The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments

Publikation: Beitrag in Buch/Konferenzbericht/Sammelband/GutachtenBeitrag in KonferenzbandBeigetragenBegutachtung

Beitragende

  • Raphael Hiesgen - , Hochschule fur Angewandte Wissenschaften Hamburg (HAW) (Autor:in)
  • Marcin Nawrocki - , NetScout Systems, Inc (Autor:in)
  • Marinho Barcellos - , University of Waikato (Autor:in)
  • Daniel Kopp - , Deutscher Commercial Internet Exchange (DE-CIX) Management GmbH (Autor:in)
  • Oliver Hohlfeld - , Universität Kassel (Autor:in)
  • Echo Chan - , Akamai Technologies, Hong Kong Polytechnic University (Autor:in)
  • Roland Dobbins - , NetScout Systems, Inc (Autor:in)
  • Christian Doerr - , Hasso-Plattner-Institut für Softwaresystemtechnik GmbH (Autor:in)
  • Christian Rossow - , CISPA – Helmholtz-Zentrum für Informationssicherheit (Autor:in)
  • Daniel R. Thomas - , University of Strathclyde (Autor:in)
  • Mattijs Jonker - , University of Twente (Autor:in)
  • Ricky Mok - , Center for Applied Internet Data Analysis, University of California at San Diego (Autor:in)
  • Xiapu Luo - , Hong Kong Polytechnic University (Autor:in)
  • John Kristoff - , NetScout Systems, Inc, University of Illinois at Chicago (Autor:in)
  • Thomas C. Schmidt - , Hochschule fur Angewandte Wissenschaften Hamburg (HAW) (Autor:in)
  • Matthias Wählisch - , Professur für Distributed and Networked Systems (Autor:in)
  • KC Claffy - , Center for Applied Internet Data Analysis, University of California at San Diego (Autor:in)

Abstract

Motivated by the impressive but diffuse scope of DDoS research and reporting, we undertake a multistakeholder (joint industry-academic) analysis to seek convergence across the best available macroscopic views of the relative trends in two dominant classes of attacks -- direct-path attacks and reflection-amplification attacks. We first analyze 24 industry reports to extract trends and (in)consistencies across observations by commercial stakeholders in 2022. We then analyze nine data sets spanning industry and academic sources, across four years (2019-2023), to find and explain discrepancies based on data sources, vantage points, methods, and parameters. Our method includes a new approach: we share an aggregated list of DDoS targets with industry players who return the results of joining this list with their proprietary data sources to reveal gaps in visibility of the academic data sources. We use academic data sources to explore an industry-reported relative drop in spoofed reflection-amplification attacks in 2021-2022. Our study illustrates the value, but also the challenge, in independent validation of security-related properties of Internet infrastructure. Finally, we reflect on opportunities to facilitate greater common understanding of the DDoS landscape. We hope our results inform not only future academic and industry pursuits but also emerging policy efforts to reduce systemic Internet security vulnerabilities.

Details

OriginalspracheEnglisch
TitelProceedings of ACM Internet Measurement Conference (IMC)
Herausgeber (Verlag)ACM New York, NY, USA
Seiten259-279
PublikationsstatusVeröffentlicht - 4 Nov. 2024
Peer-Review-StatusJa

Konferenz

TitelACM Internet Measurement Conference 2024
KurztitelACM IMC 2024
Veranstaltungsnummer24
Dauer4 - 6 November 2024
Webseite
BekanntheitsgradInternationale Veranstaltung
OrtESPACIO Fundación Telefónica
StadtMadrid
LandSpanien

Externe IDs

ORCID /0000-0002-3825-2807/work/171066142

Schlagworte

Forschungsprofillinien der TU Dresden

Fächergruppen, Lehr- und Forschungsbereiche, Fachgebiete nach Destatis