MAfIc: Adaptive packet dropping for cutting malicious flows to push back DDoS attacks

Yu Chen; Yu Kwong Kwok; Kai Hwang

doi:10.1109/ICDCSW.2005.84

MAfIc: Adaptive packet dropping for cutting malicious flows to push back DDoS attacks

Yu Chen, Yu Kwong Kwok, Kai Hwang

Research output: Contribution to conference › Paper › peer-review

13 Citations (Scopus)

Abstract

In this paper, we propose a new approach called MAFIC (MAlicious Flow Identification and Cutoff) to support adaptive packet dropping to fend off DDoS attacks. MAFIC works by judiciously issuing lightweight probes to flow sources to check if they are legitimate. Through such probing, MAFIC would drop malicious attack packets with high accuracy while minimizes the loss on legitimate traffic flows. Our NS-2 based simulation indicates that MAFIC algorithm drops packets from unresponsive potental attack flows with an accuracy as high as 99% and reduces the loss of legitimate flows to less than 3%. Furthermore, the false positive and negative rates are low-only around 1% for a majority of the cases.

Original language	English
DOIs	https://doi.org/10.1109/ICDCSW.2005.84
Publication status	Published - 2005
Externally published	Yes
Event	25th IEEE International Conference on Distributed Computing Systems Workshops, ICDCS 2005 - Columbus, OH, United States Duration: 6 Jun 2005 → 10 Jun 2005

Conference

Conference	25th IEEE International Conference on Distributed Computing Systems Workshops, ICDCS 2005
Country/Territory	United States
City	Columbus, OH
Period	6/06/05 → 10/06/05

Keywords

DDoS defense
Duplicated ACKs
Malicious flows
Packet dropping policy
Probing

Access to Document

10.1109/ICDCSW.2005.84

Cite this

@conference{51b18f30a7f0491580be8b57cae1a6c1,

title = "MAfIc: Adaptive packet dropping for cutting malicious flows to push back DDoS attacks",

abstract = "In this paper, we propose a new approach called MAFIC (MAlicious Flow Identification and Cutoff) to support adaptive packet dropping to fend off DDoS attacks. MAFIC works by judiciously issuing lightweight probes to flow sources to check if they are legitimate. Through such probing, MAFIC would drop malicious attack packets with high accuracy while minimizes the loss on legitimate traffic flows. Our NS-2 based simulation indicates that MAFIC algorithm drops packets from unresponsive potental attack flows with an accuracy as high as 99% and reduces the loss of legitimate flows to less than 3%. Furthermore, the false positive and negative rates are low-only around 1% for a majority of the cases.",

keywords = "DDoS defense, Duplicated ACKs, Malicious flows, Packet dropping policy, Probing",

author = "Yu Chen and Kwok, {Yu Kwong} and Kai Hwang",

note = "Publisher Copyright: {\textcopyright} 2005 IEEE; 25th IEEE International Conference on Distributed Computing Systems Workshops, ICDCS 2005 ; Conference date: 06-06-2005 Through 10-06-2005",

year = "2005",

doi = "10.1109/ICDCSW.2005.84",

language = "English",

}

TY - CONF

T1 - MAfIc

T2 - 25th IEEE International Conference on Distributed Computing Systems Workshops, ICDCS 2005

AU - Chen, Yu

AU - Kwok, Yu Kwong

AU - Hwang, Kai

PY - 2005

Y1 - 2005

N2 - In this paper, we propose a new approach called MAFIC (MAlicious Flow Identification and Cutoff) to support adaptive packet dropping to fend off DDoS attacks. MAFIC works by judiciously issuing lightweight probes to flow sources to check if they are legitimate. Through such probing, MAFIC would drop malicious attack packets with high accuracy while minimizes the loss on legitimate traffic flows. Our NS-2 based simulation indicates that MAFIC algorithm drops packets from unresponsive potental attack flows with an accuracy as high as 99% and reduces the loss of legitimate flows to less than 3%. Furthermore, the false positive and negative rates are low-only around 1% for a majority of the cases.

AB - In this paper, we propose a new approach called MAFIC (MAlicious Flow Identification and Cutoff) to support adaptive packet dropping to fend off DDoS attacks. MAFIC works by judiciously issuing lightweight probes to flow sources to check if they are legitimate. Through such probing, MAFIC would drop malicious attack packets with high accuracy while minimizes the loss on legitimate traffic flows. Our NS-2 based simulation indicates that MAFIC algorithm drops packets from unresponsive potental attack flows with an accuracy as high as 99% and reduces the loss of legitimate flows to less than 3%. Furthermore, the false positive and negative rates are low-only around 1% for a majority of the cases.

KW - DDoS defense

KW - Duplicated ACKs

KW - Malicious flows

KW - Packet dropping policy

KW - Probing

UR - http://www.scopus.com/inward/record.url?scp=80052201538&partnerID=8YFLogxK

U2 - 10.1109/ICDCSW.2005.84

DO - 10.1109/ICDCSW.2005.84

M3 - Paper

AN - SCOPUS:80052201538

Y2 - 6 June 2005 through 10 June 2005

ER -

MAfIc: Adaptive packet dropping for cutting malicious flows to push back DDoS attacks

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this