doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Response <s> A Distributed denial of service (DDoS) attack uses multiple machines operating in concern to attack a network or site. It is the most important security problem for IT managers. These attacks are very simple organized for intruders and hence so disruptive. The detection and defense of this attack has specific importance among network specialists. In this paper a new and smart taxonomy of DDoS attack and defense mechanism will be introduced. The attacks taxonomy is introduced using both known and potential attack mechanisms. It comprises all types of attacks and provides a comprehensive point of view for DDoS attacks. We introduce a useful tool that can be employed to a sophisticated selection defense method for DDoS attacks. Furthermore a smart taxonomy method of DDOS attacks will be proposed to help selection an appropriate defense mechanism. This method uses some features of DDOS attacks and classifies it to several clusters by Kmean algorithm and labels each cluster with a defense mechanism. If an IDS detects a DDOS attack, proposed system extract attack features and classify it by KNN (K-Nearest-Neighbor) to determine the cluster in which it belongs to. The defense mechanisms taxonomy is using the currently known approaches. Also the comprehensive defense classification will help to find the appropriate strategy to overcome the DDoS attack. <s> BIB001 </s> doi:10.1093/comjnl/bxh000 Protection against Denial of Service Attacks: A Survey <s> Conclusions on DoS Response <s> Network worms are malicious self-replicating applications that propagate in a network by infecting node after node. They can cause significant damage by reducing the system performance or totaly disabling nodes, which results into considerable degradation of the quality of service (QoS) that the users experience. The Cognitive Packet Network (CPN) is an adaptive routing protocol that attempts to address the QoS requirements of the network’s users by routing their traffic according to them. Although it is generally very resilient to network changes, it may suffer worse performance during a worm attack. Here we evaluate its performance in such crises and compare it with the Open Shortest Path First (OSPF) routing protocol, the current industry standard and widely used in Internet Protocol networks. Then we improve it by introducing a failure detection element that reduces packet loss and delay during failures. Our experiments were performed in a large networking testbed. <s> BIB002
Most of the existing literature uses different forms of redirection or dropping of the packets that the classification methods identify as illegitimate. Redirecting the offending packets to a controlled part of the network, not only decreases the congestion in the victim network, but also provides the opportunity to analyse the attack. However, such a safe and controlled environment usually does not exist and is difficult to build within a network. The family of response methods based on dropping packets is much more common, with packet filtering that depends on classification rules being the predominant technique. In practice, the large variety of DoS attack and response methods present the need for a mapping between the two. The authors of BIB001 propose such a framework that chooses a defence mechanism for a given attack mechanism, but results of their method have not been presented yet. Self-aware networks are generally more resilient to network threats, such as worms BIB002 and Denial of Service attacks, but may still need threat-specific defence systems to maintain the quality of service of their users.