DOCSLIB.ORG

Evaluation of Current State of Amplification-Based Ddos Attacks Bohte, Edgar; Stamatogiannakis, Manolis; Bos, Herbert

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Evaluation of Current State of Amplification-Based Ddos Attacks Bohte, Edgar; Stamatogiannakis, Manolis; Bos, Herbert VU Research Portal Evaluation of current state of amplification-based DDoS attacks Bohte, Edgar; Stamatogiannakis, Manolis; Bos, Herbert 2018 document version Publisher's PDF, also known as Version of record document license Unspecified Link to publication in VU Research Portal citation for published version (APA) Bohte, E. (Author), Stamatogiannakis, M. (Other), & Bos, H. (Other). (2018). Evaluation of current state of amplification-based DDoS attacks. Online publication or Website General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 24. Sep. 2021 Evaluation of current state of amplification-based DDoS attacks Edgar Bohte Vrije Universiteit Amsterdam, The Netherlands [email protected] TABLE I: Protocol, its assigned port, the bandwidth amplification Abstract—Amplification-based DDoS attacks are still a big factor and the current status. threat to the availability of the internet. In quite some time there is no new paper published that gave an update on the current Protocol Port Bandwidth Amplification Factor Status state of amplification DDoS attacks, taken into consideration it was a huge problem a few years ago. We performed multiple QOTD 17 140.3 Legacy scans of the whole IPv4 address space and deployed two honey- CHARGEN 19 358.8 Legacy pots to monitor amplification DDoS attacks to make a picture of DNS 53 28 to 54 Active the current state of amplification DDoS attacks. From the scan NTP 123 556.9 Active RIP 520 131.24 Deprecated data and the honeypot data, we can conclude that NTP is the MSSQL 1434 8 Active most dangerous protocol, for these kinds of attacks. Furthermore, SSDP/UPnP 1900 30.8 Active China and The United States are the most targeted countries for amplification DDoS attacks. The bandwidth amplification factor shows the potential effect of ADDoS attack and can be calculated by the payload in bytes sent I. INTRODUCTION for a request against that of the payload in bytes of the response. Recently, in March 2018, a distributed denial-of-service (DDoS) attack achieved an unprecedented throughput of 1.7 Tbps [1]. To achieve this kind of throughput, the attackers used instrumenting the attack. Although a reflection attack is almost a DDoS technique know as Amplification. These particular the same as an ADDOS attack the responses of protocols do kinds of DDoS attacks can be categorized under the broader not need to be larger than the request it just needs to reflect group of Reflection DDoS attacks. An Akamai study has shown the request. Figure1 shows how an ADDoS attack works. that Reflection DDoS attacks have increased both in size and In this paper, we will look at the current state of ADDoS frequency from 2014 till this day [2]. attacks. In the first part of our study, we will set up a honeypot, In principle, an Amplification DDoS (ADDoS) attack ex- which will run services that can be used in ADDoS attacks. ploits one or more connectionless (i.e. UDP-based) protocols A honeypot is a closely monitored, network-connected decoy that accept small requests and produce responses orders of host. It is expected to be broken into by unsuspecting attackers, magnitude larger in size. The connectionless nature of these so we can get to study their methods. Since the system does protocols makes them available for exploitation, as the source not get used in a legitimate way, every connection to it is of the request can be spoofed in order to redirect the large suspicious. When deployed, honeypots can keep the focus off response to the selected target. Because of the spoofing, it important machines on a network, it works as an early warning is also very hard for the target to identify who is actually against new attacks and identifies new attack trends. They can also be used for an in-depth examination during and after exploitation of the honeypot [3]. Our study will focus on seven UDP based protocols which are prone to ADDoS exploitation: • Quote Of The Day (QOTD) • Character Generator (CHARGEN) • Domain Name System (DNS) • Network Time Protocol (NTP) • Routing Information Protocol v1 (RIPV1/RIP) • Microsoft SQL (MSSQL) • Simple Service Discovery Protocol/Universal Plug and Play (SSDP/UPnP1) TableI[4][5] shows the typical amplification factor achieved by each of these protocols as well as their use status. The specific seven protocols were selected because we would like our results to be comparable with those of Krupp et Fig. 1: Illustration of an Amplification DDoS. The attacker host 1UPnP is a collection of networking protocols used to find and connect sends small spoofed requests to different UDP-based services. This devices with each other over the network. For discovery, UPnP uses the SSDP results in large responses being directed against the victim host. protocol. We will simply use SSDP for further references to these protocols. al. [6]. The Virtual Machines (VMs) ran a program called will only provide a maximum of 3 packets per IP address. This AmpPot [7] to let them act like honeypots. We chose to use contribution is minuscule in comparison to the sizes of these AmpPot because it is an easy way to set up a honeypot and attacks that we can not be held accountable for it. It is possible it gives a more precisely comparison with data from earlier to change the limit of requests per hour, but for the purpose performed research in this field. of this study, it was not necessary. Although we deployed In the second part of our study, we scanned the whole IPv4 AmpPot on more IP addresses than the original study [7], the address space for hosts running the seven protocols we focus contribution of our servers is still in the low kilobit bandwidth on. These scans have been performed using a program called size while most ADDoS attacks get a Gigabit per second ZMap [8]. To get an estimate of the number of servers that bandwidth size. can be used in an ADDoS attack. 1) Common honeypot configuration: We ran the Amp- Using the two parts of our study, we can get an up-to-date Pot code on two different VMs; one VM was provided by estimate of the current state of ADDoS attacks: the scan results SURFnet [9] and the other one by GRnet [10]. The config- give us an indication of the number of servers that can be uration of the two honeypots was identical, with a couple of abused and the honeypot data allow us to see the frequency of minor differences related to the setup of our hosting providers. ADDoS attacks. To summarize, the contributions of this paper AmpPot can be run in three different modes: Emulated, Proxy are as follows: and Agnostic. First, the Emulated mode, this mode will check • We ran a honeypot to show how many people are still if the request is valid and if so it will respond with a pre- using seven specific UDP-based protocols for ADDoS generated protocol-specific response. Secondly, there is the attacks. Proxy mode, ”The proxy mode turns AmpPot into a proxy • We performed a scan of the whole IPv4 address space to that forwards requests to internal servers that actually operate see how many IP addresses ran these seven protocols. the vulnerable protocol” [7]. At last, the Agnostic mode, this The structure of this paper is as follows. First, we will mode always replies with a response 100x the requests size or look at how we performed the data collection of the hon- with the maximum MTU, even if the request is invalid for a eypots (Section II-A) and how the scans were performed protocol. We ran both servers on the Emulated mode because (Section II-B). In Section III we will look at all the results the Agnostic mode always replies, even if the request is invalid obtained from both the scans (Section III-B) and the honeypots for a protocol. For this research, we are interested in what kind (Section III-A). In SectionIV we will look further into of protocols will be used in ADDoS attacks. Thus, if we would interesting results (Section IV-A) and analyse what could have always reply with a large request the probability is bigger it been done differently in this presented research (Section IV-B). will be used in ADDoS attacks, and this has nothing to do Furthermore, future research in this field will be considered with the abuse-ability of the protocol itself. The Emulated (Section IV-C). In SectionV we will look at research already mode also made it possible to compare our results with those done in this area. In the end, a conclusion of this research will of Krupp et al. [6]. Furthermore, it is possible to change the be givenVI. response rate of the server. This value was set to 0.5 in this research, this means that the server will only send a response II.
