DDoS Attacks: Evolution, Detection, Prevention, Reaction, and Tolerance
Gespeichert in:
1. Verfasser: | |
---|---|
Format: | Elektronisch E-Book |
Sprache: | English |
Veröffentlicht: |
CRC Press
2016
|
Online-Zugang: | BTW01 Inhaltsverzeichnis |
Beschreibung: | Description based on publisher supplied metadata and other sources |
Beschreibung: | 1 online resource (311 pages) |
ISBN: | 9781498729659 9781498729642 |
Internformat
MARC
LEADER | 00000nmm a2200000zc 4500 | ||
---|---|---|---|
001 | BV043629868 | ||
003 | DE-604 | ||
005 | 20170727 | ||
007 | cr|uuu---uuuuu | ||
008 | 160616s2016 |||| o||u| ||||||eng d | ||
020 | |a 9781498729659 |9 978-1-4987-2965-9 | ||
020 | |a 9781498729642 |c Print |9 978-1-4987-2964-2 | ||
035 | |a (ZDB-30-PQE)EBC4514305 | ||
035 | |a (ZDB-89-EBL)EBL4514305 | ||
035 | |a (ZDB-38-EBR)ebr11208377 | ||
035 | |a (OCoLC)952059709 | ||
035 | |a (DE-599)BVBBV043629868 | ||
040 | |a DE-604 |b ger |e rda | ||
041 | 0 | |a eng | |
049 | |a DE-526 | ||
082 | 0 | |a 005.8 | |
100 | 1 | |a Bhattacharyya, Dhruba Kumar |e Verfasser |0 (DE-588)1044609648 |4 aut | |
245 | 1 | 0 | |a DDoS Attacks |b Evolution, Detection, Prevention, Reaction, and Tolerance |
264 | 1 | |b CRC Press |c 2016 | |
264 | 4 | |c © 2016 | |
300 | |a 1 online resource (311 pages) | ||
336 | |b txt |2 rdacontent | ||
337 | |b c |2 rdamedia | ||
338 | |b cr |2 rdacarrier | ||
500 | |a Description based on publisher supplied metadata and other sources | ||
700 | 1 | |a Kalita, Jugal Kumar |e Sonstige |0 (DE-588)1038035732 |4 oth | |
776 | 0 | 8 | |i Erscheint auch als |n Druck-Ausgabe |a Bhattacharyya, Dhruba Kumar |t DDoS Attacks : Evolution, Detection, Prevention, Reaction, and Tolerance |
856 | 4 | 2 | |m HBZ Datenaustausch |q application/pdf |u http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=029043926&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA |3 Inhaltsverzeichnis |
912 | |a ZDB-30-PQE | ||
940 | 1 | |q BTW_PDA_PQE_KAUF | |
999 | |a oai:aleph.bib-bvb.de:BVB01-029043926 | ||
966 | e | |u http://ebookcentral.proquest.com/lib/th-wildau/detail.action?docID=4514305 |l BTW01 |p ZDB-30-PQE |q BTW_PDA_PQE_KAUF |x Aggregator |3 Volltext |
Datensatz im Suchindex
_version_ | 1804176363046830080 |
---|---|
adam_text | Titel: DDos attacks
Autor: Bhattacharyya, Dhruba Kumar
Jahr: 2016
Contents
List of Figures xiii
List of Tables xvii
Preface xix
Acknowledgments xxi
Authors xxiii
1 Introduction 1
1.1 Anomalies in Networks ....................................2
1.2 Distributed Denial-of-Service (DDoS) Attacks............3
1.3 Causes of DDoS Attacks....................................4
1.4 Targets of DDoS Attacks ..................................5
1.5 Launching of DDoS Attacks................................5
1.6 Current Trends in Botnet Technology ....................6
1.7 Machine Learning in DDoS Attack Handling..............6
1.7.1 Traffic Attributes and User-Parameter Selection 7
1.7.2 Selection of Metrics or Measures..................7
1.7.3 Analysis of Data....................................8
1.7.4 Mode of Detection..................................8
1.7.5 Generation of Alarm Information and Reaction . 9
1.8 DDoS Defense................................................9
1.9 Modules of a DDoS Defense System......................10
1.10 Types of DDoS Defense Systems ..........................11
1.10.1 Based on Approach..................................11
1.10.1.1 DDoS Detection..........................11
1.10.1.2 DDoS Prevention ........................11
1.10.1.3 DDoS Response..........................11
v
CONTENTS
1.10.1.4 DDoS Tolerance..........................12
1.10.2 Based on Nature of Control........................12
1.10.2.1 Centralized DDoS Defense..............12
1.10.2.2 Hierarchical DDoS Defense..............12
1.10.2.3 Distributed DDoS Defense..............13
1.10.3 Based on Defense Infrastructure ..................13
1.10.3.1 Host-Based DDoS Defense..............13
1.10.3.2 Network-Based DDoS Defense..........14
1.10.4 Based on Defense Location........................14
1.10.4.1 Victim-End DDoS Defense..............14
1.10.4.2 Source-End DDoS Defense..............15
1.10.4.3 Intermediate Network DDoS Defense . 15
1.10.5 Based on Technique Used..........................15
