DDoS Hide &amp; Seek

Kopp, Daniel; Wichtlhuber, Matthias; Poese, Ingmar; Santanna, Jair; Hohlfeld, Oliver; Dietzel, Christoph

doi:10.1145/3355369.3355590

Cited by 12 publications

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Researchers have used booter services to attack their own infrastructure and found attacks utilize on average 346 amplifiers from 27 autonomous systems [41]. Interestingly, honeypots observed only ∼40% of DNS self-targeted attacks [39].…”

Section: Economic Considerationsmentioning

confidence: 99%

See 1 more Smart Citation

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

Nawrocki¹,

Kristoff²,

Hiesgen³

et al. 2023

Preprint

View full text Add to dashboard Cite

In this paper, we revisit the use of honeypots for detecting reflective amplification attacks. These measurement tools require careful design of both data collection and data analysis including cautious threshold inference. We survey common amplification honeypot platforms as well as the underlying methods to infer attack detection thresholds and to extract knowledge from the data. By systematically exploring the threshold space, we find most honeypot platforms produce comparable results despite their different configurations. Moreover, by applying data from a large-scale honeypot deployment, network telescopes, and a real-world baseline obtained from a leading DDoS mitigation provider, we question the fundamental assumption of honeypot research that convergence of observations can imply their completeness. Conclusively we derive guidance on precise, reproducible honeypot research, and present open challenges.

show abstract

Section: Economic Considerationsmentioning

confidence: 99%

“…This means that observations by honeypot sensors can be extremely biased if they are used by a specific booter. Furthermore, take downs of booter websites can significantly reduce the number of observed attacks [41], [42] and negatively bias a honeypot system's view of the attack landscape.…”

Section: Economic Considerationsmentioning

confidence: 99%

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

Nawrocki¹,

Kristoff²,

Hiesgen³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks

Kopp¹,

Dietzel²,

Hohlfeld

2021

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97% of the attack traffic.

show abstract