Detecting DDoS Attacks on ISP Networks

Most past solutions for detecting denial of service attacks (and identifying the perpetrators) have targeted end-node victims. However, little attention has been given to this problem from an ISP perspective. This paper explores the key challenges involved in helping an ISP network detect attacks on itself or attacks on external sites which use the ISP network. We propose a detection mechanism where each router detects traffic anamolies using profiles of normal traffic constructed using stream sampling algorithms. In addition, an ISP’s routers exchange information with each other to increase confidence in their detection decisions. Our initial results show that individual router profiles capture key characteristics of the traffic effectively and help identify anomalies with low false positive and false negative rates. We believe that profile construction can be extremely efficient, supporting even multi-gigabit speeds. We also believe that incremental deployment of such techniques is possible, although it may signficantly impact the effectiveness of the distributed reinforced decision making.