NetShield: Protocol Anomaly Detection with Datamining Against DDoS Attacks

This article presents a new defense system to protect network servers, network routers, and client hosts from becoming the handlers, Zombies, and victims of distributed denial-of-service (DDoS) flood attacks. The NetShield system was developed at USC to protect any IP-based public network over the Internet. We explore preventive and deterrent controls to remove system vulnerabilities on target machines. Adaptation techniques are suggested to launch protocol anomaly detection and corrective intrusion responses. In particular, we propose a new datamining approach to detect protocol anomaly against DDoS flooding attacks. Suggestions are made to enforce dynamic security policies on the NetShield security system. At present, the NetShield is specially tailored for protecting network resources against DDoS flood attacks. Some analytical results on the detection performance are reported. Open research issues are identified for further work.