Our proposed scheme seeks to defend flooding distributed denial-of-service (DDoS) attacks in the Internet. An easy, yet very disruptive, way to cause unfairness to the legitimate users is to deplete the network bandwidth by sending high rate unresponsive flows from multiple sources. The network congestion created by such malicious flows causes most legitimate packets to be dropped at routers without reaching their destinations. Congestion control in IP networks is typically done at each router through queue management, and the network is entirely dependent on the end hosts to react to congestion. However, when the network is under attacks which use packet floods, existing queue management algorithms reveal significant shortcomings in protecting legitimate flows. In this paper, we propose a novel scheme for congestion control in IP networks to defend against DDoS attacks. Our approach is a time-window based filtering mechanism, processed before a queue management policy is applied. Setting the window size properly, and dropping packets reaching into the next window, can catch the non-responsive nature of misbehaving flows. The performance of our proposed scheme is demonstrated through extensive simulations with the NS2 simulator, using a set of simulated traffic generated based on IP traces reported in http://www.nlnar.org.


    Access

    Check access

    Check availability in my library

    Order at Subito €


    Export, share and cite



    Title :

    Packet filtering to defend flooding-based DDoS attacks [Internet denial-of-service attacks]


    Contributors:


    Publication date :

    2004-01-01


    Size :

    444688 byte




    Type of media :

    Conference paper


    Type of material :

    Electronic Resource


    Language :

    English



    Assessing and quantifying denial of service attacks

    Gregg, D.M. / Blackert, W.J. / Heinbuch, D.V. et al. | Tema Archive | 2001


    Payment processers face denial of service attacks

    British Library Online Contents | 2005


    Denial-of-Service Attacks on C-V2X Networks

    Trkulja, Natasa / Starobinski, David / Berry, Randall A. | TIBKAT | 2021



    Automatic Detection and Mitigation of Denial-of-Service Attacks

    PEPIN FRANCOIS / HARDER ANDRE LLOYD PERLEE / JOSHI PRAJAKTA et al. | European Patent Office | 2022

    Free access