Monitoring X-Attack Traffic over Aggregate Network

Abstract

The notable rise in significant UDP/ICMP flooding events and network worms has increased the need to design effective methods for detecting significant attack traffic and preventing further traffic degradation. This work developed web pages allowing users to monitor abnormal UDP/ICMP flooding attack traffic based on the Netflow transportation traffic logs gathered from the aggregate router. This system has been deployed in one regional network center over a TANet backbone. And the automatic X-Attack traffic detecting and limitation system also was implemented based on known extraordinary attack behaviors.