Detecting DDoS Attacks on ISP Networks

Overview

Most past solutions for detecting denial of service attacks (and identifying the perpetrators) have targeted end-node victims. However, little attention has been given to this problem from an ISP perspective. This paper explores the key challenges involved in helping an ISP network detect attacks on itself or attacks on external sites which use the ISP network. This paper proposes a detection mechanism where each router detects traffic anamolies using profiles of normal traffic constructed using stream sampling algorithms. In addition, an ISP's routers exchange information with each other to increase confidence in their detection decisions.