A Decade of DDoS

A summary timeline by Arbor Networks of how DDoS attacks have evolved.

Olive oil and haemostasis

Olive oil is a key component of the traditional Mediterranean diet; a diet that may explain the low rate of cardiovascular disease (CVD) in Southern European. (Extra virgin) Olive oil is a good source of monounsaturated fatty acids (MUFA) and phenolic compounds, both of which have been investigated for their effects on plasma lipids and lipoproteins, measures of oxidation and factors related to thrombosis. This issue aims to summarise the current understanding of the effects of such dietary components on the haemostatic system and subsequent risk of CVD. To date, evidence suggests that diets rich in MUFA and thus in olive oil attenuate the thrombotic response via a reduction in platelet aggregation and in postprandial FVII levels. Thrombosis is a key event in causing heart attacks and strokes, which if modulated by diet could pose a cost-effective way of reducing CVD incidence in populations that adhere to MUFA/olive oil-rich diets long-term.

Blind adaptive channel estimation for dual-rate DS/CDMA signals

This letter proposes the subspace-based blind adaptive channel estimation algorithm for dual-rate quasi-synchronous DS/CDMA systems, which can operate at the low-rate (LR) or high-rate (HR) mode. Simulation results show that the proposed blind adaptive algorithm at the LR mode has a better performance than that at the HR mode, with the cost of an increasing computational complexity.

Blind channel estimation for dual-rate DS/CDMA

This paper proposes a subspace based blind adaptive channel estimation algorithm for dual-rate DS-CDMA systems, which can operate at the low-rate (LR) or high-rate (HR) mode. Simulation results show that the proposed blind adaptive algorithm at the LR mode has a better performance than that at the HR mode, with the cost of an increased computational complexity.

Bayesian coalescent analysis reveals a high rate of molecular evolution in GB virus C

GB virus C/hepatitis G (GBV-C) is an RNA virus of the family Flaviviridae. Despite replicating with an RNA-dependent RNA polymerase, some previous estimates of rates of evolutionary change in GBV-C suggest that it fixes mutations at the anomalously low rate of similar to 100(-7) nucleotide substitution per site, per year. However, these estimates were largely based on the assumption that GBV-C and its close relative GBV-A (New World monkey GB viruses) codiverged with their primate hosts over millions of years. Herein, we estimated the substitution rate of GBV-C using the largest set of dated GBV-C isolates compiled to date and a Bayesian coalescent approach that utilizes the year of sampling and so is independent of the assumption of codivergence. This revealed a rate of evolutionary change approximately four orders of magnitude higher than that estimated previously, in the range of 10(-2) to 10(-3) sub/site/year, and hence in line with those previously determined for RNA viruses in general and the Flaviviridae in particular. In addition, we tested the assumption of host-virus codivergence in GBV-A by performing a reconciliation analysis of host and virus phylogenies. Strikingly, we found no statistical evidence for host-virus codivergence in GBV-A, indicating that substitution rates in the GB viruses should not be estimated from host divergence times.

Distributed defense against distributed denial-of-service attacks

Distributed defense is a promising way to neutralize the distributed Denial-of-Service attacks by detecting and responding the attacking sources widespread around the Internet. Components of the distributed defense system will cooperate with each other to combat the attacks. Compared with the centralized defense systems, distributed defense systems can discover the attacks more timely from both source end and victim end, fight the attacks with more resources and take advantage of more flexible strategies. This paper investigates 7 distributed defense systems which make use of various strategies to mitigate the DDoS attacks. Different architectures are designed in these 7 systems to provide distributed DDoS defense solutions. We evaluate these systems in terms of deployment, detection, response, security, robustness and implementation. For each criteria, we give a recommendation on which technologies are best suitable for a successful distributed defense system based on the analysis result. Finally we propose our idea on the design of an effective distributed defense system.

Mark-aided distributed filtering by using neural network for DDoS defense

Currently Distributed Denial of Service (DDoS) attacks have been identified as one of the most serious problems on the Internet. The aim of DDoS attacks is to prevent legitimate users from accessing desired resources, such as network bandwidth. Hence the immediate task of DDoS defense is to provide as much resources as possible to legitimate users when there is an attack. Unfortunately most current defense approaches can not efficiently detect and filter out attack traffic. Our approach is to find the network anomalies by using neural network, deploy the system at distributed routers, identify the attack packets, and then filter them. The marks in the IP header that are generated by a group of IP traceback schemes, Deterministic Packet Marking (DPM)/Flexible Deterministic Packet Marking (FDPM), assist this process of identifying attack packets. The experimental results show that this approach can be used to defend against both intensive and subtle DDoS attacks, and can catch DDoS attacks’ characteristic of starting from multiple sources to a single victim. According to results, we find the marks in IP headers can enhance the sensitivity and accuracy of detection, thus improve the legitimate traffic throughput and reduce attack traffic throughput. Therefore, it can perform well in filtering DDoS attack traffic precisely and effectively.

Multiple mating and a low incidence of cuckoldry for nest-holding males in the two-spotted goby, Gobiusculus flavescens

Background: A major question in behavioural ecology concerns the relationship between genetic mating systems and the strength of sexual selection. In this study, we investigated the genetic mating system of the two-spotted goby (Gobiusculus flavescens), a useful fish model for the study of sexual selection whose genetic mating system remains uncharacterized. We developed four polymorphic microsatellite markers and used them to conduct parentage analyses on 21 nests collected during the breeding season to examine the rates of multiple mating by males and to test for evidence of alternative mating strategies.

