Identification of Repeated DoS Attacks using Network Traffic Forensics. Hussain, A., Heidemann, J., & Papadopoulos, C. Technical Report ISI-TR-2003-577b, USC/Information Sciences Institute, August, 2003. Originally released August 2003, updated June 2004![Identification of Repeated DoS Attacks using Network Traffic Forensics [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper abstract bibtex Denial-of-service attacks on the Internet today are often launched from zombies, multiple compromised machines controlled by an attacker. Attackers often take control of a number of zombies and then repeatedly use this army to attack a target several times, or to attack several targets. In this paper, we propose a method to identify repeated attack scenarios, that is, the combination of a particular set of hosts and attack tool. Such identification would help a victim coordinate response to an attack, and ideally would be a useful part of legal actions. Because packet contents can be forged by the attacker, we identify an attack scenario by spectral analysis of the arrival stream of attack traffic. The attack spectrum is derived from the characteristics of the attack machines and can therefore be obscured only by reducing attack effectiveness. We designed a multi-dimensional maximum-likelihood classifier to identify repeated attack scenarios. To validate this procedure we apply our approach on real-world attacks captured at a regional ISP, identifying similar attacks first by header contents (when possible) and comparing these results to our process. We conduct controlled experiments to identify and isolate factors that affect the attack fingerprint.
@TechReport{Hussain03c,
author = "Alefiya Hussain and John Heidemann and Christos Papadopoulos",
title = "Identification of Repeated DoS Attacks using
Network Traffic Forensics",
institution = "USC/Information Sciences Institute",
year = 2003,
sortdate = "2003-08-01",
project = "ant, nocredit, saman, conser, cossack",
jsubject = "network_security",
number = "ISI-TR-2003-577b",
note = "Originally released August 2003, updated June 2004",
month = aug,
jlocation = "johnh: folder: xxx",
jlocation = "johnh: pafile",
keywords = "network forensics, network traffic
fingerprinting, spectral analysis, DDoS",
otherurl = "https://ant.isi.edu/%7ehussain/pubs/Hussain03c.pdf",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.pdf",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "authors",
abstract = "
Denial-of-service attacks on the Internet today are often launched
from zombies, multiple compromised machines controlled by an
attacker. Attackers often take control of a number of zombies and then
repeatedly use this army to attack a target several times, or to
attack several targets. In this paper, we propose a method to identify
repeated attack scenarios, that is, the combination of a particular
set of hosts and attack tool. Such identification would help a victim
coordinate response to an attack, and ideally would be a useful part
of legal actions. Because packet contents can be forged by the
attacker, we identify an attack scenario by spectral analysis of the
arrival stream of attack traffic. The attack spectrum is derived from
the characteristics of the attack machines and can therefore be
obscured only by reducing attack effectiveness. We designed a
multi-dimensional maximum-likelihood classifier to identify repeated
attack scenarios. To validate this procedure we apply our approach on
real-world attacks captured at a regional ISP, identifying similar
attacks first by header contents (when possible) and comparing these
results to our process. We conduct controlled experiments to identify
and isolate factors that affect the attack fingerprint.
