PacketScore: A statistics-based packet filtering scheme against distributed denial-of-service attacks

Yoohwan Kim, Wing Cheong Lau, Mooi Choo Chuah, H. Jonathan Chao

Research output: Contribution to journalArticle

Abstract

Distributed Denial-of-Service (DDoS) attacks are a critical threat to the Internet. This paper introduces a DDoS defense scheme that supports automated online attack characterizations and accurate attack packet discarding based on statistical processing. The key idea is to prioritize a packet based on a score which estimates its legitimacy given the attribute values it carries. Once the score of a packet is computed, this scheme performs score-based selective packet discarding where the dropping threshold is dynamically adjusted based on the score distribution of recent incoming packets and the current level of system overload. This paper describes the design and evaluation of automated attack characterizations, selective packet discarding, and an overload control process. Special considerations are made to ensure that the scheme is amenable to high-speed hardware implementation through scorebook generation and pipeline processing. A simulation study indicates that PacketScore is very effective in blocking several different attack types under many different conditions.

Original languageEnglish (US)
Pages (from-to)141-155
Number of pages15
JournalIEEE Transactions on Dependable and Secure Computing
Volume3
Issue number2
DOIs
StatePublished - 2006

Keywords

  • Network level security and protection
  • Network monitoring
  • Performance evaluation
  • Security
  • Simulation
  • Traffic analysis

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'PacketScore: A statistics-based packet filtering scheme against distributed denial-of-service attacks'. Together they form a unique fingerprint.

Cite this