We present a measurement study analyzing DDoS attacks from multiple data sources, relying on both direct measurements of flow-level information, and more traditional indirect measurements using backscatter analysis. Understanding the nature of DDoS attacks is critically important to the development of effective counter measures to this pressing problem. While much of the community's current understanding of DDoS attacks result from indirect measurements, our analysis suggests that such studies do not give a comprehensive view of DDoS attacks witnessed in today's Internet. Specifically, our results suggest little use of address spoofing by attackers, which imply that such attacks will be invisible to indirect backscatter measurement techniques. Further, at the detailed packet-level characterization (e.g., attack destination ports), there are significant differences between direct and indirect measurements. Thus, there is tremendous value in moving towards direct observations to better understand DDoS attacks. Direct measurements additionally provide information inaccessible to indirect measurements, enabling us to better understand how to defend against attacks. We find that for 70% of the attacks fewer than 50 source ASes are involved and a relatively small number of ASes produce nearly 72% of the total attack volume. This suggests that network providers can reduce a substantial volume of malicious traffic with targeted deployment of DDoS defenses.
In 2006, Mao et al. REF presented their measurement work of DDoS attacks relying on both direct measurement of flow-level information and more traditional indirect measurements using backscatter analysis.
Analyzing large DDoS attacks using multiple data sources
LSAD '06
Computer Science