An Aggregative Approach for Scalable Detection of DoS Attacks

In Voice Over IP (VoIP) systems, intruders can launch DoS attacks by establishing a large number of open connections to prevent the system from serving legitimate users. Existing defenses against DoS attacks on VoIP systems maintain full state information and thus are not scalable to implement at core routers. To this end, we adopt a two-layer aggregation scheme, termed Advanced Partial Completion Filters (APCF), to defend against DoS attacks without tracking state information of each individual connection. APCF provides adjustable control parameters so that both false alarms and detection rate can be controlled.