3 research outputs found
Detecting DDoS Attacks in Stub Domains
DoS attacks have least impact when mitigated close to
the attacks' source. This is more important for Distributed DoS
(DDoS) attacks since they are difficult to road Hudson, NH zipmitigate at the victim
without affecting service to legitimate flows. This is a challenging
task since DDoS attack traffic may have relatively low flow rates
and attack packets are indistinguishable from legitimate packets.
Current source-end detection schemes such as MULTOPS and D-WARD are
centralized and hence, are not easily deployable in multi-gateway
stub networks with asymmetric traffic.
We present a scalable, distributed DDoS detection system that can be
deployed in single- as well as multi-homed stub networks to detect
DDoS attacks using TCP packets. The detection system can detect attacks
with very low flow rates and in multi-gateway networks, even with
significant asymmetric TCP flows. We evaluate the performance of our
detection system using extensive packet level simulations under
different attack scenarios. Our results show that with relatively less
node state and processing, in networks with symmetric flows, our system
can accurately detect attack flows that are one-third the intensity of
an average flow in the network. In the case of multi-gateway networks,
the detection system can detect all attacks for all rates of asymmetry
when the attack rate is at least five times the average flow rate in
the network.
We extend the system to detect attacks aimed at multiple hosts in a
subnet instead of a single host. Subnet attacks seem more diffused
for detection schemes designed to detect host attacks. Hence, it is
harder for these schemes to detect these attacks. Our subnet attack
detection scheme can detect attacks that target hosts in large subnets
(/21) and in the presence of non-attack traffic to other hosts in the
subnet.
Our packet level simulations show that, in single gateway networks,
our scheme can detect attacks with an aggregate flow intensity
equal to an average flow in the network in less than a minute.
Using these simulations, we also show that our scheme detects attacks in
networks with up to four gateways and when up to 50\% of the flows are asymmetric
Measurement Based Optimal Multi-path Routing
We propose a new architecture for efficient network monitoring and measurements in a traditional IP network. This new architecture enables establishment of multiple paths (tunnels) between source-destination pairs without having to modify the underlying routing protocol(s). Based on the proposed architecture we propose a measurement-based multi-path routing algorithm derived from simultaneous perturbation stochastic approximation. The proposed algorithm does not assume that the gradient of analytical cost function is known to the algorithm, but rather relies on noisy estimates from measurements. Using the analytical model presented in the paper we prove the convergence of the algorithm to the optimal solution. Simulation results are presented to demonstrate the advantages of the proposed algorithm under a variety of network scenarios. A comparative study with an existing optimal routing algorithm, MATE, is also provided