Source-based filtering scheme against DDOS attacks

IP address spoofing is employed by a lot of DDoS attack tools. Most of the current research on DDoS attack packet filtering depends on cooperation among routers, which is hard to achieve in real campaigns. Therefore, in the paper, we propose a novel filtering scheme based on source information in this paper to defend against various source IP address spoofing. The proposed method works independently at the potential victim side, and accumulates the source information of its clients, for instance, source IP addresses, hops from the server during attacks free period. When a DDoS attack alarm is raised, we can filter out the attack packets based on the accumulated knowledge of the legitimate clients. We divide the source IP addresses into n(1 ≤ n ≤ 32) segments in our proposed algorithm; as a result, we can therefore release the challenge storage and speed up the procedure of information retrieval. The system which is proposed by us and the experiments indicated that the proposed method works effectively and efficiently.

Human sympathetic nerve biology : parallel influences of stress and epigenetics in essential hypertension and panic disorder

Patients with panic disorder provide a clinical model of stress. On a "good day," free from a panic attack, they show persistent stress-related changes in sympathetic nerve biology, including abnormal sympathetic nerve single-fiber firing ("salvos" of multiple firing within a cardiac cycle) and release of epinephrine as a cotransmitter. The coreleased epinephrine perhaps originates from in situ synthesis by phenylethanolamine N-methyltransferase (PNMT). In searching for biological evidence that essential hypertension is caused by mental stress—a disputed proposition—we note parallels with panic disorder, which provides an explicit clinical model of stress: (1) There is clinical comorbidity; panic disorder prevalence is increased threefold in essential hypertension. (2) For both, epinephrine cotransmission is present in sympathetic nerves. (3) In panic disorder and essential hypertension, but not in health, single-fiber sympathetic nerve firing salvos occur. (4) Tissue nerve growth factor is increased in both conditions (nerve growth factor is a stress reactant). (5) There is induction of PNMT in sympathetic nerves. Essential hypertension exhibits a further manifestation of mental stress: there is activation of noradrenergic brain stem neurons projecting to the hypothalamus and amygdala. These pathophysiological findings strongly support the view that chronic mental stress is important in the pathogenesis of essential hypertension. A hypothesis now under test is whether in both disorders, under prevailing conditions of ongoing stress, PNMT induced in sympathetic nerves acts as a DNA methylase, causing the norepinephrine transporter (NET) gene silencing that is present in both conditions. PNMT can have an intranuclear distribution, binding to DNA. We have demonstrated that the reduced neuronal noradrenaline reuptake present in both disorders does have an epigenetic mechanism, with demonstrable reduction in the abundance of the transporter protein, the NET gene silencing being associated with DNA binding by the methylation-related inhibitory transcription factor MeCP2.

A controlled trial of internet-based cognitive-behavioural therapy for panic disorder with face-to-face support from a general practitioner or email support from a psychologist

Background: Panic disorder (PD) is one of the most common anxiety disorders seen in general practice, but provision of evidence-based cognitive-behavioural treatment (CBT) is rare. Many Australian GPs are now trained to deliver focused psychological strategies, but in practice this is time consuming and costly.

Objective: To evaluate the efficacy of an internet-based CBT intervention (Panic Online) for the treatment of PD supported by general practitioner (GP)-delivered therapeutic assistance.

Design: Panic Online supported by GP-delivered face-to-face therapy was compared to Panic Online supported by psychologist-delivered email therapy.

Methods: Sixty-five people with a primary diagnosis of PD (78% of whom also had agoraphobia) completed 12 weeks of therapy using Panic Online and therapeutic assistance with his/her GP (n = 34) or a clinical psychologist (n = 31). The mean duration of PD for participants allocated to these groups was 59 months and 58 months, respectively. Participants completed a clinical diagnostic interview delivered by a psychologist via telephone and questionnaires to assess panic-related symptoms, before and after treatment.

Results: The total attrition rate was 20%, with no group differences in attrition frequency. Both treatments led to significant improvements in panic attack frequency, depression, anxiety, stress, anxiety sensitivity and quality of life. There were no statistically significant differences in the two treatments on any of these measures, or in the frequency of participants with clinically significant PD at post assessment.

