Distributed defense against distributed denial-of-service attacks

Distributed defense is a promising way to neutralize the distributed Denial-of-Service attacks by detecting and responding the attacking sources widespread around the Internet. Components of the distributed defense system will cooperate with each other to combat the attacks. Compared with the centralized defense systems, distributed defense systems can discover the attacks more timely from both source end and victim end, fight the attacks with more resources and take advantage of more flexible strategies. This paper investigates 7 distributed defense systems which make use of various strategies to mitigate the DDoS attacks. Different architectures are designed in these 7 systems to provide distributed DDoS defense solutions. We evaluate these systems in terms of deployment, detection, response, security, robustness and implementation. For each criteria, we give a recommendation on which technologies are best suitable for a successful distributed defense system based on the analysis result. Finally we propose our idea on the design of an effective distributed defense system.

Decision analysis of statistically detecting distributed denial-of-service flooding attacks

There are two statistical decision making questions regarding statistically detecting sings of denial-of-service flooding attacks. One is how to represent the distributions of detection probability, false alarm probability and miss probability. The other is how to quantitatively express a decision region within which one may make a decision that has high detection probability, low false alarm probability and low miss probability. This paper gives the answers to the above questions. In addition, a case study is demonstrated.

Protecting web services from distributed denial of service attacks

The outcome of the research was the development of three network defence systems to protect corporate network infrastructure. The results showed that these defences were able to detect and filter around 94% of the DDoS attack traffic within a matter of seconds.

Keynote : Detection of and defense against distributed denial-of-service (DDoS) attacks

Distributed denial-of-service (DDoS) attacks typically exhaust bandwidth, processing capacity, or memory of a targeted machine, service or network. Despite enormous efforts in combating DDoS attacks in the past decade, DDoS attacks are still a serious threat to the security of cyberspace. In this talk I shall outline the recent efforts of my research group in detection of and defence against DDoS attacks. In particular, this talk will concentrate on the following three critical issues related to DDoS attacks: (1) Traceback of DDoS attacks; (2) Detection of low-rate DDoS attacks; and (3) Discriminating DDoS attacks from flash crowds.

Distributed denial of service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.

New criminal sanctions-inflicting pain through the denial of employment and education

Imprisonments and fines are the standard sanctions employed by most western countries in punishing offenders.  Where neither of these penalties is appropriate, the courts normally have a variety of indeterminate sanctions at their disposal.  However the general effectiveness of these sanctions is questionable.  This paper argues that the criminal justice system has been too slow and unimaginative in developing efficient and effective methods of punishing offenders.  There are ways of inflicting pain on offenders that do not encroach on their liberty or affect their material wealth.  It is suggested that new sentencing options should include the annulment or suspension of an offenders academic qualifications and the making of orders preventing an offender from working or being enrolled in an educational or vocational pursuit.

Case comment: Cubillo and Gunner V The Commonwealth: a denial of the stolen generation?

In the recent Australian decision in Cubillo and Gunner v The Commonwealth ( ‘Cubillo 3’ ), the Full Court of the Federal Court dismissed an appeal by the Aboriginal claimants seeking damages for, inter alia, their removal from their families and detention at certain Aboriginal institutions. The removal and detention of the plaintiffs was held to be lawful in the earlier determination of O’Loughlin J because it was, inter alia, believed to be in the [then] child’s best interests and, as the plaintiffs bore the onus of proof, they had failed to show that they were taken without the consent of their parents/guardians. This decision was based upon the factual finding that ‘at the relevant times, there was no general policy in force in the Northern Territory supporting the indiscriminate removal and detention of part-Aboriginal children, irrespective of the personal circumstances of each child’. The Full Court did not comment on O’Loughlin J’s assertion that the policy of removing part-Aboriginal children, as asserted by the plaintiffs, could not be maintained. Moreover, the Full Court in fact joined O’Loughlin J in trying to distance their findings from the broader issue of the legal rights of members of the Stolen Generation, emphasising that they were only concerned with the particular circumstances of the two plaintiffs/appellants. This case comment is not aimed at evaluating the specific legal issues raised by the plaintiffs’ claims in this case or reviewing the history of the Stolen Generation, but rather seeks to examine O’Loughlin J’s comment as to the absence of a policy of indiscriminate removal and detention of part-Aboriginal children in a bid to determine the parameters intended by the court. It will be seen that, at its broadest, the statement is quite inflammatory and may be seen as a denial of the Stolen Generation. It will be submitted that this was not intended by the court. At its narrowest, the statement is merely an assertion that the particular plaintiffs failed to prove their cases. It will be submitted that, whilst this clearly was the view of the court, O’Loughlin J’s statement does have broader implications which, it will be contended, are not warranted.

Service provision factors that affect the health and wellbeing of people living in a lower SES environment: the perspective of service providers

Inequalities in health and wellbeing within low socioeconomic (SES)  environments are well documented. Factors inherent to the health care system itself, such as inaccessible, inflexible or inappropriate seroiceprovision, contribute to the poorer health status ofresidents oflow SES areas. This paper explores the issues ofseroice provision in low SES areas, documenting the perceptions of seroice providers about the seroice needs of residents, in order to understand the systemic factors that negatively impact on health and wellbeing. A total of54 health and welfare seroice providers from two adjacent low SES suburbs within regional Victoria were interoiewed using qualitative research methods. Keyfindings indicate that successful navigation of health care seroices by residents within these low SES environments is being impeded by issues ofaccess, a lack ofappropriate early interoention options or measures, and general resident disempowerment. Central to the improvement of seroice provision is the need for seroices to become economically, geographically and culturally accessible. In particular, the importance of community involvement in health planning and health promoting seroices must be reflected in the ethos ofseroice provision.

The impact of service intangibility on consumer service quality expectations

Research consistently demonstrates the strategic benefits of providing quality in service delivery (Tse and Wilton 1988; Anderson and Zeithaml 1984). However, to deliver a quality service, it is first necessary to determine the level of quality expectations that consumers have for a particular service industry. This paper examines whether quality expectations vary across services based on their degree of total intangibility. A controlled, repeated measures design is utilised, whereby subjects are each asked to evaluate three services that vary in their degree of intangibility. Contrary to past findings, results indicate that consumer expectations for service quality do not vary with the level of intangibility of the service.

Quality-of-service routing for web-based multimedia servers

Quality-of-Service is an important issue in multimedia applications; so far most of the research focuses on bandwidth guarantee, few pays attention to the server performance guarantee. In this paper we pay more attention to the server performance guarantee under the prerequisite of guaranteed bandwidth quality. We take advantage of anycast to find the "best" multimedia server among a distributed server group in terms of bandwidth, the request will be submitted to the selected server, moreover, the selected server's neighbours' (all the servers with feasible paths) addresses are delivered to the selected server simultaneously. If the selected server can not guarantee the QoS for the request in terms of server performance, then a proposed QoS-Aware Server Load Deviation (QASLD) mechanism wiII be employed, which will deliver the request to one of its neighbours until there exists a suitable server that can guarantee the server performance for the request. Our experiments show that the proposed QASLD algorithm works well.

Service failure and recovery in the presence of service guarantees

This paper presents a conceptual model and propositions outlining how, in a service recovery encounter, service guarantees (unconditional and specific) operate in conjunction with other organisational recovery variables (guarantee facilitation and service provider concern), to influence customers’ justice perceptions and subsequent satisfaction evaluations.