Transient performance of PacketScore for blocking DDoS attacks

Mooi Choo Chuah, Wing Cheong Lau, Yoohwan Kim, H. Jonathan Chao

Research output: Contribution to journalConference article

Abstract

Distributed Denial of Service (DDoS) attack is a critical threat to the Internet. Recently we have proposed the PacketScore scheme, a DDoS defense architecture that supports automated attack detection, on-line attack characterization and attack blocking. Its key idea is to use a statistics-based packet scoring mechanism to distinguish between legitimate and non-legitimate packets and discard packets based on the packet scores. In order for such an approach to work, we need to perform on-line traffic characterizations, and compare such characterizations with nominal profiles (generated from past history or off-line analysis). The threshold used for the score-based selective packet discard decision is dynamically adjusted based on the score distribution of recent incoming packets. In our previous paper [Kim04], we discuss how our proposed system performs in different attack scenarios. In this paper, we first give a brief review of the PacketScore approach and further elaborate on the transient performance under varying attack types and intensities, which may be exploited in more sophisticated attacks. We then show that PacketScore is well capable of blocking such sophisticated attacks by simply adjusting the measurement window time scale to closely track the attack profile.

Original languageEnglish (US)
Pages (from-to)1892-1896
Number of pages5
JournalIEEE International Conference on Communications
Volume4
StatePublished - 2004
Event2004 IEEE International Conference on Communications - Paris, France
Duration: Jun 20 2004Jun 24 2004

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Transient performance of PacketScore for blocking DDoS attacks'. Together they form a unique fingerprint.

  • Cite this