Finding DDoS attack sources: Searchlight localization algorithm for network tomography

Among the challenges facing the Internet, DoS/DDoS are a critical concern for Internet Service Providers. DDoS attacks can cause country-wide infrastructure problems, and can disrupt communications on a national level. Frequently, Botnets are used to carry out source-spoofed DDoS attacks. The proble...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:2011 7th International Wireless Communications and Mobile Computing Conference S. 418 - 423
Hauptverfasser: Demir, Omer, Khan, Bilal
Format: Tagungsbericht
Sprache:Englisch
Veröffentlicht: IEEE 01.07.2011
Schlagworte:
Computer crime
Computer hacking
DDoS
Electronic mail
Internet
Investments
Routing
Silicon
source localization
source spoofing
ISBN:9781424495399, 1424495393
ISSN:2376-6492
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:Among the challenges facing the Internet, DoS/DDoS are a critical concern for Internet Service Providers. DDoS attacks can cause country-wide infrastructure problems, and can disrupt communications on a national level. Frequently, Botnets are used to carry out source-spoofed DDoS attacks. The problem of tracing such attacks has been the subject of significant inquiry. Here, we leverage the fact that a Botnet requires significant exposure to risk, and investments of time and resources. Thus, as a capital resource, it is likely that a Botnet will, over its lifespan, be used to execute multiple criminal DDoS attacks on different targets. Here, we report on new techniques that leverage information obtained over sequences of source spoofed Botnet led DDoS attacks, demonstrating the efficacy of these techniques at pinpointing potential attacker locations. DDoS attack flow descriptions can be collected in many ways, using a coordinated DDoS sensor agents (e.g. as described by the authors previously in). Here, as a theoretical contribution, we provide formal statement of the attacker localization problem. We develop an new algorithm for localizing attack sources from sequences of DDoS attacks.
ISBN:9781424495399
1424495393
ISSN:2376-6492
DOI:10.1109/IWCMC.2011.5982570