Efficient Filtering of Pulsing DDoS using Incremental Clustering
Date Issued
2016
Date
2016
Author(s)
Chen, Chih-Wei
Abstract
The Low-rate Distributed Denial-of-Service (LDDoS) attack is a network attack technique which can be harmful but stealthy. One type of the LDDoS attack, called pulsing DDoS attack, leverages the adaptive nature of the TCP congestion control mechanism. Pulsing DDoS attacks can suppress legitimate TCP traffic by sending fewer packets than traditional flooding DDoS attack. With a short period burst traffic, the pulsing DDoS attack aims to interrupt the target network temporarily and thus packet drop occurs, which makes the users unable to access the network. This kind of attack is crafty and hard to be detected efficiently by existing defensive approaches. In this thesis, we propose an efficient LDDoS defense mechanism using incremental clustering. Instead of keeping per-flow state, which is too heavy-weight for core routers, we classify flows according to the amount of traffic they sent during the congestion periods. Groups with larger flows get a lower priority and will be blocked ealier during congestion. With such, we increase the probability of small TCP traffic to pass the link and block the huge flows which most of them are malicious. In addition, we record the data which is necessary for the clustering and other related work in Bloom filters to keep up with high-speed per-packet processing.
Subjects
DDoS
pulsing attack
low rate attack
bloom filter
Type
thesis
File(s)![Thumbnail Image]()
Loading...
Name
ntu-105-R03922110-1.pdf
Size
23.32 KB
Format
Adobe PDF
Checksum
(MD5):2d9c7b7b4d5cd5cfca76e10cc6e70346