We present a new solution to the problem of determining the path a packet traversed over the Internet (called the traceback problem) during a denial of service attack. This paper reframes the traceback problem as a polynomial reconstruction problem and uses algebraic techniques from coding theory and learning theory to provide robust methods of transmission and reconstruction. 1

Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents two taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria was selected to highlight commonalities and important features of attack strategies, that define challenges and dictate the design of countermeasures. The defense taxonomy classifies the body of existing DDoS defenses based on their design decisions; it then shows how these decisions dictate the advantages and deficiencies of proposed solutions.

To understand the threat posed by computer worms, it is necessary to understand the classes of worms, the attackers who may employ them, and the potential payloads. This paper describes a preliminary taxonomy based on worm target discovery and selection strategies, worm carrier mechanisms, worm activation, possible payloads, and plausible attackers who would employ a worm.

Privilege separation partitions a single program into two parts: a privileged program called the monitor and an unprivileged program called the slave. All trust and privileges are relegated to the monitor, which results in a smaller and more secure trust base. Previously the privilege separation procedure, i.e., partitioning one program into the monitor and slave, was done by hand [17, 26]. We design techniques and develop a tool called Privtrans that allows us to automatically add privilege separation to source code, provided a few programmer annotations. Additionally, we propose optimization techniques that augment static analysis with dynamic information. Our optimization techniques reduce the number of expensive calls made by the slave to the monitor. We show Software security provides the first line of defense against malicious attacks. Unfortunately, most software is written in unsafe languages such as C. Unsafe operations may lead to buffer overflows, format string vulnerabilities, off-by-one errors, and other common vulnerabilities. Exploiting a vulnerability can subvert a programs ’ logic, resulting in unintended execution paths such as inappropriately

The use of software fault trees for requirements identification and analysis in an Intrusion Detection System (IDS) is described. Intrusions are divided into seven stages, following Ruiu, and a fault subtree is developed to model each stage (e.g., reconnaissance, penetration, etc.). The software fault tree approach supports requirements evolution as new intrusions are identified as well as prioritized, incremental development of the distributed IDS. The IDS under development is a collection of mobile agents that detect, classify, and correlate system and network activities. Analysis of the software fault trees and the minimum cut sets identify the software requirements. These derived requirements include what activities are to be monitored in the agent software, what intrusion characteristics the agents should correlate, where the IDS agents are to be placed to feasibly detect the intrusions, and what countermeasures the software should take. Two examples of intrusions demonstrate how the

[no abstract] The reliable operation of our networked computing infrastructure is essential to many governmental and corporate activities. Unfortunately, this infrastructure is highly vulnerable to automated attacks by computer worms: programs that propagate themselves to all vulnerable machines on the Internet. Such wide-scale malicious code is a major threat.

Distributed denial-of-service (DDoS) attacks are a grave and challenging problem. Perpetration requires little effort on the attacker's side, since a vast number of insecure machines provides fertile ground for attack zombies, and automated scripts for exploit and attack can easily be downloaded and deployed. On the other hand, prevention of the attack or the response and traceback of perpetrators is extremely difficult due to a large number of attacking machines, the use of source-address spoofing and the similarity between legitimate and attack traffic. Many defense systems have been designed in the research and commercial communities to counter DDoS attacks, yet the problem remains largely unsolved. This thesis explores the problem of DDoS defense from two directions: (1) it strives to understand the origin of the problem and all its variations, and provides a survey of existing solutions, and (2) it presents the design (and implementation) of a source-end DDoS defense system called D-WARD that prevents outgoing attacks from deploying networks. Source-end defense is not the complete solution to DDoS attacks, since networks that do not deploy the proposed defense can still perform successful attacks. However, this thesis shows that a source-end defense (implemented in the D-WARD system) can detect and prevent a significant number of DDoS attacks, does not incur significant cost for its operation, and offers good service to legitimate traffic during the attack. By performing successful differentiation between legitimate and attack traffic close to the source, sour...

Proxy-network based overlays have been proposed to pro-tect Internet Applications against Denial-of-Service attacks by hiding an application's location. We study how a proxy network's topology influences the effectiveness of location-hiding. We present two theorems which quantitatively char-acterize when proxy networks are robust against attacks (at-tackers ' impact can be quickly and completely removed), and when they are vulnerable to attacks (attackers ' im-pact cannot be completely removed). Using these theorems, we study a range of proxy network topologies, and iden-tify those topologies favorable for location-hiding and resist-ing Denial-of-Service attacks. We have found that popular overlay network topologies such as Chord [25], which has been suggested for location-hiding, is in fact not a favorable topology for such purposes; we have also shown that CAN [21], a less popular overlay network, can be a good topol-ogy for location-hiding. Our theoretical results provide a set of sound design principles on proxy networks used for location-hiding. 1.

Integrating real world applications

Abstract: The phenomenal growth and success of Internet has changed the way traditional essential services such as banking, transportation, medicine, education and defence are operated. Now they are being progressively replaced by cheaper and more efficient Internet-based applications. In present era, the world is highly dependent on the Internet and it is considered as main infrastructure of the global information society. Therefore, the availability of Internet is very critical for the socio-economic growth of the society. However, the inherent vulnerabilities of the Internet architecture provide opportunities for a lot of attacks on its infrastructure and services. Distributed denial-of-service attack is one such kind of attack, which poses an immense threat to the availability of the Internet. One of the biggest challenges before researchers is to find details of these attacks because to avoid defamation most of the commercial sites do not even reveal that they were attacked. In this paper, an overview of distributed denial-of-service problem and Inherent vulnerabilities in the Internet architecture are provided. Real distributed denial-of-service incidents with their financial impact are critically analyzed and finally need for a comprehensive distributed denial-of-service solution is highlighted.