1.10.5.1 Misuse Detection..........................15
1.10.5.2 Anomaly Detection ......................16
1.11 DDoS Tools and Systems..................................16
1.12 DDoS Defense Evaluation..................................17
1.13 Prior Work..................................................17
1.14 Contribution of This Book..................................20
1.15 Organization of This Book..................................20
DDoS, Machine Learning, Measures 23
2.1 Issues in Internet Design....................................25
2.1.1 Complex Edge but Simple Core....................25
2.1.2 Link Bandwidth Mismatch between Core and Edge 25
2.1.3 Routing Principles..................................26
2.1.4 Lack of Centralized Network Management .... 26
2.1.5 Sharing of Reserved Resources across Data Centers 26
2.2 DDoS Attacks and Their Types............................27
2.2.1 Agent-Handler and IRC-Based DDoS Attack Gen-
eration ................................................28
2.2.2 Types of DDoS Attacks............................28
2.2.2.1 Layer-Specific DDoS Attacks............28
2.2.2.2 Direct and Reflector-Based DDoS Attacks 30
2.2.2.3 Direct and Indirect DDoS Attacks ... 31
2.2.2.4 High-Rate and Low-Rate DDoS Attacks 31
2.2.2.5 Attack Types Based on Rate Dynamics 32
2.3 DDoS Attack Targets ......................................33
2.3.1 On Infrastructure....................................33
2.3.2 On Link..............................................33
CONTENTS vii
2.3.3 On Router ..........................................34
2.3.4 On OS................................................34
2.3.5 On Defense Mechanism ............................34
2.4 Current Trends in DDoS Attacks..........................34
2.5 Strength of DDoS Attackers................................36
2.6 Desired Characteristics of DDoS Defense System .... 37
2.7 Recent DDoS Attacks......................................38
2.8 Machine Learning Background ............................39
2.8.1 Supervised and Unsupervised Machine Learning 40
2.8.2 Measures: Similarity and Dissimilarity............41
2.8.2.1 Dissimilarity Measures ..................42
2.8.2.2 Correlation Measures....................43
2.8.2.3 /-Divergence Measures..................46
2.8.2.4 Information Metrics......................48
2.8.3 Discussion............................................49
2.9 Some Empirical Studies....................................50
2.9.1 Using Information Metrics..........................50
2.9.1.1 Testbed Used..............................52
2.9.1.2 Datasets Used............................53
2.9.1.3 Results of Empirical Study..............53
2.9.1.4 Discussion................................59
2.9.2 Using Correlation Measures........................59
2.9.2.1 An Example..............................60
2.9.3 Using /-Divergence Measures......................62
2.9.3.1 Results....................................65
2.9.4 Discussion............................................69
2.10 Chapter Summary..........................................70
3 Botnets: Trends and Challenges 73
3.1 DDoS Attacks Using Stationary Botnets..................74
3.1.1 Botnet Characteristics..............................74
3.1.2 Botnet Models......................................75
3.1.2.1 Agent Handler Model....................76
3.1.2.2 IRC-Based Model........................76
3.1.2.3 Web-Based Model........................77
3.1.3 Botnet Formation Life Cycle ......................78
3.1.4 Stationary Botnet Architecture....................78
3.1.4.1 Botnet Topology..........................78
3.1.4.2 Protocols Used............................79
3.1.4.3 Botnet C C Systems....................80
viii CONTENTS
3.1.5 Some Stationary Botnets ..........................83
3.1.6 DDoS Attacks Using Mobile Botnets ............89
3.1.6.1 Mobile Botnet Characteristics..........89
3.1.6.2 C C Mechanisms in Mobile Botnet . . 90
3.1.7 Some Mobile Botnets ..............................93
3.2 Chapter Summary and Recommendations................94
4 DDoS Detection 97
4.1 Modules of a DDoS Defense Solution......................98
4.1.1 Monitoring..........................................98
4.1.2 Detection............................................98
4.1.3 Reaction..............................................99
