標題: Defending against spoofed DDoS attacks with path fingerprint
作者: Lee, FY
Shieh, S
資訊工程學系
Department of Computer Science
關鍵字: network security;intrusion detection;DDoS;IP spoofing
公開日期: 1-十月-2005
摘要: In this paper, we propose anew scheme, called ANTI D, for detecting and filtering DDoS attacks which use spoofed packets to circumvent the conventional intrusion detection schemes. The proposed anti-DDoS scheme intends to complement, rather than replace conventional schemes. By embedding in each IP packet a unique path fingerprint that represents the route an IP packet has traversed, ANTID is able to distinguish IP packets that traverse different Internet paths. In ANTID, a server maintains for each of its communicating clients the mapping from the client's IP address to the corresponding path fingerprint. The construction and renewal of these mappings is performed in an on-demand fashion that helps to reduce the cost of maintenance. With presence of the mapping table, the onset of a spoofed DDoS attack can be detected by observing a surge of spoofed packets. Consequently, spoofed attack packets are filtered so as to sustain the quality of protected Internet services. ANTID is lightweight, robust, and incrementally deployable. Our experiment results showed that the proposed scheme can detect 99.95% spoofed IP packets and can discard them with little collateral damage to legitimate clients. It also showed that the higher the aggregated attack rate is, the sooner the attack can be detected. (C) 2005 Elsevier Ltd. All rights reserved.
URI: http://dx.doi.org/10.1016/j.cose.2005.03.005
http://hdl.handle.net/11536/13219
ISSN: 0167-4048
DOI: 10.1016/j.cose.2005.03.005
期刊: COMPUTERS & SECURITY
Volume: 24
Issue: 7
起始頁: 571
結束頁: 586
顯示於類別:期刊論文


文件中的檔案:

  1. 000233232400019.pdf

若為 zip 檔案,請下載檔案解壓縮後,用瀏覽器開啟資料夾中的 index.html 瀏覽全文。