Protecting information infrastructure from DDoS attacks by MADF

Distributed Denial of Service (DDoS) attacks have become one of the most serious threats to the information infrastructure. In this paper, we propose a new approach, Mark-Aided Distributed Filtering (MADF), to find the network anomalies by using a back-propagation neural network. The marks in the IP header that are generated by a group of IP traceback schemes called Deterministic Packet Marking (DPM)/Flexible Deterministic Packet Marking (FDPM) assist this process of identifying and filtering attack packets. MADF can detect and filter DDoS attack packets with high sensitivity and accuracy, thus providing high legitimate traffic throughput and low attack traffic throughput. © 2006 Inderscience Enterprises Ltd.