A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena - PowerPoint PPT Presentation

A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena Mirkovic, Janice Martin & Peter Reiher Manu Shantharam & David Hadka

What is DoS? • DoS – A type of attack wherein access to computer resource / service is denied or restricted. An example �������� ������ ������ ���� � ������

What is DDoS? • DDoS – Concurrent, Coordinated DoS. An example �������� �������� ������ �������� � ������ ������ ����

What facilitates DDoS? • Internet security is highly interdependent – Each host depends on the state of security in the entities it is communicating with. • Internet resources are limited – Resources are enough for only certain number of users. • Power of many is greater than power of few – Resources of attackers are more than that of the victims • No accountability – Source address spoofing

DDoS Attack Strategy Recruiting, exploiting, infecting, attacking

Contribution • First of its kind • Taxonomy of DDoS attacks Based on means , characteristics and effects – • Taxonomy of DDoS defense mechanisms Based on activity level , cooperation degree and location –

Related Work

Taxonomy of DDoS Attacks

● ● ● Taxonomy of DDoS Attacks TCP SYN CGI Request Authentication Server

Taxonomy of DDoS Attacks Pulsing attack : periodic disruptions or coordinated for continual degradation

Taxonomy of DDoS Defenses Preventive : eliminate or reduce impact of DDoS attacks on legitimate clients Firewalls, virus scanners, access lists, capabilities, intrusion detection, etc. Server farms

Taxonomy of DDoS Defenses Reactive: detect and respond to an attack. Pattern : broken by slight variations in attack signature Anomaly : how to define thresholds? change over time?

Taxonomy of DDoS Defenses Reduce the impact of the attack while minimizing impact to legitimate clients

Taxonomy of DDoS Defenses e.g., firewalls Cooperate with other entities to identify and respond to attacks

Taxonomy of DDoS Defenses e.g., resource accounting, protocol security mechanisms

Results • Provides classification for simple DDoS attack and defense mechanisms • Better coordination among researchers • Clarify how different mechanisms work in concert

Take Away • This taxonomy only identifies simple methods. More complex techniques exist. • Can the defense mechanism itself cause DoS (e.g., anomaly attack detection)? • What about unintentional DoS? Digg effect?

References • Wikipedia • A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms - Jelena Mirkovic, Janice Martin & Peter Reiher • An Integrated Approach for Defending Against Distributed Denial-of-Service (DDoS) Attacks - Krishan Kumar, R.C. Joshi, and Kuldip Singh