4.2 Types of DDoS Defense Solutions..........................99
4.2.1 Based on Approach Used ..........................99
4.2.2 Based on Nature of Control............100
4.2.2.1 Centralized DDoS Defense.......100
4.2.2.2 Hierarchical DDoS Defense.......102
4.2.2.3 Distributed DDoS Defense.......102
4.2.3 Based on Defense Infrastructure .........103
4.2.3.1 Host-Based DDoS Defense.......103
4.2.3.2 Network-Based DDoS Defense.....104
4.2.4 Based on Defense Location ............104
4.2.4.1 Victim-End DDoS Defense.......105
4.2.4.2 Source-End DDoS Defense.......105
4.2.4.3 Intermediate Network DDoS Defense . 106
4.2.5 Based on Techniques Used.............107
4.3 DDoS Detection Techniques................108
4.3.1 Misuse Detection..................109
4.3.1.1 Signature-Based DDoS Detection .... 110
4.3.1.2 Rule-Based Detection..........110
4.3.1.3 State-Transition Techniques......110
4.3.2 Anomaly-Based DDoS Detection.........Ill
4.3.2.1 Statistical Techniques..........Ill
4.3.2.2 Machine Learning and Data Mining Tech-
niques ...................120
4.3.2.3 Soft Computing Techniques.......131
4.3.2.4 Knowledge-Based Techniques......137
4.4 Chapter Summary.....................141
CONTENTS ix
5 DDoS Prevention 145
5.1 DDoS Prevention Techniques...............145
5.1.1 IP Traceback....................146
5.1.1.1 Link Testing...............150
5.1.1.2 Packet Marking.............151
5.1.1.3 Packet Logging..............153
5.1.1.4 ICMP Traceback Messages.......154
5.1.1.5 Discussion................154
5.1.2 Filtering Techniques................155
5.1.2.1 Ingress and Egress Filtering.......155
5.1.2.2 Router-Based Packet Filtering (RPF) . 157
5.1.2.3 Source Address Validity Enforcement
(SAVE) Protocol.............158
5.1.3 Rate Control....................159
5.2 Chapter Summary.....................159
6 DDoS Reaction and Tolerance 161
6.1 Intrusion Response System (IRS).............161
6.1.1 Intrusion Response (IR) and Its Types......162
6.1.1.1 A Model to Demonstrate Relationships
among Responses ............163
6.1.2 Development of IRSs: Approaches, Methods, and
Techniques.....................165
6.1.2.1 Based on the Degree of Automation . . 165
6.1.2.2 Based on the Approach Used for Trig-
gering Responses.............167
6.1.2.3 Based on Adaptability..........168
6.1.2.4 Based on Promptness in Response Gen-
eration ..................169
6.1.2.5 Based on the Level of Cooperation . . . 169
6.1.2.6 Based on Versatility in Reacting to Un-
seen Situations..............170
6.1.3 Some Example Intrusion Response Systems . . . 171
6.1.3.1 Cooperative Intrusion Traceback and Re-
sponse Architecture (CITRA) .....171
6.1.3.2 Distributed Management Architecture
for Cooperative Detection and Reaction 172
6.1.3.3 EMERALD................173
6.1.3.4 CSM...................174
6.1.3.5 Adaptive, Agent-Based IRS (AAIRS) . 175
CONTENTS
6.1.3.6 ALPHATECH..............175
6.1.3.7 SITAR..................176
6.1.4 Discussion......................177
6.2 DDoS Tolerance Approaches and Methods........177
6.2.1 Multi-Level IDS-Based Approaches........179
6.2.2 Middleware Algorithm-Based Approaches .... 182
6.2.3 Recovery-Based Approaches............185
6.2.4 Discussion......................190
6.3 Chapter Summary.....................191
Tools and Systems 193
7.1 Introduction.........................193
7.2 Types of Network Security Tools.............195
7.2.1 Information Gathering Tools ...........195
7.2.1.1 Sniffing Tools...............195
7.2.1.2 Network Mapping/Scanning Tools . . . 201
7.2.2 Attack Launching Tools..............203
7.2.2.1 Trojans..................204
7.2.2.2 Transport and Network Layer Denial-
of-Service Attacks............205
7.2.2.3 Application Layer Attack Tools .... 210
7.2.2.4 Additional Attack Tools.........212
7.2.3 Network Monitoring Tools.............214
7.2.3.1 Visualization and Analysis Tools .... 215
7.3 Observations ........................216
7.4 TUCANNON+: DDoS Attack-Generation and Monitor-
ing Tool...........................218
7.4.1 TUCannon: Attack-Generation Module.....220
7.4.2 Server Sub-module of TUCannon.........220
7.4.3 Client Sub-module.................222
7.4.4 Scalability of TUCannon .............223
7.4.5 Speed of TUCannon................223
7.4.6 Reflector Attack................ . . 223
