Intrusion Detection Routers: Design, Implementation and Evaluation Using an Experimental Testbed

Abstract--In this paper, we present the design, the implementation details, and the evaluation results of an intrusion detection and defense system for distributed denial-of-service (DDoS) attack. The evaluation is conducted using an experimental testbed. The system, known as intrusion detection router (IDR), is deployed on network routers to perform online detection on any DDoS attack event, and then react with defense mechanisms to mitigate the attack. The testbed is built up by a cluster of sufficient number of Linux machines to mimic a portion of the Internet. Using the testbed, we conduct real experiments to evaluate the IDR system and demonstrate that IDR is effective in protecting the network from various DDoS attacks.

• Type: Journal
• Year: 2006
• Where: JSAC
• Authors: Eric Y. K. Chan, H. W. Chan, K. M. Chan, Vivien P. S. Chan, Samuel T. Chanson, Matthew M. H. Cheung, C. F. Chong, K. P. Chow, Albert K. T. Hui, Lucas Chi Kwong Hui, S. K. Ip, Luke C. K. Lam, W. C. Lau, Kevin K. H. Pun, Anthony Y. F. Tsang, Wai Wan Tsang, Sam C. W. Tso, Dit-Yan Yeung, Siu-Ming Yiu, K. Y. Yu, W. Ju
• Keywords: DDoS, Intrusion Detection, Intrusion Detection Router, JSAC 2006