USENIX Conference Policies
MULTOPS: A Data-Structure for Bandwidth Attack Detection
A denial-of-service bandwidth attack is an attempt to disrupt an online service by generating a traffic over-load that clogs links or causes routers near the victim to crash. We propose a heuristic and a data-structure that network devices (such as routers) can use to detect (and eliminate) such attacks. With our method, each network device maintains a data-structure, MULTOPS, that mon-itors certain traffic characteristics. MULTOPS (MUlti-Level Tree for Online Packet Statistics) is a tree of nodes that contains packet rate statistics for subnet prefixes at different aggregation levels. The tree expands and con-tracts within a fixed memory budget.
A network device using MULTOPS detects ongoing bandwidth attacks by the significant, disproportional dif-ference between packet rates going to and coming from the victim or the attacker. MULTOPS-equipped routing software running on an off-the-shelf 700 Mhz Pentium III PC can process up to 340,000 packets per second.
author = {Thomer M. Gil and Massimiliano Poletto},
title = {{MULTOPS}: A {Data-Structure} for Bandwidth Attack Detection},
booktitle = {10th USENIX Security Symposium (USENIX Security 01)},
year = {2001},
address = {Washington, D.C.},
url = {https://www.usenix.org/conference/10th-usenix-security-symposium/multops-data-structure-bandwidth-attack-detection},
publisher = {USENIX Association},
month = aug
}