MULTOPS: a data structure for denial-of-service attack detection
Thomer M. Gil · 2000
A denial-of-service (DoS) attack is an attempt by a single person or a group of people to disrupt an online service. In a bandwidth attack, attackers clog links or routers by generating a traffic overload. This can have serious consequences to companies that rely on their online availability to do business. The ubiquity of tools to organize DoS attacks and the determination of some people to wreak havoc make for potential future problems. This thesis proposes a MUlti-Level Tree for Online Packet Statistics (MULTOPS): an attackresistant data structure enabling routers to detect ongoing bandwidth attacks by searching for significant asymmetries between packet rates to and from different subnets. Statistics are kept in a tree that dynamically adapts its shape to (1) reflect changes in packet rates, and (2) avoid (maliciously intended) memory exhaustion. A MULTOPS is suitable to detect the type of bandwidth attack that occurred on a large scale in February 2000. To remain undetected, the attacker has to launch the attack from a large number of distinct sites which makes mounting the attack more difficult. This will hopefully discourage many attackers. Thesis Supervisor: M. Frans Kaashoek Title: Associate Professor of Electrical Engineering and Computer Science, Massachusetts Institute of Technology Thesis Supervisor: Massimiliano Poletto Title: Research Staff, Massachusetts Institute of Technology Thesis Supervisor: Andrew S. Tanenbaum Title: Professor of Computer Science, Vrije Universiteit