Using network management systems to detect Distributed Denial of Service Attacks

Abstract

Distributed Denial of Service (DDoS) Attacks have been increasingly found to be affecting the normal functioning of organizations causing billions of dollars of losses. Organizations are trying their best to minimize their losses from these systems. However, most of the organizations widely use the Network Management Systems (NMS) to observe and manage their networks. One of the major functional areas of a NMS is Security Management. This thesis examines how the Network Management Systems could aid in the detection of the DDoS attacks so that the losses from these could be minimized. The thesis details the SNMP MIB variables of importance for detecting these attacks and the MIB signatures of the specific attack.