Flooding attacks to internet threat monitors (ITM): Modeling and counter measures using botnet and honeypots

摘要

The Internet Threat Monitoring (ITM),is a globally scoped Internet monitoringsystem whose goal is to measure, detect, characterize, and track threats suchas distribute denial of service(DDoS) attacks and worms. To block themonitoring system in the internet the attackers are targeted the ITM system. Inthis paper we address flooding attack against ITM system in which the attackerattempt to exhaust the network and ITM's resources, such as network bandwidth,computing power, or operating system data structures by sending the malicioustraffic. We propose an information-theoretic frame work that models theflooding attacks using Botnet on ITM. Based on this model we generalize theflooding attacks and propose an effective attack detection using Honeypots.