Distributed management architecture for cooperative detection and reaction to DDoS attacks

Koutepas, G; Stamatelopoulos, F; Maglaris, B

dc.contributor.author	Koutepas, G	en
dc.contributor.author	Stamatelopoulos, F	en
dc.contributor.author	Maglaris, B	en
dc.date.accessioned	2014-03-01T11:44:37Z
dc.date.available	2014-03-01T11:44:37Z
dc.date.issued	2004	en
dc.identifier.issn	10647570	en
dc.identifier.uri	https://dspace.lib.ntua.gr/xmlui/handle/123456789/37042
dc.subject	Automated reaction	en
dc.subject	Distributed management	en
dc.subject	Inter-domain	en
dc.subject	Multicast	en
dc.subject	Network security	en
dc.subject.other	Data processing	en
dc.subject.other	Demodulation	en
dc.subject.other	Information technology	en
dc.subject.other	Multicasting	en
dc.subject.other	Optimization	en
dc.subject.other	Security of data	en
dc.subject.other	Software prototyping	en
dc.subject.other	Websites	en
dc.subject.other	Automated reaction	en
dc.subject.other	Distributed management	en
dc.subject.other	Inter-domain	en
dc.subject.other	Network security	en
dc.subject.other	Computer networks	en
dc.title	Distributed management architecture for cooperative detection and reaction to DDoS attacks	en
heal.type	other	en
heal.identifier.primary	10.1023/B:JONS.0000015699.50210.e3	en
heal.identifier.secondary	http://dx.doi.org/10.1023/B:JONS.0000015699.50210.e3	en
heal.publicationDate	2004	en
heal.abstract	We propose a cooperative intrusion detection framework focused on countering Distributed Denial-of-Service (DDoS) attacks through the introduction of a distributed overlay early-warning network. Our goal is to minimize the detection and reaction time and automate responses, while involving as many networks as possible along the attack path. The proposed approach relies on building a ""community"" of trusted partners that will cooperate by exchanging security information so that inclusion in the attack path is detected locally and without traceback procedures. The main building block is the Cooperative anti-DDoS Entity, a modular software system deployed in each participating network domain that supports secure message exchanges and local responses tailored to individual sites' policies. We discuss the operation and the implementation of a prototype, and we provide a survey of the methodologies against DDoS and compare our approach to related work.	en
heal.journalName	Journal of Network and Systems Management	en
dc.identifier.doi	10.1023/B:JONS.0000015699.50210.e3	en
dc.identifier.volume	12	en
dc.identifier.issue	1	en
dc.identifier.spage	73	en
dc.identifier.epage	94	en