Near-Optimal Defense Strategies against DDoS Attacks Based upon Packet Filtering and Blocking Enabled by Packet Marking
نویسندگان
چکیده
In the paper, the DDoS scenario is modelled as a mathematical programming problem. The defender strategically utilizes the limited resources to maximize the legitimate traffic, and he can adopt packet marking to observe the network status. The information extracts from the marking field can help the defender develop a defense strategy which combines packet filtering and packet blocking. A Lagrangean relaxation-based algorithm is proposed to optimally solve the problem.
منابع مشابه
StackPi : a new defense mechanism against IP spoofing and DDoS attacks
Today's Internet hosts are threatened by IP spoofing attacks and large scale Distributed Denial-of-Service (DDoS) attacks. We propose a new defense mechanism, StackPi, which unlike previous approaches, allows the host being attacked, or its upstream ISP, to filter out attack packets and to detect spoofed source IP addresses, on a per-packet basis. In StackPi, a packet is marked deterministicall...
متن کاملPi: A Path Identification Mechanism to Defend Against DDoS Attacks
Distributed Denial of Service (DDoS) attacks continue to plague the Internet. Defense against these attacks is complicated by spoofed source IP addresses, which make it difficult to determine a packet’s true origin. We propose Pi (short for Path Identifier), a new packet marking approach in which a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the...
متن کاملResistance against Distributed Denial of Service Attacks (DDoS) Using Bandwidth Based Admission Control
Internet hosts are threatened by large-scale Distributed Denial ofService (DDoS) attacks. The Path Identification DDoS defense scheme has recently been proposed as a deterministic packet marking scheme that allows a DDoS victim to filter out attack packets on a per packet basis with high accuracy after only a few attack packets are received. The previous work suggested depicts the Stack Path id...
متن کاملResistance against Distributed Denial of Service Attacks (DDoS) Using Bandwidth Based Admission Control
Internet hosts are threatened by large-scale Distributed Denial ofService (DDoS) attacks. The Path Identification DDoS defense scheme has recently been proposed as a deterministic packet marking scheme that allows a DDoS victim to filter out attack packets on a per packet basis with high accuracy after only a few attack packets are received. The previous work suggested depicts the Stack Path id...
متن کاملPi: A Path Identification Mechanism to Defend against DDoS Attack
Distributed Denial of Service (DDoS) attacks continue to plague the Internet. Defense against these attacks is complicated by spoofed source IP addresses, which make it difficult to determine a packet’s true origin. We propose Pi (short for Path Identifier), a new packet marking approach in which a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the...
متن کامل