Abstract-Distributed Denial of Service (DDoS) flooding attacks are one of the biggest concerns for security professionals. DDoS flooding attacks are typically explicit attempts to disrupt legitimate users' access to services. Attackers usually gain access to a large number of computers by exploiting their vulnerabilities to set up attack armies (i.e., Botnets). Once an attack army has been set up, an attacker can invoke a coordinated, large-scale attack against one or more targets. Developing a comprehensive defense mechanism against identified and anticipated DDoS flooding attacks is a desired goal of the intrusion detection and prevention research community. However, the development of such a mechanism requires a comprehensive understanding of the problem and the techniques that have been used thus far in preventing, detecting, and responding to various DDoS flooding attacks.In this paper, we explore the scope of the DDoS flooding attack problem and attempts to combat it. We categorize the DDoS flooding attacks and classify existing countermeasures based on where and when they prevent, detect, and respond to the DDoS flooding attacks. Moreover, we highlight the need for a comprehensive distributed and collaborative defense approach. Our primary intention for this work is to stimulate the research community into developing creative, effective, efficient, and comprehensive prevention, detection, and response mechanisms that address the DDoS flooding problem before, during and after an actual attack.

No abstract

No abstract

Intrusion detection and response systems (IPSs) for literature based on two intrusion prevention systems, motl protecting against distributed denial-of-service (DDoS) attacks host-based IPS (HIPS) and network-based IPS (NIPS) [1[2 will beneflit significantly if all the routers within each autonomous [3]. HIPSs are deployed on end-hosts, either source (Souce system (AS) are capable of detection and response in addition to side) or destination (Destination-side) of the attack. Sourcesd sampling. However, DDoS detection and response will incur high detection and response approaches such as ingress filtering[] storage and processing overhead if each router does redundant D-WARD [5], and MULTOPS [6] can take place at eithereg detection and response tasks. Many overlay communication routers of the local network or access routers of an ASta protocols have been introduced in the literature to achieve connect to the subscribers' edge routers [1]. Source-side'HP, coordination among the routers but they generally have high aim to detect and filter the attack traffic but they areno communication overheads. Furthermore, DDoS detection and prciaagns oStak.Theaetwraos response requires that all the flows intended to the same pracetica ageratinst Dof aittak.Terinues aretorasonst whic destination be analyzed together in order to efficiently capture mrciake ath goreneraion of s Fistern rule soagainst Dof not the correlation between them. In order to do that,, current pedsracicalute source-siden HIPs.airst thein souce oificattak can approaches centrally collect all the sampled data and analyze bfte dsturibued in diferent doaindrspn m akigicifcurtlt. foIec them, which also increases the communication overhead. In this coflthebourcties atoac detectio and responde accuroateyce, paper, we present a collaborative approach to distribute the claoaieatc eeto n epneapoce r sampling, detection, and response responsibilities among all the required to capture all the traffic from all the distriue routers within the AS in such a way that each router can detect sources to the victim. Second, it is difficult to differntit and respond to DDoS attacks. Our proposed approach achieves legitimate and DDoS attack traffic at the sources, sincth coordination among all the routers in the network to eliminate volume of the traffic is not big enough and traffic nl redundant sampling, detection, and response tasks without aggregates at the points close to destinations. Although D exploiting any specific communication protocol. We propose an WARD can generate filtering rules at the source, it consue optimal assignment of disjoint flows to each of the routers within more memory space and CPU cycles than some NIP!s[] the ASs in such a way that all the flows destined for the same host Hence, source-side HIPSs are not effective against Do will be sampled, analyzed, and properly responded at the same attacks. router. Each router can thus capture the correlation between flows destined for a specific destination. In the destination-side HIPSs, detection will be done...

No abstract