",
}
Downloads: 0
{"_id":"2fmoD6nL5jRD4HbNR","bibbaseid":"hussain-heidemann-papadopoulos-identificationofrepeateddosattacksusingnetworktrafficforensics-2003","author_short":["Hussain, A.","Heidemann, J.","Papadopoulos, C."],"bibdata":{"bibtype":"techreport","type":"techreport","author":[{"firstnames":["Alefiya"],"propositions":[],"lastnames":["Hussain"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]},{"firstnames":["Christos"],"propositions":[],"lastnames":["Papadopoulos"],"suffixes":[]}],"title":"Identification of Repeated DoS Attacks using Network Traffic Forensics","institution":"USC/Information Sciences Institute","year":"2003","sortdate":"2003-08-01","project":"ant, nocredit, saman, conser, cossack","jsubject":"network_security","number":"ISI-TR-2003-577b","note":"Originally released August 2003, updated June 2004","month":"August","jlocation":"johnh: pafile","keywords":"network forensics, network traffic fingerprinting, spectral analysis, DDoS","otherurl":"https://ant.isi.edu/%7ehussain/pubs/Hussain03c.pdf","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.pdf","myorganization":"USC/Information Sciences Institute","copyrightholder":"authors","abstract":"Denial-of-service attacks on the Internet today are often launched from zombies, multiple compromised machines controlled by an attacker. Attackers often take control of a number of zombies and then repeatedly use this army to attack a target several times, or to attack several targets. In this paper, we propose a method to identify repeated attack scenarios, that is, the combination of a particular set of hosts and attack tool. Such identification would help a victim coordinate response to an attack, and ideally would be a useful part of legal actions. Because packet contents can be forged by the attacker, we identify an attack scenario by spectral analysis of the arrival stream of attack traffic. The attack spectrum is derived from the characteristics of the attack machines and can therefore be obscured only by reducing attack effectiveness. We designed a multi-dimensional maximum-likelihood classifier to identify repeated attack scenarios. To validate this procedure we apply our approach on real-world attacks captured at a regional ISP, identifying similar attacks first by header contents (when possible) and comparing these results to our process. We conduct controlled experiments to identify and isolate factors that affect the attack fingerprint. ","bibtex":"@TechReport{Hussain03c,\n\tauthor = \t\"Alefiya Hussain and John Heidemann and Christos Papadopoulos\",\n\ttitle = \t\"Identification of Repeated DoS Attacks using\n Network Traffic Forensics\",\n\tinstitution = \t\"USC/Information Sciences Institute\",\n\tyear = \t\t2003,\n\tsortdate = \t\t\"2003-08-01\", \n\tproject = \"ant, nocredit, saman, conser, cossack\",\n\tjsubject = \"network_security\",\n\tnumber =\t\"ISI-TR-2003-577b\",\n\tnote = \"Originally released August 2003, updated June 2004\",\n\tmonth =\t\taug,\n\tjlocation =\t\"johnh: folder: xxx\",\n\tjlocation =\t\"johnh: pafile\",\n\tkeywords =\t\"network forensics, network traffic\n fingerprinting, spectral analysis, DDoS\",\n\totherurl =\t\"https://ant.isi.edu/%7ehussain/pubs/Hussain03c.pdf\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.html\",\n\tpdfurl =\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.pdf\",\n\tmyorganization =\t\"USC/Information Sciences Institute\",\n\tcopyrightholder = \"authors\",\n\tabstract = \"\nDenial-of-service attacks on the Internet today are often launched\nfrom zombies, multiple compromised machines controlled by an\nattacker. Attackers often take control of a number of zombies and then\nrepeatedly use this army to attack a target several times, or to\nattack several targets. In this paper, we propose a method to identify\nrepeated attack scenarios, that is, the combination of a particular\nset of hosts and attack tool. Such identification would help a victim\ncoordinate response to an attack, and ideally would be a useful part\nof legal actions. Because packet contents can be forged by the\nattacker, we identify an attack scenario by spectral analysis of the\narrival stream of attack traffic. The attack spectrum is derived from\nthe characteristics of the attack machines and can therefore be\nobscured only by reducing attack effectiveness. We designed a\nmulti-dimensional maximum-likelihood classifier to identify repeated\nattack scenarios. To validate this procedure we apply our approach on\nreal-world attacks captured at a regional ISP, identifying similar\nattacks first by header contents (when possible) and comparing these\nresults to our process. We conduct controlled experiments to identify\nand isolate factors that affect the attack fingerprint.\n\",\n}\n\n\n","author_short":["Hussain, A.","Heidemann, J.","Papadopoulos, C."],"bibbaseid":"hussain-heidemann-papadopoulos-identificationofrepeateddosattacksusingnetworktrafficforensics-2003","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Hussain03c.html"},"keyword":["network forensics","network traffic fingerprinting","spectral analysis","DDoS"],"metadata":{"authorlinks":{}}},"bibtype":"techreport","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["network forensics","network traffic fingerprinting","spectral analysis","ddos"],"search_terms":["identification","repeated","dos","attacks","using","network","traffic","forensics","hussain","heidemann","papadopoulos"],"title":"Identification of Repeated DoS Attacks using Network Traffic Forensics","year":2003}