research-article

Quantifying the Spectrum of Denial-of-Service Attacks through Internet Backscatter

Authors:

Norbert Blenn,

Vincent Ghiëtte,

Christian DoerrAuthors Info & Claims

ARES '17: Proceedings of the 12th International Conference on Availability, Reliability and Security

Article No.: 21, Pages 1 - 10

https://doi.org/10.1145/3098954.3098985

Published: 29 August 2017 Publication History

Get Access

Abstract

Denial of Service (DoS) attacks are a major threat currently observable in computer networks and especially the Internet. In such an attack a malicious party tries to either break a service, running on a server, or exhaust the capacity or bandwidth of the victim to hinder customers to effectively use the service. Recent reports show that the total number of Distributed Denial of Service (DDoS) attacks is steadily growing with "mega-attacks" peaking at hundreds of gigabit/s (Gbps).

In this paper, we will provide a quantification of DDoS attacks in size and duration beyond these outliers reported in the media. We find that these mega attacks do exist, but the bulk of attacks is in practice only a fraction of these frequently reported values. We further show that it is feasible to collect meaningful backscatter traces using surprisingly small telescopes, thereby enabling a broader audience to perform attack intelligence research.

References

[1]

The ucsd caida backscatter dataset - 2008. {Online}. Available: http://www.caida.org/data/passive/backscatterdataset.xml

Google Scholar

[2]

"Q2 2015 State of the Internet -- Security Report," 2015. {Online}. Available: https://www.stateoftheinternet.com/resources-cloud-security-2015-q2-web-security-report.html

Google Scholar

[3]

E. Balkanli and A. N. Zincir-Heywood, "On the analysis of backscatter traffic," 8th IEEE Workshop on Network Measurements, 2014.

Google Scholar

[4]

Z. Durumeric, M. Bailey, and J. A. Halderman, "An internet-wide view of internet-wide scanning," in 23rd USENIX Security Symposium (USENIX Security 14). San Diego, CA: USENIX Association, Aug. 2014, pp. 65--78. {Online}. Available: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/durumeric

Digital Library

Google Scholar

[5]

Information Sciences Institute, "Transmission control protocol (rfc793)," IETF, Tech. Rep., 1981.

Google Scholar

[6]

L. Krämer, J. Krupp, D. Makita, T. Nishizoe, T. Koide, K. Yoshioka, and C. Rossow, "AmpPot: Monitoring and Defending Amplification DDoS Attacks," in Proceedings of the 18th International Symposium on Research in Attacks, Intrusions and Defenses, November 2015.

Digital Library

Google Scholar

[7]

Z. M. Mao, V. Sekar, O. Spatscheck, J. van der Merwe, and R. Vasudevan, "Analyzing large ddos attacks using multiple data sources," in Proceedings of the 2006 SIGCOMM Workshop on Large-scale Attack Defense, ser. LSAD '06. New York, NY, USA: ACM, 2006, pp. 161--168. {Online}. Available:

Digital Library

Google Scholar

[8]

D. Moore, C. Shannon, D. J. Brown, G. M. Voelker, and S. Savage, "Inferring internet denial-of-service activity," ACM Trans. Comput. Syst., vol. 24, no. 2, pp. 115--139, May 2006. {Online}. Available:

Digital Library

Google Scholar

[9]

J. Reynolds and J. Postel, "Rfc1340: Assigned numbers," in IETF, 1992.

Google Scholar

[10]

C. Rossow, "Amplification Hell: Revisiting Network Protocols for DDoS Abuse," in Proceedings of the 2014 Network and Distributed System Security (NDSS) Symposium, February 2014.

Google Scholar

[11]

E. Wustrow, M. Karir, M. Bailey, F. Jahanian, and G. Huston, "Internet background radiation revisited," in Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, ser. IMC '10. New York, NY, USA: ACM, 2010, pp. 62--74. {Online}. Available:

Digital Library

Google Scholar

Cited By

View all

Hiesgen RNawrocki MBarcellos MKopp DHohlfeld OChan EDobbins RDoerr CRossow CThomas DJonker MMok RLuo XKristoff JSchmidt TWählisch Mclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS AssessmentsProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688451(259-279)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688451
Gao MMok RCarisimo ELi EKulkarni Sclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)DarkSim: A similarity-based time-series analytic framework for darknet trafficProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688426(241-258)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688426
Griffioen HKoursiounis GSmaragdakis GDoerr CVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)Have you SYN me? Characterizing Ten Years of Internet ScanningProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688409(149-164)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688409
Show More Cited By

Quantifying the Spectrum of Denial-of-Service Attacks through Internet Backscatter
1. General and reference
  1. Cross-computing tools and techniques
2. Networks
  1. Network services

Recommendations

Mitigating denial of service attacks: a tutorial

This tutorial describes what Denial of Service (DOS) attacks are. how they can be carried out in IP networks, and how one can defend against them. Distributed DoS (DDoS) attacks are included here as a subset of DoS attacks. A DoS attack has two phases: ...
Denial-of-service attacks and countermeasures on BitTorrent

BitTorrent has been widely used for the efficient distribution of files, such as digital content and media files, to very large numbers of users. However, previous work has exposed vulnerabilities in the protocol and demonstrated that they can be ...
Surviving Distributed Denial-of-Service Attacks

A series of distributed denial-of-service (DDoS) attacks were launched against computer systems and services in the US and South Korea beginning July 4th. A DDoS attack is an attempt to make a computer service unavailable to its intended users. The ...

