John Haggerty, Qi Shi and Madjid Merabti
Liverpool John Moores University
United Kingdom

The threat to organisations from network attacks is very real. Denial of service (DoS) attacks are seriously under-represented in current research compared to their prevalence 'in the wild'. Current countermeasures to DoS attacks rely on the perimeter model of network security. However, as the case study and analysis in this paper make apparent, the perimeter model, which relies on firewalls and Intrusion Detection Systems, is unable to provide an effective defence against DoS attacks. Therefore, there is a need for a new approach; one that identifies an attack beyond the perimeter. Within this paper, we present such an approach. We achieve early detection of DoS attacks by the identification of traffic signatures which indicate that an attack is underway. As these signatures can be identified 'outside' the perimeter, appropriate measures can be taken to prevent the attack from succeeding. We use examples of DoS attacks and a case study to demonstrate the applicability of our approach.

Keywords: Denial of Service, detection, availability

Read Paper (in PDF)