Load more

Recommended publications
  • IT Acronyms.Docx
    List of computing and IT abbreviations /.—Slashdot 1GL—First-Generation Programming Language 1NF—First Normal Form 10B2—10BASE-2 10B5—10BASE-5 10B-F—10BASE-F 10B-FB—10BASE-FB 10B-FL—10BASE-FL 10B-FP—10BASE-FP 10B-T—10BASE-T 100B-FX—100BASE-FX 100B-T—100BASE-T 100B-TX—100BASE-TX 100BVG—100BASE-VG 286—Intel 80286 processor 2B1Q—2 Binary 1 Quaternary 2GL—Second-Generation Programming Language 2NF—Second Normal Form 3GL—Third-Generation Programming Language 3NF—Third Normal Form 386—Intel 80386 processor 1 486—Intel 80486 processor 4B5BLF—4 Byte 5 Byte Local Fiber 4GL—Fourth-Generation Programming Language 4NF—Fourth Normal Form 5GL—Fifth-Generation Programming Language 5NF—Fifth Normal Form 6NF—Sixth Normal Form 8B10BLF—8 Byte 10 Byte Local Fiber A AAT—Average Access Time AA—Anti-Aliasing AAA—Authentication Authorization, Accounting AABB—Axis Aligned Bounding Box AAC—Advanced Audio Coding AAL—ATM Adaptation Layer AALC—ATM Adaptation Layer Connection AARP—AppleTalk Address Resolution Protocol ABCL—Actor-Based Concurrent Language ABI—Application Binary Interface ABM—Asynchronous Balanced Mode ABR—Area Border Router ABR—Auto Baud-Rate detection ABR—Available Bitrate 2 ABR—Average Bitrate AC—Acoustic Coupler AC—Alternating Current ACD—Automatic Call Distributor ACE—Advanced Computing Environment ACF NCP—Advanced Communications Function—Network Control Program ACID—Atomicity Consistency Isolation Durability ACK—ACKnowledgement ACK—Amsterdam Compiler Kit ACL—Access Control List ACL—Active Current
    [Show full text]
  • Reference Information
    APPENDIX B Software Field Description Tables The window field description tables for the following are included in this section: • “Flow Record Match and Collect Field Descriptions” • “Configure Filter Window Fields” • “Configure Records Window Fields” • “Configure Collector Window Fields” • “Configure Exporter Window Fields” • “Configure Monitor Window Fields” • “Application ID Collect Field Information” Table B-1 lists the match and collect field descriptions for IPv4, IPv6, and Layer 2 flow records in the user interface, as well as the CLI. Table B-1 Flow Record Match and Collect Field Descriptions Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 CoS X X X Ethertype X X X Input SNMP Interface X X X IP Protocol X X IPv4 Destination Address X IPv4 Source Address X IPv4 TOS X IPv4 TTL X IPv6 Destination Address X IPv6 Hop Limit X IPv6 Source Address X IPv6 Traffic Class X Layer 4 Destination Port X X Layer 4 Source Port X X MAC Destination Address X X X Cisco NetFlow Generation Appliance User Guide B-1 Appendix B Software Field Description Tables Table B-1 Flow Record Match and Collect Field Descriptions (continued) Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 MAC Source Address X X X MPLS Label X X X Output SNMP Interface X X X VLAN ID X X X Collect Fields Application ID1 XXX Byte Count X X X First Timestamp X X X Flow Label X IPv4 ICMP Code X IPv4 ICMP Type X IPv6 ICMP Code X IPv6 ICMP Type X Last Timestamp X X X Network Encapsulation X X X Packet Count X X X TCP Header Flags X X X 1.
    [Show full text]
  • Troubleshooting TCP/IP
    4620-1 ch05.f.qc 10/28/99 12:00 PM Page 157 Chapter 5 Troubleshooting TCP/IP In This Chapter ᮣ Troubleshooting TCP/IP in Windows 2000 Server ᮣ TCP/IP troubleshooting steps ᮣ Defining which is the best TCP/IP troubleshooting tool to solve your problem ᮣ Mastering basic TCP/IP utilities roubleshooting is, it seems, an exercise in matrix mathematics. That is, Twe use a variety of approaches and influences to successfully solve our problems, almost in a mental columns-and-rows format. These approaches may include structured methodologies, inductive and deductive reasoning, common sense, experience, and luck. And this is what troubleshooting is made of. Troubleshooting TCP/IP problems is really no different from troubleshooting other Windows 2000 Server problems mentioned in this book, such as instal- lation failures described in Chapter 2. Needless to say, Windows 2000 Server offers several TCP/IP-related tools and utilities to assist us, but more on the specifics in a moment. TCP/IP Troubleshooting Basics The goal in TCP/IP troubleshooting is very simple: fix the problem. Too often, it is easy to become overly concerned about why something happened instead of just fixing the problem. And by fixing the problem, I mean cost effectively. 1. Be cost effective. Don’t forget that several hours’ worth of MCSE-level consulting could more than pay for the additional bandwidth that may easily solve your TCP/IP WAN-related problem. Don’t overlook such an easy fix when struggling to make a WAN connection between sites utilizing Windows 2000 Server. Too little bandwidth is typically the result of being penny wise and pound foolish.