Comments

Information & Contributors

Information

Published In

ARES '17: Proceedings of the 12th International Conference on Availability, Reliability and Security

August 2017

853 pages

ISBN:9781450352574

DOI:10.1145/3098954

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 29 August 2017

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Conference

ARES '17

ARES '17: International Conference on Availability, Reliability and Security

August 29 - September 1, 2017

Reggio Calabria, Italy

Acceptance Rates

ARES '17 Paper Acceptance Rate 100 of 191 submissions, 52%;

Overall Acceptance Rate 228 of 451 submissions, 51%

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

26
Total Citations
View Citations
253
Total Downloads

Downloads (Last 12 months)34
Downloads (Last 6 weeks)2

Reflects downloads up to 06 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

View all

Hiesgen RNawrocki MBarcellos MKopp DHohlfeld OChan EDobbins RDoerr CRossow CThomas DJonker MMok RLuo XKristoff JSchmidt TWählisch Mclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS AssessmentsProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688451(259-279)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688451
Gao MMok RCarisimo ELi EKulkarni Sclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)DarkSim: A similarity-based time-series analytic framework for darknet trafficProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688426(241-258)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688426
Griffioen HKoursiounis GSmaragdakis GDoerr CVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)Have you SYN me? Characterizing Ten Years of Internet ScanningProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688409(149-164)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3688409
Collins MHussain ASchwab S(2023)Identifying and Differentiating Acknowledged Scanners in Network Traffic2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)10.1109/EuroSPW59978.2023.00069(567-574)Online publication date: Jul-2023
https://doi.org/10.1109/EuroSPW59978.2023.00069
Tanaka AHan CTakahashi T(2023)Detecting Coordinated Internet-Wide Scanning by TCP/IP Header FingerprintIEEE Access10.1109/ACCESS.2023.324947411(23227-23244)Online publication date: 2023
https://doi.org/10.1109/ACCESS.2023.3249474
Pawlicki MZadnik MKozik RChoraś M(2023)Analysis and Detection of DDoS Backscatter Using NetFlow Data, Hyperband-Optimised Deep Learning and Explainability TechniquesArtificial Intelligence and Soft Computing10.1007/978-3-031-23492-7_8(82-92)Online publication date: 24-Jan-2023
https://doi.org/10.1007/978-3-031-23492-7_8
Nawrocki MHiesgen RSchmidt TWählisch MLevin DMislove AAmann JLuckie M(2021)QUICsandProceedings of the 21st ACM Internet Measurement Conference10.1145/3487552.3487840(283-291)Online publication date: 2-Nov-2021
https://dl.acm.org/doi/10.1145/3487552.3487840
Griffioen HOosthoek Kvan der Knaap PDoerr CKim YKim JVigna GShi E(2021)Scan, Test, Execute: Adversarial Tactics in Amplification DDoS AttacksProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security10.1145/3460120.3484747(940-954)Online publication date: 12-Nov-2021
https://dl.acm.org/doi/10.1145/3460120.3484747
Tanaka AHan CTakahashi TFujisawa K(2021)Internet-Wide Scanner Fingerprint Identifier Based on TCP/IP Header2021 Sixth International Conference on Fog and Mobile Edge Computing (FMEC)10.1109/FMEC54266.2021.9732414(1-6)Online publication date: 6-Dec-2021
https://doi.org/10.1109/FMEC54266.2021.9732414
Niraja KSrinivasa Rao S(2021)A hybrid algorithm design for near real time detection cyber attacks from compromised devices to enhance IoT securityMaterials Today: Proceedings10.1016/j.matpr.2021.01.751Online publication date: Mar-2021
https://doi.org/10.1016/j.matpr.2021.01.751
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Cited By

Recommendations

Mitigating denial of service attacks: a tutorial

Denial-of-service attacks and countermeasures on BitTorrent

Surviving Distributed Denial-of-Service Attacks

Comments

Published In

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Acceptance Rates

Other Metrics

Article Metrics

Other Metrics

Cited By

Login options

Full Access

PDF

eReader

Abstract

References

Cited By

Recommendations

Mitigating denial of service attacks: a tutorial

Denial-of-service attacks and countermeasures on BitTorrent

Surviving Distributed Denial-of-Service Attacks

Comments

Information

Published In

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Acceptance Rates

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Get Access

Login options

Full Access

View options

PDF

eReader

Figures

Other

Share

Share this Publication link

Share on social media

Affiliations