![[CAIDA - Cooperative Association for Internet Data Analysis logo]](/images/caida_globe_faded.png)
![[CAIDA]](/images/caida_whitewords.png "Go to CAIDA home page"){kind=small}
Abstract for "Inferring Internet Denial-of-Service Activity" authored by David Moore, Colleen Shannon, Doug Brown, Geoffrey M. Voelker and Stefan Savage. Appeared in ACM Transactions on Computer Systems, vol. 24, no. 2, pp. 115-139, May 2006.
Educational video: Backscatter analysis of denial-of-service attacks (90 seconds)
The original paper from USENIX Security Symposium in 2001.
Inferring Internet Denial-of-Service Activity
David Moore and Colleen Shannon
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego
Doug Brown
University of California, San Diego and New York University
Geoffrey M. Voelker, Stefan Savage
University of California, San Diego
In this paper, we seek to address a simple question: "How prevalent are denial-of-service attacks in the Internet?" Our motivation is to quantitatively understand the nature of the current threat as well as to enable longer-term analyses of trends and recurring patterns of attacks. We present a new technique, called "backscatter analysis", that provides a conservative estimate of worldwide denial-of-service activity. We use this approach on 22 traces (each covering a week or more) gathered over three years from 2001 through 2004. Across this corpus we quantitatively assess the number, duration and focus of attacks, and qualitatively characterize their behavior. In total, we observed over 68,000 attacks directed at over 34,000 distinct victim IP addresses -- ranging from well-known e-commerce companies such as Amazon and Hotmail to small foreign ISPs and dial-up connections. We believe our technique is the rst to provide quantitative estimates of Internet-wide denial-of-service activity and that this paper describes the most comprehensive public measurements of such activity to date.