On the robustness of router-based denial-of-service (DoS) defense systems

This paper focuses on "router-based" defense mechanisms, and whether they can provide effective solutions to network Denialof-Service (DoS) attacks. Router-based defenses operate either on traffic aggregates or on individual flows, and have been shown, either alone or in combination with other schemes, e.g., traceback, to be reasonably effective against certain types of basic attacks. Those attacks are, however, relatively brute-force, and usually accompanied by either significant increases in congestion, and/or traffic patterns that are easily identified. It is, therefore, unclear if router-based solutions are viable in the presence of more diverse or sophisticated attacks. As a result, even if incorporating defense mechanisms in the routers themselves has obvious advantages, such schemes have not seen wide deployments. Our ultimate goal is to determine whether it is possible to build router-based defense mechanisms that are effective against a wide range of attacks. This p...

• Type: Journal
• Year: 2005
• Where: CCR
• Authors: Ying Xu, Roch Guérin
• Keywords: CCR 2005, Defense Mechanisms, Flooding Patterns, Router-based Defense