Edge-to-Edge Network Monitoring to Detect Service Violations and DoS Attacks
Ahsan Habib · IGI Global eBooks · 2009
This chapter develops a distributed monitoring scheme that uses edge-to-edge measurements to identify congested links and capture the misbehaving flows that violate service-level-agreements and inject excessive traffic that leads into denial of service (DoS) attacks. The challenge of this problem is to develop low overhead schemes that do not involve core routers in any measurement to achieve scalability. The main contribution of this work is overlay-based network monitoring schemes for efficient and scalable network monitoring. This monitoring scheme uses edge-to-edge measurements of delay, loss, and throughput to infer the internal characteristics of a network domain. The analytical and experimental results show that a network domain can be monitored with O(n) probes, where n is the number of edge routers. Upon detection of an attack, the routers regulate misbehaving flows to stop it. We introduce a new way to measure communication and computation overhead among monitoring schemes. This comparative study shows that core-assisted network monitoring has higher communication and computation overhead comparing to edge-to-edge network monitoring scheme.