A survey of distributed denial-of-service attack, prevention, and mitigation techniques

Mahjabin, Tasnuva; Xiao, Yang; Sun, Guang; Jiang, Wangdong

doi:10.1177/1550147717741463

Cited by 247 publications

(141 citation statements)

References 127 publications

Supporting

Mentioning

133

Contrasting

Unclassified

Order By: Relevance

“…According to Cisco cybersecurity report, 30% organizations have experienced cyber attacks in 2019. Denial of Service (DoS) and Distributed DoS (DDoS) [1] are the most common attacks on the Internet recently. In DoS and DDoS, attackers take control of many hosts, known as botnets and use them to send extremely large numbers of request to victims to stop their services.…”

Section: Introductionmentioning

confidence: 99%

A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

Tuấn

Hung²,

Nghia

et al. 2020

Electronics

View full text Add to dashboard Cite

Keeping Internet users protected from cyberattacks and other threats is one of the most prominent security challenges for network operators nowadays. Among other critical threats, distributed denial-of-service (DDoS) becomes one of the most widespread attacks in the Internet, which is very challenging to mitigate appropriately as DDoS attacks cause the system to stop working by resource exhaustion. Software-defined networking (SDN) has recently emerged as a new networking technology offering unprecedented programmability that allows network operators to configure and manage their infrastructures dynamically. The flexible processing and centralized management of the SDN controller allow flexibly deploying complex security algorithms and mitigation methods. In this paper, we propose a novel DDoS attack mitigation in SDN-based Internet Service Provider (ISP) networks for TCP-SYN and ICMP flood attacks utilizing machine learning approach, i.e., K-Nearest-Neighbor (KNN) and XGBoost. By deploying a testbed, we implement the proposed algorithms, evaluate their accuracy, and address the trade-off between the accuracy and mitigation efficiency. Through extensive experiments, the results show that the algorithms can efficiently mitigate the attack by over 98.0% while benign traffic is not affected.

show abstract

Section: Introductionmentioning

confidence: 99%

A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

Tuấn

Hung²,

Nghia

et al. 2020

Electronics

View full text Add to dashboard Cite

show abstract

“…On the other hand, a DDoS attack adds a many‐to‐one dimension to the DoS problem. Instead of using one connection, a DDoS attack often uses thousands of compromised hosts to execute an attack, amplifying both the available attacker resources and the complexity of the attack …”

Section: Introductionmentioning

confidence: 99%

Mitigating DDoS using weight‐based geographical clustering

Kongshavn¹,

Haugerud

Yazidi

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Distributed denial of service (DDoS) attacks have for the last two decades been among the greatest threats facing the internet infrastructure. Mitigating DDoS attacks is a particularly challenging task as an attacker tries to conceal a huge amount of traffic inside a legitimate traffic flow. This article proposes to use data mining approaches to find unique hidden data structures which are able to characterize the normal traffic flow. This will serve as a mean for filtering illegitimate traffic under DDoS attacks. In this endeavor, we devise three algorithms built on previously uncharted areas within mitigation techniques where clustering techniques are used to create geographical clusters in regions which are likely to contain legitimate traffic. We argue through extensive experimental results that establishing clusters around this narrative is a superior solution to clustering algorithms which rely on bitwise distances between IP addresses. In addition, the DDoS filtering algorithm is deployed in a virtual Linux environment using Nfqueue and tested in a simulated real-life DDoS attack.

show abstract

“…Among the significant types of events that lead to traffic anomalies, some of the most important include denial of service (DoS), flash crowds, port scans, and worms. DoS is usually a type of attack in which one or more hosts try to turn a particular host or service unavailable so that the attacked entity cannot process legitimate requests. Flash crowds cause a sudden increase on the number of accesses to a given service.…”

Section: Introductionmentioning

confidence: 99%

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Duarte

Hara

Torres

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

BackStreamDB is distributed traffic monitoring system based on a stream processing engine (SPE) designed to monitor the traffic of wide area backbones.BackStreamDB provides arbitrary metrics about the traffic in real time, taking into account the backbone as a whole. The system was developed for and successfully deployed on the Brazilian National Academic Network (RNP). In this work, we describe the functionality for the detection of traffic anomalies. A large number of Internet attacks are continuously reported, and several types of attacks result in anomalous traffic. In the proposed strategy for anomaly detection, the traffic is sampled by monitors that are distributed across the backbone, which are accessed and processed by the SPE. BackStreamDB was extended with stream processing modules for computing traffic entropy and principal component analysis, which are the employed to detect traffic anomalies. Experimental results are reported which were obtained to validate the effectiveness of the proposed strategy for different types of attacks.

show abstract

A survey of distributed denial-of-service attack, prevention, and mitigation techniques

Cited by 247 publications

References 127 publications

A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

A DDoS Attack Mitigation Scheme in ISP Networks Using Machine Learning Based on SDN

Mitigating DDoS using weight‐based geographical clustering

BackStreamDB: A stream processing engine for backbone traffic monitoring with anomaly detection

Contact Info

Product

Resources

About