{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:38:48Z","timestamp":1750307928006,"version":"3.41.0"},"reference-count":34,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2007,3,20]],"date-time":"2007-03-20T00:00:00Z","timestamp":1174348800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2007,3,20]]},"abstract":"<jats:p>Defending against large, distributed Denial-of-Service attacks is challenging, with large changes to the network core or to end-hosts often suggested. To make matters worse, spoofing adds to the difficulty, since defenses must resist attempts to trigger filtering of other people's traffic. Further, any solution has to provide incentives for deployment, or it will never see the light of day. We present a simple and effective architectural defense against distributed DoS attacks that requires no changes to the end-hosts, minimal changes to the network core, is robust to spoofing, provides incentives for initial deployment, and can be built with off-the-shelf hardware<\/jats:p>","DOI":"10.1145\/1232919.1232924","type":"journal-article","created":{"date-parts":[[2007,4,5]],"date-time":"2007-04-05T19:52:18Z","timestamp":1175802738000},"page":"39-50","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":14,"title":["An edge-to-edge filtering architecture against DoS"],"prefix":"10.1145","volume":"37","author":[{"given":"Felipe","family":"Huici","sequence":"first","affiliation":[{"name":"University College London, London, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mark","family":"Handley","sequence":"additional","affiliation":[{"name":"University College London, London, United Kingdom"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2007,3,20]]},"reference":[{"key":"e_1_2_1_2_1","volume-title":"Proc. ACM SIGCOMM 2nd Workshop on Hot Topics in Networks","author":"Anderson T.","year":"2003","unstructured":"T. Anderson , T. Roscoe , and D. Wetherall . Preventing Internet Denial-of-Service with Capabilities . In Proc. ACM SIGCOMM 2nd Workshop on Hot Topics in Networks , November 2003 . T. Anderson, T. Roscoe, and D. Wetherall. Preventing Internet Denial-of-Service with Capabilities. In Proc. ACM SIGCOMM 2nd Workshop on Hot Topics in Networks, November 2003."},{"key":"e_1_2_1_3_1","unstructured":"Arbor Networks. Arbor peakflow: Network security management and intrusion detection.  Arbor Networks. Arbor peakflow: Network security management and intrusion detection."},{"key":"e_1_2_1_4_1","volume-title":"Usenix Annual Techical Conference","author":"Argyraki K.","year":"2005","unstructured":"K. Argyraki and D. Cheriton . Active Internet Traffic Filtering: Real-Time Response to Denial-of-Service Attacks . In Usenix Annual Techical Conference , April 2005 . K. Argyraki and D. Cheriton. Active Internet Traffic Filtering: Real-Time Response to Denial-of-Service Attacks. In Usenix Annual Techical Conference, April 2005."},{"key":"e_1_2_1_5_1","doi-asserted-by":"crossref","unstructured":"S. Bellovin. The Security Flag in the IPv4 Header. http:\/\/www.ietf.org\/rfc\/rfc3514.txt April 2003.   S. Bellovin. The Security Flag in the IPv4 Header. http:\/\/www.ietf.org\/rfc\/rfc3514.txt April 2003.","DOI":"10.17487\/rfc3514"},{"key":"e_1_2_1_6_1","volume-title":"October","author":"Bellovin S.","year":"2001","unstructured":"S. Bellovin , M. Leech , and T. Taylor . The ICMP traceback message , October 2001 . S. Bellovin, M. Leech, and T. Taylor. The ICMP traceback message, October 2001."},{"key":"e_1_2_1_7_1","unstructured":"CAIDA\n  : Cooperative Association for Internet Data Analysis. Packet Sizes and Sequencing. http:\/\/learn.caida.org 1998.  CAIDA: Cooperative Association for Internet Data Analysis. Packet Sizes and Sequencing. http:\/\/learn.caida.org 1998."},{"key":"e_1_2_1_8_1","unstructured":"CAIDA\n  : Cooperative Association for Internet Data Analysis. Packet Length Distributions. http:\/\/www.caida.org 2000.  CAIDA: Cooperative Association for Internet Data Analysis. Packet Length Distributions. http:\/\/www.caida.org 2000."