Quality-of-protection (QoP) - An online monitoring and self-protection mechanism

Salim Hariri, Guangzhi Qu, Ramkishore Modukuri, Huoping Chen, Mazin Yousif

Research output: Contribution to journalArticlepeer-review

22 Scopus citations

Abstract

With increasing faults and attacks on the Internet infrastructure, there is an impending need to provide automatic techniques to detect and mitigate the impact of attacks on network services. Denial-of-service attacks have been successful in denying legitimate traffic access to its required resources because existing routing protocols treat the attacking traffic equally as any normal traffic. This paper presents a proactive network defense frame-work that can be integrated with existing quality-of-service (QoS) protocols to provide differentiated services to network traffic flows based on their distance from the normal behavior. We introduce a new metric that we refer to as abnormality distance (AD) metric that can be used to classify traffic into normal, probable normal, probable abnormal (suspicious traffic), and abnormal (attacking traffic). The AD metric can then be used in conjunction with any QoS protocol to give high priority to normal traffic and lower priority to abnormal traffic. We demonstrate through several examples, how our approach can dynamically detect attacks, quantify their impact, and how to reduce the impacts and recover from them.

Original languageEnglish (US)
Pages (from-to)1983-1993
Number of pages11
JournalIEEE Journal on Selected Areas in Communications
Volume23
Issue number10
DOIs
StatePublished - Oct 1 2005

Keywords

  • Abnormality distance (AD)
  • Network attack
  • Proactive defense
  • Quality-of-protection (QoP)

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Quality-of-protection (QoP) - An online monitoring and self-protection mechanism'. Together they form a unique fingerprint.

Cite this