This article presents a survey of denial of service attacks and the methods that have been proposed for defense against these attacks. In this survey, we analyze the design decisions in the Internet that have created the potential for denial of service attacks. We review the state-of-art mechanisms for defending against denial of service attacks, compare the strengths and weaknesses of each proposal, and discuss potential countermeasures against each defense mechanism. We conclude by highlighting opportunities for an integrated solution to solve the problem of distributed denial of service attacks.

/pdf/survey-of-network-based-defense-mechanisms-countering-the-4arcuz8045.pdf

Survey of network-based defense mechanisms countering the DoS and DDoS problems

Computational grids have not scaled effectively due to administrative hurdles to resource and user participation. Most production grids are essentially multi-site supercomputer centers, rather than truly open and heterogeneous sets of resources that can join and leave dynamically, and that can provide support for an equally dynamic set of users. Large-scale grids containing individual resources with more autonomy about when and how they join and leave will require self-organizing grid middleware services that do not require centralized administrative control. This paper considers one such service, namely the dynamic discovery of high-performance variable-size clusters of grid nodes. A brute force approach to the problem of identifying these "ad-hoc clusters" would require excessive overhead in terms of both message exchange and computation. Therefore, we propose a scalable solution that uses a delay-based overlay structure to organize nodes based on their proximity to one another, using a small number of delay experiments. This overlay can then be used to provide a variable-size set of promising candidate nodes than can then be used as a cluster, or tested further to improve the selection. Simulation results show that this approach results in effective clustering with acceptable overhead.

/pdf/automatic-clustering-for-self-organizing-grids-1sf0g2xhfx.pdf

Automatic Clustering for Self-Organizing Grids

developments in this area in recent years. In this article, we present an in-depth study of the denial of service problem in the Internet, and provide a comprehensive survey of attacks and their countermeasures. We investigate various DoS attack mechanisms, derive a more practical taxonomy of attack mechanisms, and summarize the challenges in DoS defense. We critically review the state of the art in DoS defense, analyze the strengths and weaknesses of dierent proposals, and conclude a comprehensive taxonomy of various defense mechanisms.

/pdf/internet-denial-of-service-attacks-and-defense-mechanisms-34y7xkbh4q.pdf

Internet Denial of Service Attacks and Defense Mechanisms

This study proposed a method which can detect large-scale attacks, such as DoS attacks, in real-time by weighted KNN classifiers. The key factor for designing an anomaly-based NIDS is to select significant features for making decisions. Not only is excellent detection performance required, but real-time processing is also demanded for most NIDSs. A good feature selection policy, which can choose significant and as few as possible features, plays a key role for any successful NIDS. The study proposed a genetic algorithm combined with KNN (k-nearest-neighbor) for feature selection and weighting. All initial 35 features in the training phase were weighted, and the top ones were selected to implement NIDSs for testing. Many DoS attacks were applied to evaluate the systems. For known attacks, an overall accuracy rate as high as 97.42% was obtained, while only the top 19 features were considered. For unknown attacks, an overall accuracy rate of 78% was obtained using the top 28 features.

Real-time anomaly detection systems for Denial-of-Service attacks by weighted k-nearest-neighbor classifiers

Methods and apparatus for dynamically adjusting capacity allocation; e.g., to a group of services in a multimedia distribution network. In one embodiment, bandwidth allocation is adjusted by predicting bandwidth utilization of the group of services based on historical bandwidth utilization information. Behavioral templates and statistical models may also be employed for the predictions. The invention provides more efficient use of available bandwidth compared to conventional bandwidth allocation schemes where the overall bandwidth for a group of services is set to a constant value that is not changed frequently. The present invention further provides a bandwidth allocation method in a switched distribution network. The bandwidth allocation method allocates bandwidth such that the bandwidth required by the number of services does not exceed the allocation, i.e., the total usage falls within the allocation.

Methods and apparatus for predictive capacity allocation

This paper describes an approach to detecting distributed denial of service (DDoS) attacks that is based on fundamentals of Information Theory, specifically Kolmogorov Complexity. A theorem derived using principles of Kolmogorov Complexity states that the joint complexity measure of random strings is lower than the sum of the complexities of the individual strings when the strings exhibit some correlation. Furthermore, the joint complexity measure varies inversely with the amount of correlation. We propose a distributed active network-based algorithm that exploits this property to correlate arbitrary traffic flows in the network to detect possible denial-of-service attacks. One of the strengths of this algorithm is that it does not require special filtering rules and hence it can be used to detect any type of DDoS attack. We implement and investigate the performance of the algorithm in an active network. Our results show that DDoS attacks can be detected in a manner that is not sensitive to legitimate background traffic.

Detecting Distributed Denial-of-Service Attacks Using Kolmogorov Complexity Metrics

Active network technology envisions deployment of virtual execution environments within network elements, such as switches and routers. As a result, inhomogeneous processing can be applied to network traffic. To use such technology safely and efficiently, individual nodes must provide mechanisms to enforce resource limits. This implies that each node must understand the varying resource requirements for specific network traffic. This paper presents an approach to model the CPU time requirements of active applications in a form that can be interpreted among heterogeneous nodes. Further, the paper demonstrates how this approach can be used successfully to control resources consumed at an active-network node and to predict load among nodes in an active network, when integrated within the Active Virtual Network Management Prediction system.

Predicting and controlling resource usage in a heterogeneous active network

From the Publisher:
Active networking is an exciting new paradigm in digital networking that has the potential to revolutionize the manner in which communication takes place. It is an emerging technology, one in which new ideas are constantly being formulated and new topics of research are springing up even as this book is being written. This technology is very likely to appeal to a broad spectrum of users from academia and industry. Therefore, this book was written in a way that enables all these groups to understand the impact of active networking in their sphere of interest. Information services managers, network administrators, and e-commerce developers would like to know the potential benefits of the new technology to their businesses, networks, and applications. The book introduces the basic active networking paradigm and its potential impacts on the future of information handling in general and on communications in particular. This is useful for forward-looking businesses that wish to actively participate in the development of active networks and ensure a head start in the integration of the technology in their future products, be they applications or networks. Areas in which active networking is likely to make significant impact are identified, and the reader is pointed to any related ongoing research efforts in the area.

Active Networks and Active Network Management: A Proactive Management Framework

A system operates a wireless ad hoc network. The system includes a plurality of nodes and a plurality of packets for transmission between the plurality of nodes. The packets contain code for routing the packets between the plurality of nodes. The code adapts to a changing configuration of the plurality of nodes.

System for a dynamic ad-hoc wireless network

A system clusters nodes of a network of a plurality of nodes. The system includes: a receiver for obtaining information about a local neighborhood around a first node of the plurality of nodes, the first node having a first clusterhead node; a compiler for generating a list of clusterhead nodes; a recorder for recording weights of the clusterhead nodes of the list; a processor for computing a differential weight for the clusterhead nodes of the list; a comparator for comparing each of the differential weights with a predetermined affinity threshold; and a determinator for determining whether the first node replaces the first clusterhead node with a new clusterhead node or the first node becomes a clusterhead node.

Amit Bhavanishankar Kulkarni

Papers

Detecting Distributed Denial-of-Service Attacks Using Kolmogorov Complexity Metrics

Predicting and controlling resource usage in a heterogeneous active network

Active Networks and Active Network Management: A Proactive Management Framework

System for a dynamic ad-hoc wireless network

System for creating optimally-sized clusters