Delving into Internet DDoS Attacks by Botnets: Characterization and Analysis

摘要: Internet Distributed Denial of Service (DDoS) at- tacks are prevalent but hard to defend against, partially due the volatility attacking methods and patterns used by attackers. Understanding latest DDoS attacks can provide new insights for effective defense. But most existing understandings based on indirect traffic measures (e.g., backscatters) or seen locally. In this study, we present an in-depth analysis 50,704 different directly observed in a seven-month period. These were launched 674 botnets from 23 botnet families with total 9,026 victim IPs belonging 1,074 organizations 186 countries. Our reveals several interesting findings about today's attacks. Some highlights include: (1) geolocation shows that geospatial distribution sources follows certain patterns, which enables very accurate source prediction future active families, (2) target perspective, multiple same also exhibit strong inter-attack time interval, allowing start next anticipated (3) there is trend launch targeting victim, simultaneously turn. add literature understanding attacks, offer designing defense schemes at levels.