A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena - - PowerPoint PPT Presentation

A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms

Jelena Mirkovic, Janice Martin & Peter Reiher

Manu Shantharam & David Hadka

What is DoS?

• DoS – A type of attack wherein access to computer resource / service is denied or

restricted. An example

What is DDoS?

• DDoS – Concurrent, Coordinated DoS.

An example

What facilitates DDoS?

• Internet security is highly interdependent

– Each host depends on the state of security in the entities it is communicating with.

• Internet resources are limited

– Resources are enough for only certain number of users.

• Power of many is greater than power of few

– Resources of attackers are more than that of the victims

• No accountability

– Source address spoofing

DDoS Attack Strategy

Recruiting, exploiting, infecting, attacking

Contribution

• First of its kind
• Taxonomy of DDoS attacks

– Based on means, characteristics and effects

• Taxonomy of DDoS defense mechanisms

– Based on activity level, cooperation degree and location

Related Work

Taxonomy of DDoS Attacks

Taxonomy of DDoS Attacks

• TCP SYN
• CGI Request
• Authentication Server

Taxonomy of DDoS Attacks

Pulsing attack: periodic disruptions or coordinated for continual degradation

Taxonomy of DDoS Defenses

Preventive: eliminate or reduce impact of DDoS attacks on legitimate clients Firewalls, virus scanners, access lists, capabilities, intrusion detection, etc. Server farms

Taxonomy of DDoS Defenses

Reactive: detect and respond to an attack. Pattern: broken by slight variations in attack signature Anomaly: how to define thresholds? change

• ver time?

Taxonomy of DDoS Defenses

Reduce the impact of the attack while minimizing impact to legitimate clients

Taxonomy of DDoS Defenses

Cooperate with other entities to identify and respond to attacks e.g., firewalls

Taxonomy of DDoS Defenses

e.g., resource accounting, protocol security mechanisms

Results

• Provides classification for simple DDoS attack and

defense mechanisms

• Better coordination among researchers
• Clarify how different mechanisms work in concert

Take Away

• This taxonomy only identifies simple methods. More

complex techniques exist.

• Can the defense mechanism itself cause DoS (e.g.,

anomaly attack detection)?

• What about unintentional DoS? Digg effect?

References

• Wikipedia
• A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms - Jelena Mirkovic, Janice Martin & Peter

Reiher

• An Integrated Approach for Defending Against Distributed Denial-of-Service (DDoS) Attacks -

Krishan Kumar, R.C. Joshi, and Kuldip Singh