- Issues, Answers & A Comparison 江政祐 Henry, Cheng-You Chiang A Divide-and-Conquer Strategy for Thwarting Distributed Denial of-Service Attacks - Issues, Answers & A Comparison 江政祐 Henry, Cheng-You Chiang
Agenda Abstract INTRODUCTION 2.1 Assumptions 2.2 Overview of AD and PAD 2.5 Analysis of False Positives 3.4 Gradual Deployment Considerations 4 SIMULATION AND RESULTS A Comparison
Abstract How does this scheme deal with the problem that, nowadays, there exist : Numerous DDoS attackers Scarce and expensive filter resources
INTRODUCTION Source of Ideas FROM : Current Paper FROM: Optimal Filtering for DDoS Attacks
INTRODUCTION Mitigation techniques can be divided into two categories FIRST To regard DDoS defense as a resource allocation problem effectively suppress attackers that generate traffic at a high rate high-rate legitimate traffic may be throttled, causing “collateral damage” not effective against low-rate DDoS attacks
INTRODUCTION Mitigation techniques can be divided into two categories SECOND Two modules: an attack detection module and a packet filtering module The attack detection module is used to extract the characteristics of attack packets, i.e., “attack signatures,” such as source IP addresses or marked IP header values After the characteristics have been summarized, this information is used by the packet filtering module to filter malicious packets.
2.1 Assumptions How about the legitimate traffic from an attacking source !
2.2 Overview of AD and PAD - How to solve the LAN configuration problem
2.2 Overview of AD and PAD How to deal with the storage issue as topology gets larger !
2.5 Analysis of False Positives - How about MAC Spoofing ! IP address may not be spoofed, but MAC!
2.5 Analysis of False Positives - The Cause of false positives
3.4 Gradual Deployment Considerations The same as an earlier mentioned : - How to deal with the storage issue as topology gets larger !
4 SIMULATION AND RESULTS How about non-treelike multi-victim TOPOLOGY !
A Comparison - between my work & the paper
END