text: Denial of Service (DoS) attacks are one of the most challenging threats to Internet security. An attacker typically compromises a large number of vulnerable hosts and uses them to flood the victim's site with malicious traffic, clogging its tail circuit and interfering with normal traffic. At present, the network operator of a site under attack has no other resolution but to respond manually by inserting filters in the appropriate edge routers to drop attack traffic. However, as DoS attacks become increasingly sophisticated, manual filter propagation becomes unacceptably slow or even infeasible. In this paper, we present Active Internet Traffic Filtering, a new automatic filter propagation protocol. We argue that this system provides a guaranteed, significant level of protection against DoS attacks in exchange for a reasonable, bounded amount of router resources. We also argue that the proposed system cannot be abused by a malicious node to interfere with normal Internet operation. Finally, we argue that it retains its efficiency in the face of continued Internet growth.
  @cite_5: The current Internet infrastructure has very few built-in protection mechanisms, and is therefore vulnerable to attacks and failures. In particular, recent events have illustrated the Internet's vulnerability to both denial of service (DoS) attacks and flash crowds in which one or more links in the network (or servers at the edge of the network) become severely congested. In both DoS attacks and flash crowds the congestion is due neither to a single flow, nor to a general increase in traffic, but to a well-defined subset of the traffic --- an aggregate. This paper proposes mechanisms for detecting and controlling such high bandwidth aggregates. Our design involves both a local mechanism for detecting and controlling an aggregate at a single router, and a cooperative pushback mechanism in which a router can ask upstream routers to control an aggregate. While certainly not a panacea, these mechanisms could provide some needed relief from flash crowds and flooding-style DoS attacks. The presentation in this paper is a first step towards a more rigorous evaluation of these mechanisms.
summary: In @cite_5 Mahajan propose mechanisms for detecting and controlling high bandwidth traffic aggregates. One part of their work discusses how a node determines whether it is congested and how it identifies the aggregate(s) responsible for the congestion. In contrast, we start from the point where the node has identified the undesired flow(s). In that sense, their work and our work are complementary. Another part of their work discusses how much to rate-limit an annoying aggregate due to a DoS attack or a flash crowd. In contrast, our mechanism focuses on DoS attack traffic and attempts to limit it to rate @math . We believe that DoS attacks should be addressed separately from flash crowds: Flash crowd aggregates are created by legitimate traffic. Therefore, it makes sense to rate-limit them instead of completely blocking them. On the contrary, DoS attack traffic aims at disrupting the victim's operation. Therefore, it makes sense to block it. Blocking a traffic flow is simpler and cheaper than rate-limiting it. Moreover, DoS attack traffic is generated by malicious compromised nodes. Therefore, it demands a more intelligent defense mechanism.