Paper Info
Title
Witnessing distributed denial-of-service traffic from an attacker's network
Abstract
In July 2009, surprising large-scale Distributed Denial-of-Service (DDoS) attacks simultaneously targeted US and South Korean government, military, and commercial websites. Initial speculation was that this was well-designed cyber warfare from North Korea, but the truth is still unknown. What was even more surprising was how these critical infrastructures were still vulnerable after a decade of research on DDoS attacks. These particular incidents, the so-called 7.7 (July 7th) DDoS attacks, were highlighted not just because of their success but also because of their well-coordinated strategy. The 3.3 (March 3rd, 2011) DDoS attacks had similar characteristics to the 7.7 DDoS attacks, but they were not as successful because of the rapid vaccination of the zombie hosts. In this paper, we suggest that it is worthwhile to take a step back from the target side of the DDoS attacks and look at the problem in terms of network traffic from the attacker's side. We collected a unique large-scale sample of DDoS attack traffic from the two real-world incidents (not simulated), and we provide an analysis of traffic patterns from the perspective of the attacker's hosting network.
Year
Venue
Keywords
2011
CNSM
south korean government,traffic pattern,critical infrastructure,target side,denial-of-service traffic,ddos attack traffic,ddos attack,network traffic,north korea,unique large-scale sample,commercial web,malware,servers,ddos,government,distributed denial of service,distributed processing,protocols
Field
DocType
Citations 
Internet privacy,Traffic analysis,Denial-of-service attack,Trinoo,Computer science,Cyberwarfare,Computer security,Server,Computer network,Zombie,Malware,Application layer DDoS attack
Conference
0
PageRank 
References 
Authors
0.34
8
3
Name
Order
Citations
PageRank
Sin-Seok Seo1879.84
Young J. Won212212.22
James Won-Ki Hong3713122.26