On the Spectral Analysis of Backscatter Data

In this paper we explore the use of spectral analysis techniques applied to artifacts of denial of service attacks called backscatter packets. First, we detail how to partition backscatter data collected by a network sensor into logical attacks. Since backscatter packets are the result of spoofed packets sent to the target by the attacker, determining attack boundaries is an important first step in inferring denial of service activity. Next, we outline a method by which these disparate attacks can be compared using spectral analysis techniques. Denial of service attacks vary in size and duration, and so being able to compare structures across these ranges is important. Finally, we explore some interesting structures found in the attacks, which may indicate multiple attacker activity and/or location clusterings. These techniques and findings serve as a fruitful approach for gaining insight into denial of service activity using only collected backscatter packets from a thirdparty site not associated with the target or attacker.