7.5 TUCannon Architecture..................224
7.5.1 Server Architecture.................224
7.5.2 Client Architecture.................225
7.6 TUMonitor.........................226
7.6.1 TUMonitor: An Overview.............226
7.6.2 TUMonitor Architecture..............229
7.6.3 Visualization with TUMonitor ..........231
CONTENTS xi
7.7 DDoS Defense Systems...................231
7.7.1 Systems that Respond to Intrusion........232
7.7.1.1 Architectures of Some Well-Known De-
fense Systems ..............233
7.7.2 Some Commercial and Academic Defense Systems 237
7.7.3 Discussion......................247
7.8 Chapter Summary.....................247
8 Conclusion and Research Challenges 249
8.1 Conclusion .........................249
8.1.1 Source IP Spoofing.................250
8.1.2 Degree of Randomization.............250
8.1.3 Isolation vs. Combination.............250
8.1.4 Realistic TCP SYN Flooding...........251
8.1.5 Removal of Unique Characteristics........251
8.1.6 Low-Cost and Limited Bandwidth Attack .... 251
8.2 Research Challenges....................252
8.2.1 Developing a Generic DDoS Defense Mechanism 252
8.2.2 Integration of Packet/Flow Monitoring and De-
tection ........................252
8.2.3 Developing DDoS-Tolerant Architecture.....253
8.2.4 Developing a Cost-Effective Source-End Defense 253
8.2.5 Developing an Efficient Dynamic Firewall .... 253
8.2.6 Hybridization Issues to Support Real-Time
Performance with QoS...............253
8.2.7 Heuristics for Accurate Estimation of Defense
Parameters.....................254
8.2.8 Developing a Robust and Cost-Effective Proxim-
ity
Measure.......................254
8.2.9 Standard for Unbiased Evaluation of Defense So-
lutions ........................254
8.2.10 Large-Scale Testbed for Defense Validation . . . 254
Index
285
|
any_adam_object | 1 |
author | Bhattacharyya, Dhruba Kumar |
author_GND | (DE-588)1044609648 (DE-588)1038035732 |
author_facet | Bhattacharyya, Dhruba Kumar |
author_role | aut |
author_sort | Bhattacharyya, Dhruba Kumar |
author_variant | d k b dk dkb |
building | Verbundindex |
bvnumber | BV043629868 |
collection | ZDB-30-PQE |
ctrlnum | (ZDB-30-PQE)EBC4514305 (ZDB-89-EBL)EBL4514305 (ZDB-38-EBR)ebr11208377 (OCoLC)952059709 (DE-599)BVBBV043629868 |
dewey-full | 005.8 |
dewey-hundreds | 000 - Computer science, information, general works |
dewey-ones | 005 - Computer programming, programs, data, security |
dewey-raw | 005.8 |
dewey-search | 005.8 |
dewey-sort | 15.8 |
dewey-tens | 000 - Computer science, information, general works |
discipline | Informatik |
format | Electronic eBook |
fullrecord | <?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>01748nmm a2200409zc 4500</leader><controlfield tag="001">BV043629868</controlfield><controlfield tag="003">DE-604</controlfield><controlfield tag="005">20170727 </controlfield><controlfield tag="007">cr|uuu---uuuuu</controlfield><controlfield tag="008">160616s2016 |||| o||u| ||||||eng d</controlfield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">9781498729659</subfield><subfield code="9">978-1-4987-2965-9</subfield></datafield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">9781498729642</subfield><subfield code="c">Print</subfield><subfield code="9">978-1-4987-2964-2</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(ZDB-30-PQE)EBC4514305</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(ZDB-89-EBL)EBL4514305</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(ZDB-38-EBR)ebr11208377</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(OCoLC)952059709</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-599)BVBBV043629868</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-604</subfield><subfield code="b">ger</subfield><subfield code="e">rda</subfield></datafield><datafield tag="041" ind1="0" ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="049" ind1=" " ind2=" "><subfield code="a">DE-526</subfield></datafield><datafield tag="082" ind1="0" ind2=" "><subfield code="a">005.8</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Bhattacharyya, Dhruba Kumar</subfield><subfield code="e">Verfasser</subfield><subfield code="0">(DE-588)1044609648</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">DDoS Attacks</subfield><subfield code="b">Evolution, Detection, Prevention, Reaction, and