Research Article
Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain
@INPROCEEDINGS{10.1109/IAS.2007.23, author={Anjali Sardana and Krishan Kumar and R. C. Joshi}, title={Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain}, proceedings={3rd International ICST Symposium on Information Assurance and Security}, publisher={IEEE}, proceedings_a={IAS}, year={2007}, month={9}, keywords={Bandwidth Communication channels Computer crime Counting circuits Degradation Entropy Information security Linux Service oriented architecture TCPIP}, doi={10.1109/IAS.2007.23} }- Anjali Sardana
Krishan Kumar
R. C. Joshi
Year: 2007
Detection and Honeypot Based Redirection to Counter DDoS Attacks in ISP Domain
IAS
IEEE
DOI: 10.1109/IAS.2007.23
Abstract
The inherent vulnerabilities in TCT/IP architecture give dearth of opportunities to DDoS attackers. The array of schemes proposed for detection of these attacks in real time is either targeted towards low rate attacks or high bandwidth attacks. Tresence of low rate attacks leads to graceful degradation of QoS in the network thus making them further undetectable. In this paper, we propose a scheme that uses three lines of defense. The first line of defense is towards detecting the presence of low rate as well as high bandwidth attacks based on entropy variations in small time windows. The second line of defense identifies and tags attack flows in real time. The last line of defense is redirecting the attack flows to honeypot server that responds in contained manner to the attack flows, thus providing deterrence and maintaining QoS at ISP level. We validate the effectiveness of the approach with simulation in ns-2 on a Linux platform.