Conclusions: When provided with accessible online treatment protocols, GPs trained to deliver focused psychological strategies can achieve patient outcomes comparable to efficacious treatments delivered by clinical psychologists. The findings of this research provide a model for how GPs may be assisted to provide evidence-based mental healthcare successfully.

Therapist-assisted, internet-based treatment for panic disorder: can general practitioners achieve comparable patient outcomes to psychologists

Background: Mental illness is an escalating concern worldwide. The management of disorders such as anxiety and depression largely falls to family doctors or general practitioners (GPs). However, GPs are often too time constrained and may lack the necessary training to adequately manage the needs of such patients. Evidence-based Internet interventions represent a potentially valuable resource to reduce the burden of care and the cost of managing mental health disorders within primary care settings and, at the same time, improve patient outcomes.
Objective: The present study sought to extend the efficacy of a therapist-assisted Internet treatment program for panic disorder, Panic Online, by determining whether comparable outcomes could be achieved and maintained when Panic Online was supported by either GPs or psychologists.
Methods: Via a natural groups design, 96 people with a primary diagnosis of panic disorder (with or without agoraphobia) completed the Panic Online program over 12 weeks with the therapeutic assistance of their GP (n = 53), who had received specialist training in cognitive behavioral therapy, or a clinical psychologist (n = 43). Participants completed a clinical diagnostic telephone interview, conducted by a psychologist, and a set of online questionnaires to assess panic-related symptoms at three time periods (pretreatment, posttreatment, and 6 month follow-up).
Results: Both treatments led to clinically significant improvements on measures of panic and panic-related symptomatology from pretreatment to posttreatment. Both groups were shown to significantly improve over time. Improvements for both groups were maintained at follow-up; however, the groups did differ significantly on two quality of life domains: physical (F₁,₈₂ = 9.13, P = .00) and environmental (F₁,₈₂ = 4.41, P = .04). The attrition rate was significantly higher among those being treated by their GP (χ²₁ = 4.40, P = .02, N = 96).
Conclusions: This study provides evidence that Internet-based interventions are an effective adjunct to existing mental health care systems. Consequently, this may facilitate and enhance the delivery of evidence-based mental health treatments to increasingly large segments of the population via primary care systems and through suitably trained health professionals.

Is internet-based CBT for panic disorder and agoraphobia as effective as face-to-face CBT

This study compared Panic Online (PO), an internet-based CBT intervention, to best-practice face-to-face CBT for people with panic disorder with or without agoraphobia. Eighty-six people with a primary diagnosis of panic disorder were recruited from Victoria, Australia. Participants were randomly assigned to either PO (n = 46) or best practice face-to-face CBT (n = 40). Effects of the internet-based CBT program were found to be comparable to those of face-to-face CBT. Both interventions produced significant reductions in panic disorder and agoraphobia clinician severity ratings, self reported panic disorder severity and panic attack frequency, measures of depression, anxiety, stress and panic related cognitions, and displayed improvements in quality of life. Participants rated both treatment conditions as equally credible and satisfying. Participants in the face-to-face CBT treatment group cited higher enjoyment with communicating with their therapist. Consistent with this, therapists’ ratings for compliance to treatment and understanding of the CBT material was higher in the face-to-face CBT treatment group. PO required significantly less therapist time than the face-to-face CBT condition.

Entropy-based collaborative detection of DDOS attacks on community networks

A community network often operates with the same Internet service provider domain or the virtual network of different entities who are cooperating with each other. In such a federated network environment, routers can work closely to raise early warning of DDoS attacks to void catastrophic damages. However, the attackers simulate the normal network behaviors, e.g. pumping the attack packages as poisson distribution, to disable detection algorithms. It is an open question: how to discriminate DDoS attacks from surge legitimate accessing. We noticed that the attackers use the same mathematical functions to control the speed of attack package pumping to the victim. Based on this observation, the different attack flows of a DDoS attack share the same regularities, which is different from the real surging accessing in a short time period. We apply information theory parameter, entropy rate, to discriminate the DDoS attack from the surge legitimate accessing. We proved the effectiveness of our method in theory, and the simulations are the work in the near future. We also point out the future directions that worth to explore in the future.

