Re: BGP FlowSpec

[Tyler Haske <tyler.haske () gmail com>]

Martin,


> Last but not least: I am also looking for anonymized statistical data
about DDoS attacks which I could use in the thesis. I am mainly interested
in data about the
> type of attacks, attack time, sources, source and destination ports, and
so on. I know this something which is generally not shared, so I would
really appreciate it if
> someone would be able to share such data.

Many companies are extremely reluctant to share their attack data. But
that's OK, because there are other ways to get it.

Have you investigated backscatter analysis? It's used to see ongoing and
current Internet scope DDoS attacks.

Inferring Internet Denial of Service Activity
https://cseweb.ucsd.edu/~savage/papers/UsenixSec01.pdf

Analyzing Large DDoS Attacks Using Multiple Data Sources
https://www.cs.utah.edu/~kobus/docs/ddos.lsad.pdf

ISP Security - Real World Techniques
https://www.nanog.org/meetings/nanog23/presentations/greene.ppt

A Summary of DoS/DDoS Prevention, Monitoring and Mitigation Techniques in a
Service Provider Environment
https://www.sans.org/reading-room/whitepapers/intrusion/summary-dos-ddos-prevention-monitoring-mitigation-techniques-service-provider-enviro-1212

Maybe you have access to some public IPs, then you can do this data
collection yourself.

Regards,

Tyler