Detection, traceback and filtering of denial of service attacks in networked embedded systems

This work presents a composite scheme for detection, traceback and filtering of distributed denial of service (DDoS) attacks in networked embedded systems. A method based on algorithmic analysis of various node and network parameters is used to detect attacks while a packet marking method is used to mitigate the effects of the attack by filtering the incoming traffic that is part of this attack and trace back to the origin of the attack. The combination of the detection and mitigation methods provide an increased level of security in comparison to approaches based on a single method. Furthermore, the scheme is developed in a way to comply with the novel SHIELD secure architecture being developed, which aims at providing interoperability with other secure components as well as metrics to quantify their security properties.