Adaptive Defense Against Various Network Attacks Export

@inproceedings{citeulike:1099514, abstract = {In defending against various network attacks, such as Distributed Denial-of-Service (DDoS) attacks or worm attacks, a defense system needs to deal with various network conditions and dynamically changing attacks. In this paper, we introduce an ``adaptive defense" principle based on cost minimization -- a defense system adaptively adjusts its configurations according to the network condition and attack severity in order to minimize the combined cost introduced by false positives (misidentify normal traffic as attack) and false negatives (misidentify attack traffic as normal) at any time. In this way, the adaptive defense system generates fewer false alarms in normal situations (or under light attacks) with relaxed defense configurations, while protecting a network or a server more vigorously under severe attacks. Specifically, we present detailed adaptive defense system designs for defending against two major network attacks: SYN flood DDoS attack and Internet worm infection. The adaptive defense is a high-level system design that can be built on top of various non-adaptive detection and filtering algorithms, which makes it applicable for a wide range of security defenses.}, author = {Cliff and Gong, Weibo}, citeulike-article-id = {1099514}, citeulike-linkout-0 = {http://www.usenix.org/publications/library/proceedings/sruti05/tech/zou.html}, journal = {Steps to Reducing Unwanted Traffic on the Internet Workshop}, keywords = {c, computer\_security, computersecurity, cybersecurity}, pages = {69--75}, posted-at = {2009-06-26 17:16:37}, priority = {2}, title = {Adaptive Defense Against Various Network Attacks}, url = {http://www.usenix.org/publications/library/proceedings/sruti05/tech/zou.html} }

TY - CONF ID - citeulike:1099514 L3 - citeulike-article-id:1099514 N2 - In defending against various network attacks, such as Distributed Denial-of-Service (DDoS) attacks or worm attacks, a defense system needs to deal with various network conditions and dynamically changing attacks. In this paper, we introduce an ``adaptive defense" principle based on cost minimization -- a defense system adaptively adjusts its configurations according to the network condition and attack severity in order to minimize the combined cost introduced by false positives (misidentify normal traffic as attack) and false negatives (misidentify attack traffic as normal) at any time. In this way, the adaptive defense system generates fewer false alarms in normal situations (or under light attacks) with relaxed defense configurations, while protecting a network or a server more vigorously under severe attacks. Specifically, we present detailed adaptive defense system designs for defending against two major network attacks: SYN flood DDoS attack and Internet worm infection. The adaptive defense is a high-level system design that can be built on top of various non-adaptive detection and filtering algorithms, which makes it applicable for a wide range of security defenses. JF - Steps to Reducing Unwanted Traffic on the Internet Workshop EP - 75 TI - Adaptive Defense Against Various Network Attacks SP - 69 KW - c KW - computer_security KW - computersecurity KW - cybersecurity AU - Cliff AU - Gong, Weibo UR - http://www.usenix.org/publications/library/proceedings/sruti05/tech/zou.html ER -