An analysis of using reflectors for distributed denial-of-service attacks

By Vern Paxson. CCRV, 2001

518 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/f32ee72f4674bca71464f5fca2b2edc3e0cd6926

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Netalyzr: illuminating the edge network (2010, background): “, for queries coming from external sources), enabling amplification attacks [19] and other mischief.”
SIFF: a stateless Internet flow filter to mitigate DDoS flooding attacks (2004, background): “For this reason, DDoS attackers are not concerned with spoofing as a disguising tactic; they merely use it to bypass potential IP address filters or to involve unwitting third parties in the attack as traffic amplifiers [34].”
Change-point monitoring for the detection of DoS attacks (2004, background): “it cannot detect the reflected flooding attacks [42] easily since malicious packets are diffused before reaching the core router.”
DDoS attacks and defense mechanisms: classification and state-of-the-art (2004, background): “The intermediary nodes that are used as attack launchers in amplification attacks are called reflectors [33].”
A taxonomy of DDoS attack and DDoS defense mechanisms (2004, background): “Attacks with indirect communication deploy a level of indi-rection to increase the survivability of a DDoS network.”
Pi: a path identification mechanism to defend against DDoS attacks (2003, background): “In a particular type of DDoS attack, known as a reflector attack [24], attackers send request packets to various services whose responses are of far larger size than the requests themselves (eg.”
Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds (2005, background): “, SYN flood [40], the Smurf attack [14], reflector attacks [38]), and presents detection techniques, or proposes specific countermeasures.”
Survey of network-based defense mechanisms countering the DoS and DDoS problems (2007, background): “However, during a highly distributed denial of service attack (e.g., re.ector attacks [Paxson 2001]), the attack traf.c comes from a large number of links.”
A survey of coordinated attacks and collaborative intrusion detection (2010, background): “In this case, each reflector will see the same spoofed source IP address in the incoming SYN packets (Paxson, 2001).”
Controlling high bandwidth aggregates in the network (2002, background): “Consider, for example, a reflector attack [23] based on DNS [5].”
Distributed Denial of Service: Taxonomies of Attacks, Tools, and Countermeasures (2004, methodology): “To help identify the attackers, packet traceback techniques are proposed [ 23 ] . The concept involves tracing Internet traffic back to it’s source (rather than that of a spoofed source IP address).”
Amplification Hell: Revisiting Network Protocols for DDoS Abuse (2014, background): “Closest to our work, Paxson analyzed the possibility for DRDoS attacks in 2001 [24].”
Defending against flooding-based distributed denial-of-service attacks: a tutorial (2002, methodology): “Paxson has also analyzed the vulnerability of Gnutella and T/TCP protocols in a reflector attack [6].”
Hop-count filtering: an effective defense against spoofed DDoS traffic (2003, background): “Moreover, some known DDoS attacks, such as smurf [8] and more recent DRDoS (Distributed Reflection Denial of Service) attacks [19], [33], are not possible without IP spoofing.”
Single-packet IP traceback (2002, background): “(A large number ofreflector attacks utilize such transforms to hide their source [6].”