},{"key":"e_1_2_1_9_1","unstructured":"Cisco Systems. Cisco Guard DDoS mitigation appliances - products and services.  Cisco Systems. Cisco Guard DDoS mitigation appliances - products and services."},{"key":"e_1_2_1_10_1","volume-title":"October","author":"CNET.","year":"2005","unstructured":"CNET. Bot herders may have controlled 1.5 million pcs. http:\/\/news.com.com\/ , October 2005 . CNET. Bot herders may have controlled 1.5 million pcs. http:\/\/news.com.com\/, October 2005."},{"key":"e_1_2_1_11_1","volume-title":"Workshop on Economics of Peer-to-Peer Systems","author":"Cohen Brad","year":"2003","unstructured":"Brad Cohen . Incentives build robustness in BitTorrent . In Workshop on Economics of Peer-to-Peer Systems , May 2003 . Brad Cohen. Incentives build robustness in BitTorrent. In Workshop on Economics of Peer-to-Peer Systems, May 2003."},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2004.832971"},{"key":"e_1_2_1_13_1","volume-title":"Firebreak: An IP Perimeter Defense Architecture","author":"Francis Paul","year":"2004","unstructured":"Paul Francis . Firebreak: An IP Perimeter Defense Architecture . 2004 . Paul Francis. Firebreak: An IP Perimeter Defense Architecture. 2004."},{"key":"e_1_2_1_14_1","volume-title":"Proc. IEEE DISCEX","author":"Govindan R.","year":"2003","unstructured":"R. Govindan , A. Hussain , R. Lindell , J. Mehringer , and C. Papadopoulos . COSSACK: Coordinated suppression of simultaneous attacks . In Proc. IEEE DISCEX , April 2003 . R. Govindan, A. Hussain, R. Lindell, J. Mehringer, and C. Papadopoulos. COSSACK: Coordinated suppression of simultaneous attacks. In Proc. IEEE DISCEX, April 2003."},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the 2005 Workshop on Steps to Reducing Unwanted Traffic on the Internet","author":"Greenhalgh A.","year":"2005","unstructured":"A. Greenhalgh , M. Handley , and F. Huici . Using Routing and Tunneling to Combat DoS Attacks . In Proceedings of the 2005 Workshop on Steps to Reducing Unwanted Traffic on the Internet , 2005 . A. Greenhalgh, M. Handley, and F. Huici. Using Routing and Tunneling to Combat DoS Attacks. In Proceedings of the 2005 Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2005."},{"key":"e_1_2_1_16_1","volume-title":"Proc. ACM HotNets IV","author":"Handley Mark","year":"2005","unstructured":"Mark Handley and Adam Greenhalgh . The case for pushing DNS . In Proc. ACM HotNets IV , November 2005 . Mark Handley and Adam Greenhalgh. The case for pushing DNS. In Proc. ACM HotNets IV, November 2005."},{"key":"e_1_2_1_17_1","volume-title":"Proc. Network and Distributed System Security Symposium","author":"Ioannidis John","year":"2002","unstructured":"John Ioannidis and Steven M. Bellovin . Implementing pushback: Router-based defense against DDoS attacks . In Proc. Network and Distributed System Security Symposium , San Diego. ISOC, Reston, VA. , February 2002 . John Ioannidis and Steven M. Bellovin. Implementing pushback: Router-based defense against DDoS attacks. In Proc. Network and Distributed System Security Symposium, San Diego. ISOC, Reston, VA., February 2002."},{"key":"e_1_2_1_18_1","unstructured":"Juniper Networks. Tunnel services PIC datasheet. http:\/\/www.juniper.net\/products\/modules\/tunnel pic.html.  Juniper Networks. Tunnel services PIC datasheet. http:\/\/www.juniper.net\/products\/modules\/tunnel pic.html."},{"key":"e_1_2_1_19_1","volume-title":"IETF","author":"Kantor B.","year":"1986","unstructured":"B. Kantor and P. Lapsley . Network news transfer protocol, a proposed standard for the stream-based transmission of news. RFC 977 , IETF , February 1986 . B. Kantor and P. Lapsley. Network news transfer protocol, a proposed standard for the stream-based transmission of news. RFC 977, IETF, February 1986."