Search

Distributed denial of service attacks are the serious candidates for traffic analysis next to traffic performance evaluation. As these threats deplete the network resources rapidly particularly link parameters, modeling these attacks provide a strong base for analyzing the attack characteristics. The solution domain uses active networks for implementation, as it supports active routers which can perform customized tasks on demand and ease of deploying. The paper presents a model based on packet attributes to characterize the attack traffic and a detection and response framework based on the model. The detection mechanism uses leaky buckets to rate limit the traffic based on the packet ranking using linear arithmetic. The simulation results depicting the attack traffic passed through the network as well as the legitimate traffic dropped at the active routers, under different attack scenarios, are found to be comparable to existing solutions with improved efficiency in detection rate and time. [ABSTRACT FROM AUTHOR]