    [Show full text]
  • 09-Mobile Networking
    Mobile Networking Programming for Engineers Winter 2015 Andreas Zeller, Saarland University Today’s Topics • Mobile Networking • HTTP • HTML • Webserver! The aim of a computer network is Murray Leinster to have computers communicate “A Logic Named Joe” (1946) with each other The computer ... manages the spreading of ninety-four percent of all TV programs, conveys all information about weather, air trafc, special deals… and records every business conversation, every contract… Computers have changed the world. Computers are the civilisation. If we turn them of, we will fall back to a kind of civilisation, of which we have forgotten how it even works. Murray Leinster, 1896–1975 Partial map of the Internet based on the January 15, 2005 data The Internet found on opte.org. Each line is drawn between two nodes, representing two IP addresses. The length of the lines are indicative of the delay between those two nodes. This graph represents less than 30% of the Class C networks reachable by the data collection program in early 2005. Wireless Internet • WLAN = Wireless Local Area Network • Allows “local” computers to communicate The Arduino ESP8266 shield allows the Arduino to connect to Wireless Modem networks, and also to set up its own network The modem is controlled by so- Controlling a Modem called AT commands Modems receive • data to be sent • commands to control them View from above – connectors are Programming for Engineers WS15/16 Prof. Dr. Andreas Zeller saarland Software Engineering Chair Resp. Tutor: Curd Becker university at the bottom ConnectingSaarland University theAssignment Modem Sheet 6 computer science The connectors for the ESP8266 wireless module are shown in more detail here.
    [Show full text]
  • Dos Amplification Attacks – Protocol-Agnostic Detection Of
    DoS Amplification Attacks – Protocol-Agnostic Detection of Service Abuse in Amplifier Networks B Timm B¨ottger1( ), Lothar Braun1 , Oliver Gasser1, Felix von Eye2, Helmut Reiser2, and Georg Carle1 1 Technische Universit¨at M¨unchen, Munich, Germany {boettget,braun,gasser,carle}@net.in.tum.de 2 Leibniz Supercomputing Centre, Munich, Germany {voneye,reiser}@lrz.de Abstract. For many years Distributed Denial-of-Service attacks have been known to be a threat to Internet services. Recently a configura- tionflawinNTPdaemonsledtoattackswithtrafficratesofseveral hundred Gbit/s. For those attacks a third party, the amplifier, is used to significantly increase the volume of traffic reflected to the victim. Recent research revealed more UDP-based protocols that are vulnerable to amplification attacks. Detecting such attacks from an abused ampli- fier network’s point of view has only rarely been investigated. In this work we identify novel properties which characterize ampli- fication attacks and allow to identify the illegitimate use of arbitrary services. Their suitability for amplification attack detection is evaluated in large high-speed research networks. We prove that our approach is fully capa- ble of detecting attacks that were already seen in the wild as well as capable of detecting attacks we conducted ourselves exploiting newly discovered vulnerabilities. 1 Introduction Denial-of-Service attacks aim at making services unavailable to their intended users. Attackers can use different methods to consume bandwidth or deplete other resources of the victim. One method to exhaust bandwidth is called Dis- tributed Reflection Denial-of-Service (DRDoS) attack: an attacker sends forged requests to several servers with the victim’s spoofed source address.
