Distinguishing between single and multi-source attacks using signal processing

Launching a denial of service (DoS) attack is trivial, but detection and response is a painfully slow and often a manual process. Automatic classification of attacks as single- or multi-source can help focus a response, but current packet-header-based approaches are susceptible to spoofing. This paper introduces a framework for classifying DoS attacks based on header content, transient ramp-up behavior, and novel techniques such as spectral analysis. Although headers are easily forged, we show that characteristics of attack ramp-up and attack spectrum are more difficult to spoof. To evaluate our framework we monitored access links of a regional ISP detecting 80 live attacks. Header analysis identified the number of attackers in 67 attacks, while the remaining 13 attacks were classified based on ramp-up and spectral analysis. We validate our results through monitoring at a second site, controlled experiments, and simulation. We use experiments and simulation to understand the underlyin...

• Type: Journal
• Year: 2004
• Where: CN
• Authors: Alefiya Hussain, John S. Heidemann, Christos Papadopoulos
• Keywords: CN 2004, Current Packet-header-based Approaches, Spectral Analysis, Transient Ramp-up Behavior