A collaborative approach to facilitate intrusion detection and response against DDoS attacks.

Abstract

Intrusion detection and response systems (IPSs) for literature based on two intrusion prevention systems, motl protecting against distributed denial-of-service (DDoS) attacks host-based IPS (HIPS) and network-based IPS (NIPS) [1[2 will beneflit significantly if all the routers within each autonomous [3]. HIPSs are deployed on end-hosts, either source (Souce system (AS) are capable of detection and response in addition to side) or destination (Destination-side) of the attack. Sourcesd sampling. However, DDoS detection and response will incur high detection and response approaches such as ingress filtering[] storage and processing overhead if each router does redundant D-WARD [5], and MULTOPS [6] can take place at eithereg detection and response tasks. Many overlay communication routers of the local network or access routers of an ASta protocols have been introduced in the literature to achieve connect to the subscribers' edge routers [1]. Source-side'HP, coordination among the routers but they generally have high aim to detect and filter the attack traffic but they areno communication overheads. Furthermore, DDoS detection and prciaagns oStak.Theaetwraos response requires that all the flows intended to the same pracetica ageratinst Dof aittak.Terinues aretorasonst whic destination be analyzed together in order to efficiently capture mrciake ath goreneraion of s Fistern rule soagainst Dof not the correlation between them. In order to do that,, current pedsracicalute source-siden HIPs.airst thein souce oificattak can approaches centrally collect all the sampled data and analyze bfte dsturibued in diferent doaindrspn m akigicifcurtlt. foIec them, which also increases the communication overhead. In this coflthebourcties atoac detectio and responde accuroateyce, paper, we present a collaborative approach to distribute the claoaieatc eeto n epneapoce r sampling, detection, and response responsibilities among all the required to capture all the traffic from all the distriue routers within the AS in such a way that each router can detect sources to the victim. Second, it is difficult to differntit and respond to DDoS attacks. Our proposed approach achieves legitimate and DDoS attack traffic at the sources, sincth coordination among all the routers in the network to eliminate volume of the traffic is not big enough and traffic nl redundant sampling, detection, and response tasks without aggregates at the points close to destinations. Although D exploiting any specific communication protocol. We propose an WARD can generate filtering rules at the source, it consue optimal assignment of disjoint flows to each of the routers within more memory space and CPU cycles than some NIP!s[] the ASs in such a way that all the flows destined for the same host Hence, source-side HIPSs are not effective against Do will be sampled, analyzed, and properly responded at the same attacks. router. Each router can thus capture the correlation between flows destined for a specific destination. In the destination-side HIPSs, detection will be done...

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks

“…These overheads get even worse if each router does redundant detection and response through the path to the destination [86], which can present a significant burden. Various researchers have proposed different approaches to reduce the amount of storage and consumption of CPU cycles for detection and response at the routers such as Bloom filters [78] [87], Packet sampling [88], etc.…”

“…But these approaches are not sufficient when routers still do redundant jobs. Moreover, reducing the amount of redundant detection and response between the routers requires coordination among them [86]. Different communication protocols have been proposed to coordinate attack detection and response among the routers [1].…”

DCDIDP: A Distributed, Collaborative, and Data-driven Intrusion Detection and Prevention Framework for Cloud Computing Environments

“…Collaboration also increases attack detection and the speed and strength of prevention efforts. Distributed detection and prevention of the attacks within/among cloud providers can reduce the complexity of redundant monitoring of attack flows [6] at different check points which should be one of the main features in the next generation of IDPSs suitable for cloud environments. Creating comprehensive local/global databases to be used for detection tasks by IDPSs is another major requirement in order for IDPSs to act as a comprehensive defense mechanism.…”

“…Based on where detection and response occurs in the system, IDPSs can be categorized into three different types: host-based IDPSs (HIDPSs), network-based IDPS (NIDPSs), and Hybrid IDPSs (also known as Distributed IDPSs [2]) which includes both host-based and network-based sensors [6], [8]. HIDPSs are not capable of detecting attacks before the end-system is compromised.…”

“…Hybrid IDPSs extend intrusion detection and packet filtering to the network routers by employing NIDPSs. Distributed and collaborative NIDPSs [6], [7] may be employed on the network infrastructure layer to detect and respond to the attacks effectively and in real-time. Each router within a collaborative cluster of routers and hosts interacts with each of the three local databases to detect and respond to the attacks.…”