Detecting DDoS Attacks in Stub Domains (ISR IP)

ISR intellectual property available to license

Inventors:
Christopher Kommareddy, Samrat Bhattacharjee, Mark Shayman, Richard La

Description
Denial of Service (DoS) attack technology is developing in an open-source environment and is evolving rapidly. Technology producers, system administrators, and users are improving their ability to react to emerging problems, but they are behind and significant damage to systems and infrastructure can occur before effective defenses can be implemented.

Researchers at University of Maryland have come up with an innovative technique for detecting "Distributed Denial of Service (DDoS)" attacks without changing the existing routing infrastructure. This new detection system (using TCP packets) has several advantages over currently existing technology in terms of:
1. Flexibility: can be deployed in single and multi-homed stub networks.
2. Performance: high detecting capability even with the network having asymmetric traffic or very low flow rates.
3. Efficiency: very little processing and communication overhead.
4. Robustness: detects different types of attacks on traces with orders of magnitude difference in packet rates without parameter tweaking.

Inventors have performed extensive packet level simulations under different attack scenarios. Observations are listed below:

1. Detect attack flows that are one-third the intensity of an average flow of in the network.
2. Detect attack for asymmetric traffic in multi-gateway networks if the attack rate is at least five times the average flow rate in the network.

Researchers have even extended this detection technique to detect subnet attacks and were successful in detecting attacks that target hosts in large subnets and in the presence of non-attack traffic to other hosts in the subnet. The experiments conducted for single domain networks revealed that the scheme can detect attacks with aggregate flow intensity equal to the average flow in the network in less than a minute. The experiments for multi-domain stub networks demonstrated that the scheme detects attacks even when the network has four gateways and when up to 50% of flows are asymmetric.

For more information
If you would like to license this intellectual property, have questions, would like to contact the inventors, or need more information, contact ISR External Relations Director Jeff Coriale at coriale@umd.edu or 301.405.6604.

Find more ISR IP
You can go to our main IP search page to search by research category or faculty name. Or view the entire list of available IP on our complete IP listing page.

ISR-IP-Shayman ISR-IP-La ISR-IP-security

Related Articles:
Methods for Estimating the Intrinsic Pattern of Fingerprint Scanners and Using it in Biometric Authentication and for Cryptographic Key Generation (ISR IP)
Method for Efficient Source Authentication for Multicast Communications in Hybrid Satellite/Wireless Networks (ISR IP)
Method for Performance-Aware Security of Unicast Communications in Hybrid Satellite Networks (ISR IP)
Method and Implementation for Key Generation and Replacement Using Markov Models (ISR IP)
Confidentiality Preserving Rank-Ordered Search (ISR IP)
Method and Implementation for Wireless Message Authentication (ISR IP)
Component Forensics of Visual Sensors and Devices (ISR IP)
Data Hiding in Compiled Program Binaries for Enhancing Computer System Performance (ISR IP)
Effective and Efficient Collusion-Resistant Fingerprinting for Multimedia (ISR IP)
Curve-Based Data Hiding for Protecting Map Document (ISR IP)

June 22, 2007