    [Show full text]
  • Vulnerability Report TLP: White
    Vulnerability Report TLP: White Contents 1 Introduction ..................................... 4 2 Overview of Scanning Projects ............... 5 2.1 SSL POODLE Scan ................................................ 6 2.2 HTTP Scan ........................................................ 7 2.3 FTP Scan .......................................................... 8 2.4 RDP ................................................................ 9 2.5 mDNS ............................................................ 10 2.6 SNMP ............................................................. 11 2.7 AFP ............................................................... 12 2.8 NTP .............................................................. 13 2.9 Telnet ........................................................... 14 2.10 SSL Freak ....................................................... 15 2.11 Port Mapper .................................................... 16 2.12 VNC .............................................................. 17 2.13 DNS............................................................... 18 2.14 Netbios .......................................................... 19 2.15 SSDP ............................................................. 20 2.16 ISAKMP .......................................................... 21 2.17 TFTP ............................................................. 22 2.18 RSYNC ........................................................... 23 2.19 SMB .............................................................. 24 2.20 CWMP
    [Show full text]
  • Amplification Hell: Revisiting Network Protocols for Ddos Abuse
    Amplification Hell: Revisiting Network Protocols for DDoS Abuse Christian Rossow VU University Amsterdam, The Netherlands Horst Gortz¨ Institute for IT-Security, Ruhr University Bochum, Germany firstname.lastname @rub.de { } Abstract—In distributed reflective denial-of-service (DRDoS) In distributed reflective denial-of-service (DRDoS) attacks, attacks, adversaries send requests to public servers (e.g., open an adversary aims to exhaust the victim’s bandwidth. He recursive DNS resolvers) and spoof the IP address of a victim. abuses the fact that public servers of UDP-based network These servers, in turn, flood the victim with valid responses protocols respond to requests without further validating the and – unknowingly – exhaust its bandwidth. Recently, attackers identity (i.e., the IP address) of the sender. DRDoS offers many launched DRDoS attacks with hundreds of Gb/s bandwidth of this desired attack features for an adversary: (i) He disguises his kind. While the attack technique is well-known for a few protocols such as DNS, it is unclear if further protocols are vulnerable to identity, as victims receive backscatter traffic from amplifiers, similar or worse attacks. i.e., systems that can be abused to send traffic to the victim on the attacker’s behalf; (ii) The simultaneous abuse of multiple In this paper, we revisit popular UDP-based protocols of amplifiers permits a highly-distributed DoS attack to be con- network services, online games, P2P filesharing networks and ducted from a single Internet uplink. (iii) The traffic reflected P2P botnets to assess their security against DRDoS abuse. We find that 14 protocols are susceptible to bandwidth amplification to the victim is significantly larger in bandwidth than the traffic and multiply the traffic up to a factor 4670.
    [Show full text]
  • Ddos Beasts and How to Fight Them
    DDoS Beasts and How to Fight Them Artyom Gavrichenkov <[email protected]> Timeline of ancient history • First attacks: 1999-2000 • 2005: STRIDE model by Microsoft • Spoofing Identity • Tampering with Data • Repudiation • Information Disclosure • Denial of Service • Elevation of Privileges [D?]DoS The difference between “a distributed attack” and an, err, not distributed one is vague. Traditional meaning: a distributed attack comes from multiple sources. • What is a source? Is it an IP address or a machine? • If it is a machine, does a virtual instance count? Or a few instances under the same physical hypervisor? What if they often migrate between physical machines? If I’m a victim, how do I tell a single-sourced from a multiple-sourced? • If it is an IP, then how do we treat spoofed traffic? [D?]DoS Hence, a different sort of thinking applies: • DoS (as implied in STRIDE): a vulnerability in a software (e.g. NULL pointer dereference, like Ping of Death) • DDoS: computational resource exhaustion Risk management The basic idea behind STRIDE and other approaches is risk assessment, modelling and management. Probability/Impact Matrix Trivial Minor Moderate Significant Severe Rare Unlikely Moderate Likely Very Likely Probability/Impact Matrix Trivial Minor Moderate Significant Severe DDoS attack, Rare 2018 Unlikely • Impact: Moderate Likely Severe Very Likely • Probability: ? Motivation of an attacker • Fun! • Blackmail • Self-promotion • Political statement • Revenge • Market competition • Diverting attention (e.g. in case of theft) • Preventing access to a compromising information Motivation of an attacker • Fun! • Blackmail Rather hard to evaluate and control • Self-promotion • Political statement • Revenge • Market competition • Diverting attention More or less predictable! (e.g.
    [Show full text]
  • Threat Landscape and Good Practice Guide for Internet Infrastructure
    Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 European Union Agency for Network and Information Security www.enisa.europa.eu Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors Dr. Cédric Lévy-Bencheton (ENISA), Dr. Louis Marinos (ENISA), Rossella Mattioli (ENISA), Dr. Thomas King (DE-CIX Management GmbH), Christoph Dietzel (DE-CIX Management GmbH), Jan Stumpf (DE-CIX Management GmbH) Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected] Acknowledgements For the completion of this study, ENISA has worked closely with: • The “Internet infrastructure security and resilience” reference group. • Individual experts that reviewed the results and provided valuable feedback: Randy Bush (Internet Initiative Japan), Patrick Fältström (Netnod), Peter Koch (DENIC), Benno Overeinder (NLnetLabs), Andrei Robachevsky (Internet Society). We are grateful for their valuable input and comments.