Detecting and tracing DDoS attacks by intelligent decision prototype

Over the last couple of months a large number of distributed denial of service (DDoS) attacks have occurred across the world, especially targeting those who provide Web services. IP traceback, a counter measure against DDoS, is the ability to trace IP packets back to the true source/s of the attack. In this paper, an IP traceback scheme using a machine learning technique called intelligent decision prototype (IDP), is proposed. IDP can be used on both probabilistic packet marking (PPM) and deterministic packet marking (DPM) traceback schemes to identify DDoS attacks. This will greatly reduce the packets that are marked and in effect make the system more efficient and effective at tracing the source of an attack compared with other methods. IDP can be applied to many security systems such as data mining, forensic analysis, intrusion detection systems (IDS) and DDoS defense systems.

Multi-core Defense System (MSDS) for protecting computer infrastructure against DDoS attacks

Distributed Denial of Service attacks is one of the most challenging areas to deal with in Security. Not only do security managers have to deal with flood and vulnerability attacks. They also have to consider whether they are from legitimate or malicious attackers. In our previous work we developed a framework called bodyguard, which is to help security software developers from the current serialized paradigm, to a multi-core paradigm. In this paper, we update our research work by moving our bodyguard paradigm, into our new Ubiquitous Multi-Core Framework. From this shift, we show a marked improvement from our previous result of 20% to 110% speedup performance with an average cost of 1.5 ms. We also conducted a second series of experiments, which we trained up Neural Network, and tested it against actual DDoS attack traffic. From these experiments, we were able to achieve an average of 93.36%, of this attack traffic.

Using mobile agents to recover from node and database compromise in path-based DoS attacks in wireless sensor networks

Wireless sensor networks represent a new generation of real-time embedded systems with significantly different communication constraints from the traditional networked systems. With their development, a new attack called a path-based DoS (PDoS) attack has appeared. In a PDoS attack, an adversary, either inside or outside the network, overwhelms sensor nodes by flooding a multi-hop end-to-end communication path with either replayed packets or injected spurious packets. Detection and recovery from PDoS attacks have not been given much attention in the literature. In this article, we consider wireless sensor networks designed to collect and store data. In a path-based attack, both sensor nodes and the database containing collected data can be compromised. We propose a recovery method using mobile agents which can detect PDoS attacks easily and efficiently and recover the compromised nodes along with the database.

Protecting web services from distributed denial of service attacks

The outcome of the research was the development of three network defence systems to protect corporate network infrastructure. The results showed that these defences were able to detect and filter around 94% of the DDoS attack traffic within a matter of seconds.

A distributed active defense system against DDoS attacks

This thesis proposes a novel architecture of Distributed Active Defense System (DADS) against Distibuted Denial of Service (DDoS) attacks. Three sub-systems of DADS were built. For each sub-system corresponding algorithms were developed, prototypes implemented, criteria for evaluation were set up and experiments in both simulation and real network laboratory environments were carried out.

An abnormal-based approach to effectively detect DDOS attacks

Distributed Denial-of-Service (DDoS) attacks are a serious threat to the safety and security of cyberspace. In this paper we propose a novel metric to detect DDoS attacks in the Internet. More precisely, we use the function of order α of the generalized (Rényi) entropy to distinguish DDoS attacks traffic from legitimate network traffic effectively. In information theory, entropies make up the basis for distance and divergence measures among various probability densities. We design our abnormal-based detection metric using the generalized entropy. The experimental results show that our proposed approach can not only detect DDoS attacks early (it can detect attacks one hop earlier than using the Shannon metric while order  α =2, and two hops earlier than the Shannon metric while order α =10.) but can also reduce both the false positive rate and the false negative rate, compared with the traditional Shannon entropy metric approach.

Chaos theory based detection against network mimicking DDoS attacks

DDoS attack traffic is difficult to differentiate from legitimate network traffic during transit from the attacker, or zombies, to the victim. In this paper, we use the theory of network self-similarity to differentiate DDoS flooding attack traffic from legitimate self-similar traffic in the network. We observed that DDoS traffic causes a strange attractor to develop in the pattern of network traffic. From this observation, we developed a neural network detector trained by our DDoS prediction algorithm. Our preliminary experiments and analysis indicate that our proposed chaotic model can accurately and effectively detect DDoS attack traffic. Our approach has the potential to not only detect attack traffic during transit, but to also filter it.