An Efficient Filter for Denial-of-Service Bandwidth Attacks

This paper presents an efficient method for detecting and filtering denial-of-service bandwidth attacks. The system called TOPS (Tabulated Online Packet Statistics) can monitor a large number of network addresses in a compact, fixed-size structure using several effective heuristics. The paper demonstrates that TOPS can detect bandwidth attacks in a standard benchmark dataset with a high accuracy and a low false alarm rate. A key benefit of TOPS is that it uses few computational resources and does not slow down during an attack.