Detecting DDoS Attacks in Stub Domains

DoS attacks have least impact when mitigated close to the attacks' source. This is more important for Distributed DoS (DDoS) attacks since they are difficult to road Hudson, NH zipmitigate at the victim without affecting service to legitimate flows. This is a challenging task since DDoS attack traffic may have relatively low flow rates and attack packets are indistinguishable from legitimate packets. Current source-end detection schemes such as MULTOPS and D-WARD are centralized and hence, are not easily deployable in multi-gateway stub networks with asymmetric traffic. We present a scalable, distributed DDoS detection system that can be deployed in single- as well as multi-homed stub networks to detect DDoS attacks using TCP packets. The detection system can detect attacks with very low flow rates and in multi-gateway networks, even with significant asymmetric TCP flows. We evaluate the performance of our detection system using extensive packet level simulations under different attack scenarios. Our results show that with relatively less node state and processing, in networks with symmetric flows, our system can accurately detect attack flows that are one-third the intensity of an average flow in the network. In the case of multi-gateway networks, the detection system can detect all attacks for all rates of asymmetry when the attack rate is at least five times the average flow rate in the network. We extend the system to detect attacks aimed at multiple hosts in a subnet instead of a single host. Subnet attacks seem more diffused for detection schemes designed to detect host attacks. Hence, it is harder for these schemes to detect these attacks. Our subnet attack detection scheme can detect attacks that target hosts in large subnets (/21) and in the presence of non-attack traffic to other hosts in the subnet. Our packet level simulations show that, in single gateway networks, our scheme can detect attacks with an aggregate flow intensity equal to an average flow in the network in less than a minute. Using these simulations, we also show that our scheme detects attacks in networks with up to four gateways and when up to 50\% of the flows are asymmetric

Measurement Based Optimal Multi-path Routing

We propose a new architecture for efficient network monitoring and measurements in a traditional IP network. This new architecture enables establishment of multiple paths (tunnels) between source-destination pairs without having to modify the underlying routing protocol(s). Based on the proposed architecture we propose a measurement-based multi-path routing algorithm derived from simultaneous perturbation stochastic approximation. The proposed algorithm does not assume that the gradient of analytical cost function is known to the algorithm, but rather relies on noisy estimates from measurements. Using the analytical model presented in the paper we prove the convergence of the algorithm to the optimal solution. Simulation results are presented to demonstrate the advantages of the proposed algorithm under a variety of network scenarios. A comparative study with an existing optimal routing algorithm, MATE, is also provided