.png){kind=icon}
返回
An empirical study of reflection attacks using NetFlow data
.png){kind=icon}
OA
AI
DOI：10.1186/s42400-023-00203-7.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Reflection attacks are one of the most intimidating threats organizations face. A reflection attack is a special type of distributed denial-of-service attack that amplifies the amount of malicious traffic by using reflectors and hides the identity of the attacker. Reflection attacks are known to be one of the most common causes of service disruption in large networks. Large networks perform extensive logging of NetFlow data, and parsing this data is an advocated basis for identifying network attacks. We conduct a comprehensive analysis of NetFlow data containing 1.7 billion NetFlow records and identified reflection attacks on the network time protocol (NTP) and NetBIOS servers. We set up three regression models including the Ridge, Elastic Net and LASSO. To the best of our knowledge, there is no work that studied different regression models to understand patterns of reflection attacks in a large network. In this paper, we (a) propose an approach for identifying correlations of reflection attacks, and (b) evaluate the three regression models on real NetFlow data. Our results show that (a) reflection attacks on the NTP servers are not correlated, (b) reflection attacks on the NetBIOS servers are not correlated, (c) the traffic generated by those reflection attacks did not overwhelm the NTP and NetBIOS servers, and (d) the dwell times of reflection attacks on the NTP and NetBIOS servers are too small for predicting reflection attacks on these servers. Our work on reflection attacks identification highlights recommendations that could facilitate better handling of reflection attacks in large networks.
Keyword:
Large networks
NetFlow data
Reflection attacks
Regression analysis
期刊
C
IF:
3.7
论文数:
589
被引数:
1.0K
机构
引用论文
Patients’ perspectives on screening for disordered eating among adolescents with type 1 diabetesOAAI
OAAI分享收藏分享收藏Restoring faith in conservation action: Maintaining wild genetic diversity through the Tasmanian devil insurance program.png)
iScience
OAAI
iScienceIF0
OAAI分享收藏Detection of DDoS attacks with feed forward based deep neural network model基于前馈深度神经网络模型的DDoS攻击检测
PREAI
分享收藏
查看更多内容