3rd International ICST Symposium on Information Assurance and Security

Research Article

Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain

  • @INPROCEEDINGS{10.1109/IAS.2007.23,
        author={Anjali  Sardana and Krishan Kumar and R.  C. Joshi},
        title={Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain},
        proceedings={3rd International ICST Symposium on  Information Assurance and Security},
        publisher={IEEE},
        proceedings_a={IAS},
        year={2007},
        month={9},
        keywords={Bandwidth  Communication channels  Computer crime  Counting circuits  Degradation  Entropy  Information security  Linux  Service oriented architecture  TCPIP},
        doi={10.1109/IAS.2007.23}
    }
    
  • Anjali Sardana
    Krishan Kumar
    R. C. Joshi
    Year: 2007
    Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain
    IAS
    IEEE
    DOI: 10.1109/IAS.2007.23
Anjali Sardana1,*, Krishan Kumar2,*, R. C. Joshi2,*
  • 1: Indian Institute of Technology, Roorke
  • 2: Indian Institute of Technology, Roorkee
*Contact email: anjlsdec@iitr.ernet.in, kksaldec@iitr.ernet.in, joshifcc@iitr.ernet.in

Abstract

The inherent vulnerabilities in TCT/IP architecture give dearth of opportunities to DDoS attackers. The array of schemes proposed for detection of these attacks in real time is either targeted towards low rate attacks or high bandwidth attacks. Tresence of low rate attacks leads to graceful degradation of QoS in the network thus making them further undetectable. In this paper, we propose a scheme that uses three lines of defense. The first line of defense is towards detecting the presence of low rate as well as high bandwidth attacks based on entropy variations in small time windows. The second line of defense identifies and tags attack flows in real time. The last line of defense is redirecting the attack flows to honeypot server that responds in contained manner to the attack flows, thus providing deterrence and maintaining QoS at ISP level. We validate the effectiveness of the approach with simulation in ns-2 on a Linux platform.