A Framework for Classifying Denial of Service Attacks-extended. Hussain, A., Heidemann, J., & Papadopoulos, C. Technical Report ISI-TR-2003-569b, USC/Information Sciences Institute, June, 2003. (Original TR, February 2003, updated June 2003)
A Framework for Classifying Denial of Service Attacks-extended [link]Paper  abstract   bibtex   
Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, transient ramp-up behavior and novel techniques such as spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlying reasons for the characteristics observed. In addition to helping understand attack dynamics, classification mechanisms such as ours are important for the development of realistic models of DoS traffic, can be packaged as an automated tool to aid in rapid response to attacks, and can also be used to estimate the level of DoS activity on the Internet.
@TechReport{Hussain03a,
	author = 	"Alefiya Hussain and John Heidemann and Christos Papadopoulos",
	title = 	"A Framework for Classifying Denial of Service Attacks-extended",
	institution = 	"USC/Information Sciences Institute",
	year = 		2003,
	sortdate = 		"2003-06-01",
	project = "ant, saman, conser, cossack",
	jsubject = "network_security",
	number =	"ISI-TR-2003-569b",
	month =		jun,
	note = "(Original TR, February 2003, updated June 2003)",
	jlocation =	"johnh: folder: xxx",
	jlocation =	"johnh: pafile",
	keywords =	"ddos classification, spectral analysis",
	otherurl =	"ftp://ftp.isi.edu/isi-pubs/tr-569.pdf",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03a.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03a.pdf",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
	abstract = "
Launching a denial of service (DoS) attack is trivial, but detection
and response is a painfully slow and often a manual process.
Automatic classification of attacks as single- or multi-source can
help focus a response, but current packet-header-based approaches are
susceptible to spoofing. This paper introduces a framework for
classifying DoS attacks based on header content, transient ramp-up
behavior and novel techniques such as spectral analysis. Although
headers are easily forged, we show that characteristics of attack
ramp-up and attack spectrum are more difficult to spoof. To evaluate
our framework we monitored access links of a regional ISP detecting 80
live attacks. Header analysis identified the number of attackers in 67
attacks, while the remaining 13 attacks were classified based on
ramp-up and spectral analysis. We validate our results through
monitoring at a second site, controlled experiments, and
simulation. We use experiments and simulation to understand the
underlying reasons for the characteristics observed. In addition to
helping understand attack dynamics, classification mechanisms such as
ours are important for the development of realistic models of DoS
traffic, can be packaged as an automated tool to aid in rapid response
to attacks, and can also be used to estimate the level of DoS activity
on the Internet.
",
}

Downloads: 0