DDoS Attack Research

Introductory Background Reading

Flow Monitoring Explained, Hofstede et al., 2014 - Tutorial describing the ins and outs of setting up a flow monitoring pipeline.
Traffic characteristics of common DoS tools, Bukac, 2014 - An overview of relevant flow properties and how to use those to detect DDoS attacks.

HTTP Flood (39% in 2012)
- Slow Attacks
  - tool Slowloris - slowly write perpetually partial HTTP requests
  - slow Read attacks
- Encrypted SSL DDoS Attacks (tool THC-SSL-DoS)
SYN Flood (19% in 2012) - spoofed SYN packets
UDP Flood (15% in 2012)
- spoofed UDP messages to random ports, requiring ICMP replies
- NTP reflection
- Snork Attack Flows - from port 7, 19 or 135 to port 135, Windows NT RPC Service
- Echo Request Broadcasts - UDP packet to port 7 (echo) on a Broadcast IP
- UDP Echo-Chargen - UDP Flows between port 7/Echo and port 19/Chargen, either direction
- fragmented UDP messages
ICMP Flood (13% in 2012) - spoofed echo request
- ICMP Request Broadcasts - Echo Request, Timestamp, Info Request, or Address Mask Request to Broadcast IP
- ICMP Protocol Unreachables - 770/Protocol Unreachable, causes active TCP connections to be dropped
- ICMP Source Quench Flows - 1024/Source Quench. Out dated, could limit the bandwidth of a router or host
- Smurf Attacks - spoof victim’s source IP and send ICMP echo request to third-parties
DNS (3% in 2012)
- DNS Open Resolver Amplification - spoof target’s source IP
- DNS Attacks - with large EDNS replies LDoS
SMTP (2% in 2012)
SIP INVITE Flood (0.5% in 2012)
BGP (detected by Cisco's TAD)
Teardrop Attacks - TCP packets with overlapping, over-sized payloads causing deficiencies in old TCP stacks to crash
Land Attack Flows - Flows with the same Src IP & Dst IP. Causes the target machine to reply to itself continuously

Metasploit Framework (MSF)
Low Orbit Ion Cannon
- many connections in a short time on UDP port 80 from many IPs
- TCP with ACK & packets of size 1448
- specific malformed GET requests
- un-spoofed source IPs
High Orbit Ion Canon
Net Flood: ICMP (reply/request/any), UDP, TCP

manual ACLs
anomalous bandwidth usage
anomalous CPU utilization
anomalous traffic types
Intrusion Detection System (IDS) devices
Intrusion Prevention System (IPS) devices
Unicast Reverse Path Forwarding (uRPF) - invalid source addresses in traffic
Reputation-Based Blocking
WatchGuard Reputation Authority
WebSEO Analytics
Imperva ThreatRadar
unmatched ACKs (TCP reflection attacks)
Snort rules
Apache’s mod_evasive - request thresholds
http server 503 errors or slow responses
D-WARD (unfeasible source based detection)
statistical, for example maintaining latest rates and exponential moving averages (baselines) of bytes and packets
soft computing methods (neural networks, radial basis functions, genetic algorithms)

Prolexic Technologies: DoS and DDoS Protection
AT&T Internet Protect: Distributed Denial of Service Defense
Verizon: DoS Defense Services
Arbor Networks: Pravail Availability Protection System (APS)
Arbor Peakflow SP, [User Guide] (http://www.techtronicssolution.com/blog/?p=1086)
- uses per-network attack duration with bps & pps thresholds
- or auto-rate calculation with floors, percentiles and scaling parameters
- or complex fingerprints, both FCAP and Arbor’s Active Threat Feed (ATF)
Cisco Cyber Threat Defense Solution
Manage Engine Netflow Analyser
Cisco Traffic Anomaly Detector (TAD)
Open Daylight Defense4All (FOSS)
A list of tools, mostly commercial

list of plugins:

Backend Perl API Summary

Frontend PHP API Summary