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633032"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874"},{"key":"e_1_2_1_22_1","volume-title":"Proc. ACM HotNets 2005","author":"Kreibich C.","year":"2005","unstructured":"C. Kreibich , A. Warfield , J. Crowcroft , S. Hand , and I. Pratt . Using Packet Symmetry to Curtail Malicious Traffic . In Proc. ACM HotNets 2005 , 2005 . C. Kreibich, A. Warfield, J. Crowcroft, S. Hand, and I. Pratt. Using Packet Symmetry to Curtail Malicious Traffic. In Proc. ACM HotNets 2005, 2005."},{"key":"e_1_2_1_23_1","volume-title":"Proc. ACM HotNets","author":"Lakshminarayanan Karthik","year":"2003","unstructured":"Karthik Lakshminarayanan , Daniel Adkins , Adrian Perrig , and Ion Stoica . Taming IP packet flooding attacks . In Proc. ACM HotNets 2003 . Karthik Lakshminarayanan, Daniel Adkins, Adrian Perrig, and Ion Stoica. Taming IP packet flooding attacks. In Proc. ACM HotNets 2003."},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2003.1176986"},{"key":"e_1_2_1_25_1","unstructured":"Mazu Networks. Network behavior analysis for the perimeter.  Mazu Networks. Network behavior analysis for the perimeter."},{"key":"e_1_2_1_26_1","unstructured":"Network World. Extortion via DDoS on the rise. http:\/\/www.networkworld.com\/ May 2005.  Network World. Extortion via DDoS on the rise. http:\/\/www.networkworld.com\/ May 2005."},{"key":"e_1_2_1_27_1","unstructured":"Prolexic Technologies. Prolexic Technologies Home Page.  Prolexic Technologies. Prolexic Technologies Home Page."},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/347057.347560"},{"key":"e_1_2_1_29_1","unstructured":"R. Sinha C. Papadopoulos and J. Heidemann. Internet Packet Size Distributions: Some Observations. http:\/\/netweb.usc.edu\/\u00bfrsinha\/pkt-sizes 2005.  R. Sinha C. Papadopoulos and J. Heidemann. Internet Packet Size Distributions: Some Observations. http:\/\/netweb.usc.edu\/\u00bfrsinha\/pkt-sizes 2005."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/383059.383060"},{"key":"e_1_2_1_31_1","volume-title":"Proc. 9th USENIX Security Symposium","author":"R. Stone. Center","year":"2000","unstructured":"R. Stone. Center Track : An IP overlay network for tracking DoS floods . In Proc. 9th USENIX Security Symposium , August 2000 . R. Stone. CenterTrack: An IP overlay network for tracking DoS floods. In Proc. 9th USENIX Security Symposium, August 2000."},{"volume-title":"Internet Security Threat Report","author":"Symantec Corporation","key":"e_1_2_1_32_1","unstructured":"Symantec Corporation . Internet Security Threat Report Volume IX . http:\/\/www.symantec.com\/enterprise\/threatreport\/index.jsp. Symantec Corporation. Internet Security Threat Report Volume IX. http:\/\/www.symantec.com\/enterprise\/threatreport\/index.jsp."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159948"},{"key":"e_1_2_1_34_1","first-page":"93","volume-title":"SP '03: Proceedings of the 2003 IEEE Symposium on Security and Privacy","author":"Yaar A.","unstructured":"A. Yaar , A. Perrig , and D. Song . Pi: A path identification mechanism to defend against DDoS attacks . In SP '03: Proceedings of the 2003 IEEE Symposium on Security and Privacy , page 93 . IEEE Computer Society, 2003. A. Yaar, A. Perrig, and D. Song. Pi: A path identification mechanism to defend against DDoS attacks. In SP '03: Proceedings of the 2003 IEEE Symposium on Security and Privacy, page 93. IEEE Computer Society, 2003."},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2004.1301320"}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1232919.1232924","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1232919.1232924","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:51:51Z","timestamp":1750258311000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1232919.1232924"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,3,20]]},"references-count":34,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2007,3,20]]}},"alternative-id":["10.1145\/1232919.1232924"],"URL":"https:\/\/doi.org\/10.1145\/1232919.1232924","relation":{},"ISSN":["0146-4833"],"issn-type":[{"type":"print","value":"0146-4833"}],"subject":[],"published":{"date-parts":[[2007,3,20]]},"assertion":[{"value":"2007-03-20","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}