  Distributed Denial of Service (DDoS) attacks have emerged as a popular means
of causing mass targeted service disruptions, often for extended periods of
time. The relative ease and low costs of launching such attacks, supplemented
by the current inadequate sate of any viable defense mechanism, have made them
one of the top threats to the Internet community today. Since the increasing
popularity of web-based applications has led to several critical services being
provided over the Internet, it is imperative to monitor the network traffic so
as to prevent malicious attackers from depleting the resources of the network
and denying services to legitimate users. This paper first presents a brief
discussion on some of the important types of DDoS attacks that currently exist
and some existing mechanisms to combat these attacks. It then points out the
major drawbacks of the currently existing defense mechanisms and proposes a new
mechanism for protecting a web-server against a DDoS attack. In the proposed
mechanism, incoming traffic to the server is continuously monitored and any
abnormal rise in the inbound traffic is immediately detected. The detection
algorithm is based on a statistical analysis of the inbound traffic on the
server and a robust hypothesis testing framework. Simulations carried out on
the proposed mechanism have produced results that demonstrate effectiveness of
the proposed defense mechanism against DDoS attacks.
