Skip to main navigation Skip to search Skip to main content

HAWK: Halting Anomalies with Weighted choKing to rescue well-behaved TCP sessions from shrew DDoS attacks

Research output: Contribution to journal › Conference article › peer-review

44 Citations (Scopus)

Abstract

High availability in network services is crucial for effective large-scale distributed computing. While distributed denial-of-service (DDoS) attacks through massive packet flooding have baffled researchers for years, a new type of even more detrimental attack - shrew attacks (periodic intensive packet bursts with low average rate) - has recently been identified. Shrew attacks can significantly degrade well-behaved TCP sessions, repel potential new connections, and are very difficult to detect, not to mention defend against, due to its low average rate. We propose a new stateful adaptive queue management technique called HAWK (Halting Anomaly with Weighted choKing) which works by judiciously identifying malicious shrew packet flows using a small flow table and dropping such packets decisively to halt the attack such that well-behaved TCP sessions can re-gain their bandwidth shares. Our NS-2 based extensive performance results indicate that HAWK is highly agile.

Original languageEnglish
Pages (from-to)423-432
Number of pages10
JournalLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume3619
DOIs
Publication statusPublished - 2005
Externally publishedYes
EventThird International Conference on Computer Network and Mobile Computing, ICCNMC 2005 - Zhangjiajie, China
Duration: 2 Aug 2005 → 4 Aug 2005

Fingerprint

Dive into the research topics of 'HAWK: Halting Anomalies with Weighted choKing to rescue well-behaved TCP sessions from shrew DDoS attacks'. Together they form a unique fingerprint.

Cite this