Distributed detection and response for the mitigation of distributed denial of service attacks

Distributed Denial of Service (DDoS) attacks continue to escalate in size and impact despite efforts to control and limit exposures that enable them to be successful. This proposal takes a novel approach to the DDoS problem, by combining separate existing information security technologies in a collaborative system. Devices used to gather evidence on attack methods and provide for reverse engineering malware are ‘honeypots’. These devices provide researchers with critically important information for analysis and eventually allow for development of detection and response mechanisms to malicious attacks. Intrusion prevention systems (IPS) can take action to alert administrators to potential misuse of computing assets, and in many cases execute predetermined response to malicious activity. This work tests operational communication between distributed honeypots and IPS devices to detect and actively respond to denial of service attacks at near machine speed.