol performance [20].”
Hop-count filtering: an effective defense against spoofed DDoS traffic (2003, background): “As a proactive solution to DDoS attacks, these filtering schemes [15, 25, 31, 45], which must execute on IP routers or r ely on routers’ markings, have been proposed to prevent spoofed IP packets from reaching intended victims.”
SIFF: a stateless Internet flow filter to mitigate DDoS flooding attacks (2004, background): “Park and Lee propose a distributed packet filtering (DPF) mechanism against IP address spoofing [32].”