Finding DDoS attack sources: Searchlight localization algorithm for network tomography

Among the challenges facing the Internet, DoS/DDoS are a critical concern for Internet Service Providers. DDoS attacks can cause country-wide infrastructure problems, and can disrupt communications on a national level. Frequently, Botnets are used to carry out source-spoofed DDoS attacks. The proble...

Celý popis

Uloženo v:
Podrobná bibliografie
Vydáno v:2011 7th International Wireless Communications and Mobile Computing Conference s. 418 - 423
Hlavní autoři: Demir, Omer, Khan, Bilal
Médium: Konferenční příspěvek
Jazyk:angličtina
Vydáno: IEEE 01.07.2011
Témata:
Computer crime
Computer hacking
DDoS
Electronic mail
Internet
Investments
Routing
Silicon
source localization
source spoofing
ISBN:9781424495399, 1424495393
ISSN:2376-6492
On-line přístup:Získat plný text
Tagy: Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
Popis
Shrnutí:Among the challenges facing the Internet, DoS/DDoS are a critical concern for Internet Service Providers. DDoS attacks can cause country-wide infrastructure problems, and can disrupt communications on a national level. Frequently, Botnets are used to carry out source-spoofed DDoS attacks. The problem of tracing such attacks has been the subject of significant inquiry. Here, we leverage the fact that a Botnet requires significant exposure to risk, and investments of time and resources. Thus, as a capital resource, it is likely that a Botnet will, over its lifespan, be used to execute multiple criminal DDoS attacks on different targets. Here, we report on new techniques that leverage information obtained over sequences of source spoofed Botnet led DDoS attacks, demonstrating the efficacy of these techniques at pinpointing potential attacker locations. DDoS attack flow descriptions can be collected in many ways, using a coordinated DDoS sensor agents (e.g. as described by the authors previously in). Here, as a theoretical contribution, we provide formal statement of the attacker localization problem. We develop an new algorithm for localizing attack sources from sequences of DDoS attacks.
ISBN:9781424495399
1424495393
ISSN:2376-6492
DOI:10.1109/IWCMC.2011.5982570