A visualization analysis tool for DNS amplification attack

This paper presents a visualization analysis tool for detecting, analyzing and responding to the Distributed Denial of Service attack termed the Domain Name Service (DNS) amplification attack. The tool integrates agent technology, visual analytics and interactive visualization techniques to allow users to interact with the system in real-time, to monitor the network traffic, to analyze traffic information, to detect abnormal behaviors, and to respond to the DNS amplification attack. Three algorithms that are the filter algorithm, the mapping and visualizing algorithm, and the response algorithm have been developed to detect and respond to the DNS amplification attack automatically or manually. A set of experiments have been conducted in an isolated laboratory and produced expected results.