Fingerprinting Internet DNS Amplification DDoS Activities

摘要: This work proposes a novel approach to infer and characterize Internet-scale DNS amplification DDoS attacks by leveraging the darknet space. Complementary pioneer on inferring Distributed Denial of Service (DDoS) using darknet, this shows that we can extract activities without relying backscattered analysis. The aim is cyber security intelligence related Amplification such as detection period, attack duration, intensity, packet size, rate geo- location in addition various network-layer flow-based insights. To achieve task, proposed exploits certain parameters detect attacks. We empirically evaluate 720 GB real data collected from /13 address space during recent three months period. Our analysis reveals was successful significant including prominent targeted one largest anti-spam organizations. Moreover, disclosed mechanism Further, results uncover high-speed stealthy attempts were never previously documented. case study history lead better understanding nature scale threat generate inferences could contribute detecting, preventing, assessing, mitigating even attributing activities.