Tolerance</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="b">CRC Press</subfield><subfield code="c">2016</subfield></datafield><datafield tag="264" ind1=" " ind2="4"><subfield code="c">© 2016</subfield></datafield><datafield tag="300" ind1=" " ind2=" "><subfield code="a">1 online resource (311 pages)</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="b">c</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="b">cr</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="500" ind1=" " ind2=" "><subfield code="a">Description based on publisher supplied metadata and other sources</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Kalita, Jugal Kumar</subfield><subfield code="e">Sonstige</subfield><subfield code="0">(DE-588)1038035732</subfield><subfield code="4">oth</subfield></datafield><datafield tag="776" ind1="0" ind2="8"><subfield code="i">Erscheint auch als</subfield><subfield code="n">Druck-Ausgabe</subfield><subfield code="a">Bhattacharyya, Dhruba Kumar</subfield><subfield code="t">DDoS Attacks : Evolution, Detection, Prevention, Reaction, and Tolerance</subfield></datafield><datafield tag="856" ind1="4" ind2="2"><subfield code="m">HBZ Datenaustausch</subfield><subfield code="q">application/pdf</subfield><subfield code="u">http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=029043926&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA</subfield><subfield code="3">Inhaltsverzeichnis</subfield></datafield><datafield tag="912" ind1=" " ind2=" "><subfield code="a">ZDB-30-PQE</subfield></datafield><datafield tag="940" ind1="1" ind2=" "><subfield code="q">BTW_PDA_PQE_KAUF</subfield></datafield><datafield tag="999" ind1=" " ind2=" "><subfield code="a">oai:aleph.bib-bvb.de:BVB01-029043926</subfield></datafield><datafield tag="966" ind1="e" ind2=" "><subfield code="u">http://ebookcentral.proquest.com/lib/th-wildau/detail.action?docID=4514305</subfield><subfield code="l">BTW01</subfield><subfield code="p">ZDB-30-PQE</subfield><subfield code="q">BTW_PDA_PQE_KAUF</subfield><subfield code="x">Aggregator</subfield><subfield code="3">Volltext</subfield></datafield></record></collection> |
id | DE-604.BV043629868 |
illustrated | Not Illustrated |
indexdate | 2024-07-10T07:30:59Z |
institution | BVB |
isbn | 9781498729659 9781498729642 |
language | English |
oai_aleph_id | oai:aleph.bib-bvb.de:BVB01-029043926 |
oclc_num | 952059709 |
open_access_boolean | |
owner | DE-526 |
owner_facet | DE-526 |
physical | 1 online resource (311 pages) |
psigel | ZDB-30-PQE BTW_PDA_PQE_KAUF ZDB-30-PQE BTW_PDA_PQE_KAUF |
publishDate | 2016 |
publishDateSearch | 2016 |
publishDateSort | 2016 |
publisher | CRC Press |
record_format | marc |
spelling | Bhattacharyya, Dhruba Kumar Verfasser (DE-588)1044609648 aut DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance CRC Press 2016 © 2016 1 online resource (311 pages) txt rdacontent c rdamedia cr rdacarrier Description based on publisher supplied metadata and other sources Kalita, Jugal Kumar Sonstige (DE-588)1038035732 oth Erscheint auch als Druck-Ausgabe Bhattacharyya, Dhruba Kumar DDoS Attacks : Evolution, Detection, Prevention, Reaction, and Tolerance HBZ Datenaustausch application/pdf http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=029043926&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA Inhaltsverzeichnis |
spellingShingle | Bhattacharyya, Dhruba Kumar DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_auth | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_exact_search | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_full | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_fullStr | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_full_unstemmed | DDoS Attacks Evolution, Detection, Prevention, Reaction, and Tolerance |
title_short | DDoS Attacks |
title_sort | ddos attacks evolution detection prevention reaction and tolerance |
title_sub | Evolution, Detection, Prevention, Reaction, and Tolerance |
url | http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=029043926&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA |
work_keys_str_mv | AT bhattacharyyadhrubakumar ddosattacksevolutiondetectionpreventionreactionandtolerance AT kalitajugalkumar ddosattacksevolutiondetectionpreventionreactionandtolerance |