Results: Results of this study indicate that male G. flavescens mate with multiple females and enjoy confidence of paternity. We detected only one instance of sneaking, so cuckoldry contributed a very small percentage (~0.1%) of the total fertilizations in this population. Nests were nearly full and males that maintain larger nests have higher mating and reproductive success, irrespective of body size.

Conclusion: Overall, our investigation shows that G. flavescens is similar to other, related gobies in that the nests of care-giving males often contain eggs from multiple females. However, G. flavescens differs from other gobies in displaying an extremely low rate of cuckoldry. The study of ecological factors responsible for this important

Discriminating DDoS attack traffic from flash crowd through packet arrival patterns

Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission strategies and various forms of attack packets to beat defense systems. These problems lead to defense systems requiring various detection methods in order to identify attacks. Moreover, DDoS attacks can mix their traffics during flash crowds. By doing this, the complex defense system cannot detect the attack traffic in time. In this paper, we propose a behavior based detection that can discriminate DDoS attack traffic from traffic generated by real users. By using Pearson's correlation coefficient, our comparable detection methods can extract the repeatable features of the packet arrivals. The extensive simulations were tested for the accuracy of detection. We then performed experiments with several datasets and our results affirm that the proposed method can differentiate traffic of an attack source from legitimate traffic with a quick response. We also discuss approaches to improve our proposed methods at the conclusion of this paper.

Distributed denial of service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.

Low level of extrapair parentage in wild zebra finches

The captive zebra finch, Taeniopygia guttata, has become one of the key vertebrate model systems for studying a range of behavioural, physiological and neurological phenomena. In particular, this species has played a key role in developing our understanding of sexual selection and sperm competition. In contrast with the large number of studies using domesticated zebra finches, relatively few studies have focused on free-living populations of wild zebra finches. Investigating the incidence of extrapair paternity in zebra finches in the Australian desert, we found a very low level; 1.7% of 316 offspring from four of 80 broods fathered outside the pair bond. These numbers contrast with the high levels of extrapair paternity observed in domesticated aviary populations, and suggest a low level of sperm competition and sexual selection in natural populations. Our finding of such a low rate of extrapair paternity in the wild zebra finch suggests that it is one of the most genetically monogamous of all passerine species and that has important implications for future studies of this model organism in studies of sexual selection and reproductive biology. In addition, we found that 5.4% of 316 offspring were not related to either putative parent and hatched from eggs that had been dumped by intraspecific brood parasites.

DDoS attack detection at local area networks using information theoretical metrics

DDoS attacks are one of the major threats to Internet services. Sophisticated hackers are mimicking the features of legitimate network events, such as flash crowds, to fly under the radar. This poses great challenges to detect DDoS attacks. In this paper, we propose an attack feature independent DDoS flooding attack detection method at local area networks. We employ flow entropy on local area network routers to supervise the network traffic and raise potential DDoS flooding attack alarms when the flow entropy drops significantly in a short period of time. Furthermore, information distance is employed to differentiate DDoS attacks from flash crowds. In general, the attack traffic of one DDoS flooding attack session is generated by many bots from one botnet, and all of these bots are executing the same attack program. As a result, the similarity among attack traffic should higher than that among flash crowds, which are generated by many random users. Mathematical models have been established for the proposed detection strategies. Analysis based on the models indicates that the proposed methods can raise the alarm for potential DDoS flooding attacks and can differentiate DDoS flooding attacks from flash crowds with conditions. The extensive experiments and simulations confirmed the effectiveness of our proposed detection strategies.

A dynamical deterministic packet marking scheme for DDoS traceback

DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and relatively effective traceback scheme among the available traceback methods. However, the existing DPM schemes inheret a critical drawback of scalability in tracing all possible attack sources, which roots at their static mark encoding and attempt to mark all Internet routers for their traceback purpose. We find that a DDoS attack session usually involves a limited number of attack sources, e.g. at the thousand level. In order to achieve the traceback goal, we only need to mark these attack related routers. We therefore propose a novel Marking on Demand (MOD) scheme based on the DPM mechanism to dynamical distribute marking IDs in both temporal and space dimensions. The proposed MOD scheme can traceback to all possible sources of DDoS attacks, which is not possible for the existing DPM schemes. We thoroughly compare the proposed MOD scheme with two dominant DPM schemes through theoretical analysis and experiments. The the results demonstrate that the MOD scheme outperforms the existing DPM schemes. © 2013 IEEE.

Detection on application layer DDoS using random walk model

Application Layer Distributed Denial of Service (ALDDoS) attacks have been increasing rapidly with the growth of Botnets and Ubiquitous computing. Differentiate to the former DDoS attacks, ALDDoS attacks cannot be efficiently detected, as attackers always adopt legitimate requests with real IP address, and the traffic has high similarity to legitimate traffic. In spite of that, we think, the attackers' browsing behavior will have great disparity from that of the legitimate users'. In this paper, we put forward a novel user behavior-based method to detect the application layer asymmetric DDoS attack. We introduce an extended random walk model to describe user browsing behavior and establish the legitimate pattern of browsing sequences. For each incoming browser, we observe his page request sequence and predict subsequent page request sequence based on random walk model. The similarity between the predicted and the observed page request sequence is used as a criterion to measure the legality of the user, and then attacker would be detected based on it. Evaluation results based on real collected data set has demonstrated that our method is very effective in detecting asymmetric ALDDoS attacks. © 2014 IEEE.