STONE: A stream-based DDoS defense framework
Paper i proceeding, 2013

An effective Distributed Denial of Service (DDoS) defense mechanism must guarantee legitimate users access to an Internet service masking the effects of possible attacks. That is, it must be able to detect threats and discard malicious packets in a online fashion. Given that emerging data streaming technology can enable such mitigation in an effective manner, in this paper we present STONE, a stream-based DDoS defense framework, which integrates anomaly-based DDoS detection and mitigation with scalable data streaming technology. With STONE, the traffic of potential targets is analyzed via continuous data streaming queries maintaining information used for both attack detection and mitigation. STONE provides minimal degradation of legitimate users traffic during DDoS attacks and it also faces effectively flash crowds. Our preliminary evaluation based on an implemented prototype and conducted with real legitimate and malicious traffic traces shows that STONE is able to provide fast detection and precise mitigation of DDoS attacks leveraging scalable data streaming technology.

DDoS detection and mitigation

Data streaming


Mar Callau-Zori

Universidad Politecnica de Madrid

Vincenzo Massimiliano Gulisano

Universidad Politecnica de Madrid

Zhang Fu

Chalmers, Data- och informationsteknik, Nätverk och system

Ricardo Jiménez-Péris

Universidad Politecnica de Madrid

Marina Papatriantafilou

Chalmers, Data- och informationsteknik, Nätverk och system

Marta Patiño-Martínez

Universidad Politecnica de Madrid

Proceedings of the ACM Symposium on Applied Computing, SAC 2013; Coimbra; Portugal; 18 March 2013 through 22 March 2013



Data- och informationsvetenskap