    [Show full text]
  • Port Ranges Traffic Analysis
    Simon Owens Port Ranges • Ports 0 to 1023 are Well-Known Ports. • Ports 1024 to 49151 are Registered Ports (often registered by a software developer to designate a particular port for their application) • Ports 49152 to 65535 are Public Ports. Traffic Analysis - Wireshark Configure Name Resolution 1. Make a new profile 2. Make a “hosts” file with format “ip hostname” 3. Place that “hosts” file in the ~/.config/wireshark/configprofilename/ folder 4. open pcap file, select your configuration profile, and ensure “view>>name resolution>>resolve network/transport address names” is checked Configure Ports 1. Go to “Edit>>preferences>>columns” and add src and dst ports to the display Figuring out what multi-cast goes too 1. Fill out “hosts” and “services” file if you can 2. Click on various multi-cast products – generally the parameters will identify what the application is with a version or the company that made it. Query for Common Ports • tcp.dstport >= 0 and tcp.dstport <= 10000 || tftp || dns Saving off filters to make capture smaller 1. Apply a filter 2. Click “File>> Export Specified Packets” then save them to a file Search for Strings • Edit >> find packet Extracting files • file >> export objects Find Hashes • net-creds.py file.pcap Changing Parameters in the Packets Simon Owens • Port Scan Netdiscover -r <ip-range> make sure you know everything on network IP=insert mkdir $IP Masscan: • masscan -p0-65535 $IP --banners -oG $IP/masscan_$IP.grep Nmap: • Nmap -sV -T4 $IP -oN $IP/normalNmap.txt • nmap -v -sS -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/TCPscan_$IP • nmap -v -sU -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/UDPscan_$IP General Services: • 9/tcp - Discard o Discard Protocol - https://www.exploit-db.com/exploits/19555 The Discard Protocol is a service in the Internet Protocol Suite defined in RFC 863.
    [Show full text]
  • Draft SP 800-189, Secure Interdomain Traffic Exchange
    Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date October 17, 2019 Original Release Date December 17, 2018 Superseding Document Status 2nd Public Draft (2PD) Series/Number NIST Special Publication 800-189 Title Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation Publication Date October 2019 DOI https://doi.org/10.6028/NIST.SP.800-189-draft2 CSRC URL https://csrc.nist.gov/publications/detail/sp/800-189/draft Additional Information 1 Draft NIST Special Publication 800-189 2 3 Secure Interdomain Traffic Exchange 4 BGP Robustness and DDoS Mitigation 5 6 Kotikalapudi Sriram 7 Doug Montgomery 8 9 10 11 12 13 This publication is available free of charge from: 14 https://doi.org/10.6028/NIST.SP.800-189-draft 15 16 17 C O M P U T E R S E C U R I T Y 18 19 20 Draft NIST Special Publication 800-189 21 22 Secure Interdomain Traffic Exchange 23 BGP Robustness and DDoS Mitigation 24 25 Kotikalapudi Sriram 26 Doug Montgomery 27 Advanced Network Technology Division 28 Information Technology Laboratory 29 30 31 32 33 34 35 36 This publication is available free of charge from: 37 https://doi.org/10.6028/NIST.SP.800-189-draft 38 39 40 December 2018 41 42 43 44 45 U.S. Department of Commerce 46 Wilbur L. Ross, Jr., Secretary 47 48 National Institute of Standards and Technology 49 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 50 Authority 51 This publication has been developed by NIST in accordance with its statutory responsibilities under the 52 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C.
    [Show full text]
  • ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction
    ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction ...............................................................................................................................................................................3 Signature-Based Recognition vs. ACL’s ................................................................................................................3 Detection Engine ...................................................................................................................................................................3 Using Groups or Individual Applications .............................................................................................................3 Actions Once an Application is Detected ...........................................................................................................3 Appendix A: Application List ........................................................................................................................................ 4 martellotech.com elfiq.com 2 INTRODUCTION The Elfiq AppOptimizer is designed to give organizations full control over their existing and future bandwidth, guaranteeing key applications such as Citrix XenDesktop or Skype get priority treatment and undesirables such as peer-to-peer file transfers or games are limited or no longer permitted. It is an add-on-module that provides application-layer deep packet inspection (layer 7) classification and control, including Mobile, Social Networking, P2P, Instant Messaging,
    [Show full text]