Dual-level defense for networks under DDoS attacks

Abstract

DDoS has become one of the thorniest problems in the Internet, and aims to deny legitimate users of the services they should have. In this paper, we introduce novel dual - level attack defense against the DDoS attacks. The macroscopic level detectors attempt to detect voluminous congestion inducing attacks which cause apparent slowdown in network functionality. The subsequent characterization process identifies these large volumes attacks that have been detected early in transit domain. The microscopic level detectors detect sophisticated attacks that cause network performance to degrade gracefully and remain undetected in transit domain. The subsequent characterization process identifies such attacks that have been detected at border routers in stub domain near the victim. We employ the concepts of change point detection on entropy with time to improve the detection rate. Honeypots help achieve high detection and filtering accuracy. In addition to being competitive than other techniques, the defense works well in the presence of different DDoS attacks. The compromise of detection and characterization accuracy and time of confirming is a critical aspect and the proposed technique provides the quite demanded solution.