Adaptive defense against various network attacks

    Authors

    C. C. Zou; N. Duffield; D. Towsley;W. B. Gong

    Comments

    Authors: contact us about adding a copy of your work at STARS@ucf.edu

    Abbreviated Journal Title

    IEEE J. Sel. Areas Commun.

    Keywords

    adaptive defense; computer security; distributed denial-of-service; (DDoS); Internet worm; SYN flood; Engineering, Electrical & Electronic; Telecommunications

    Abstract

    In defending against various network attacks, such as distributed denial-of-service (DDoS) attacks or worm attacks, a defense system needs to deal with various network conditions and dynamically changing attacks. Therefore, a good defense system needs to have a built-in "adaptive defense" functionality based on cost minimization-adaptively adjusting its configurations according to the network condition and attack severity in order to minimize the combined cost introduced by false positives (misidentify normal traffic as attack) and false negatives (misidentify attack traffic as normal) at any time. In this way, the adaptive defense system can generate fewer false alarms in normal situations or under light attacks with relaxed defense configurations, while protecting a network or a server more vigorously under severe attacks. In this paper, we present concrete adaptive defense system designs for defending against two major network attacks: SYN flood DDoS attack and Internet worm infection. The adaptive defense is a high-level system design that can be built on various underlying nonadaptive detection and filtering algorithms, which makes it applicable for a wide range of security defenses.

    Journal Title

    Ieee Journal on Selected Areas in Communications

    Volume

    24

    Issue/Number

    10

    Publication Date

    1-1-2006

    Document Type

    Article

    Language

    English

    First Page

    1877

    Last Page

    1888

    WOS Identifier

    WOS:000241016500010

    ISSN

    0733-8716

    Share

    COinS