Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > publications : papers : 2017 : millions_targets_under_attack
Millions of Targets Under Attack: a Macroscopic Characterization of the DoS Ecosystem
M. Jonker, A. King, J. Krupp, C. Rossow, A. Sperotto, and A. Dainotti, "Millions of Targets Under Attack: a Macroscopic Characterization of the DoS Ecosystem", in Internet Measurement Conference (IMC), Nov 2017.
|   View full paper:    PDF    DOI    Related Presentation    |  Citation:    BibTeX   |

Millions of Targets Under Attack: a Macroscopic Characterization of the DoS Ecosystem

Mattijs Jonker3
Alistair King1
Johannes Krupp2
Christian Rossow2
Anna Sperotto3
Alberto Dainotti1
1

CAIDA, San Diego Supercomputer Center, University of California San Diego

2

CISPA, Saarland University

3

University of Twente

Denial-of-Service attacks have rapidly increased in terms of frequency and intensity, steadily becoming one of the biggest threats to Internet stability and reliability. However, a rigorous comprehensive characterization of this phenomenon, and of countermeasures to mitigate the associated risks, faces many infrastructure and analytic challenges. We make progress toward this goal, by introducing and applying a new framework to enable a macroscopic characterization of attacks, attack targets, and DDoS Protection Services (DPSs). Our analysis leverages data from four independent global Internet measurement infrastructures over the last two years: backscatter traffic to a large network telescope; logs from amplification honeypots; a DNS measurement platform covering 60% of the current namespace; and a DNS-based data set focusing on DPS adoption. Our results reveal the massive scale of the DoS problem, including an eye-opening statistic that one-third of all /24 networks recently estimated to be active on the Internet have suffered at least one DoS attack over the last two years. We also discovered that often targets are simultaneously hit by different types of attacks. In our data, Web servers were the most prominent attack target; an average of 3% of the Web sites in .com, .net, and .org were involved with attacks, daily. Finally, we shed light on factors influencing migration to a DPS.

Keywords: internet outages, measurement methodology, network telescope, security
  Last Modified: Mon Nov-6-2017 12:17:29 PST
  Page URL: http://www.caida.org/publications/papers/2017/millions_targets_under_attack/index.xml