Home   >   CSC-OpenAccess Library   >    Manuscript Information
DoS Forensic Exemplar Comparison to a Known Sample
Paul Knight, Narasimha Karpoor Shashidhar
Pages - 11 - 21     |    Revised - 31-03-2018     |    Published - 30-04-2018
Volume - 12   Issue - 1    |    Publication Date - April 2018  Table of Contents
Denial of Service Flow Comparison, DoS Similarity Score, DoS Exemplar, Stresser.
The investigation of any event or incident often involves the evaluation of physical evidence. Occasionally, a comparison is conducted between an evidentiary sample of unknown origin and that of an appropriate known sample. In a Denial of Service (DoS) attack, items of evidentiary value may cross the spectrum from anecdotes to useful information in firewall logs or complete packet captures. Because of the spoofed or reflective nature of DoS attacks, relevant information leading to the direct identification of the perpetrator is rarely available. In many instances, this underscores the significance of the investigator's ability to accurately identify the tool utilized by the suspect. For a DoS attack scenario, this would likely involve a commercially available stresser or criminal bot infrastructure. In this paper, we propose the concept of a DoS exemplar and determine if the comparison of evidentiary samples to an appropriate known sample of DoS attributes could add value in the investigative process. We also provide a simple tool to compare two DoS flows.
1 Google Scholar 
2 BibSonomy 
3 Doc Player 
4 Scribd 
5 SlideShare 
D. A. Wheeler, & G. N. Larsen (2003). "Techniques for cyber-attack attribution" (No. IDA-P-3792). Institute for Defense Analyses, Alexandria, VA.
GitHub - prknight/Sam_Project [Online]. Available: https://github.com/prknight/Sam_Project.
J. Hunker, M. Bishop, & C. Gates. (2010). "Report on Attribution for GENI". In National Science Foundation Project 1776, 2010.
J. Santanna, R. van Rijswijk-Deij, R. Hofstede, A. Sperotto, M. Wierbosch, L. Z. Granville, & A. Pras. (2015) "Booters-An analysis of DDoS-as-a-service attacks". In Integrated Network Management (IM), 2015 IFIP/IEEE International Symposium on (pp. 243-251). IEEE.
M. Karami, "Understanding and Undermining the Business of DDoS Booter Services," Ph.D. dissertation, Dept. Comp. Sci., George Mason Univ., Fairfax, VA, 2016.
M. Kührer, T. Hupperich, C. Rossow, & T. Holz. (2014, Aug). "Exit from Hell? Reducing the Impact of Amplification DDoS Attacks". In USENIX Security Symposium (pp. 111-125).
Professor Paul Knight
Department of Computer Science Sam Houston State University Huntsville, TX 77341, USA - United States of America
Dr. Narasimha Karpoor Shashidhar
Sam Houston State University - United States of America

View all special issues >>