This dissertation, "Investigation of a Router-based Approach to Defense Against Distributed Denial-of-Service (DDoS) Attack" by Yik-Kwan, Eric, Chan, 陳奕鈞, was obtained from The University of Hong Kong (Pokfulam, Hong Kong) and is being sold pursuant to Creative Commons: Attribution 3.0 Hong Kong License. The content of this dissertation has not been altered in any way. We have altered the formatting in order to facilitate the ease of printing and reading of the dissertation. All rights not granted by the above license are retained by the author. Abstract: Abstract of thesis entitled Investigation of a Router-based Approach to Defense against Distributed Denial-of-Service (DDoS) Attack Submitted by Eric Yik-Kwan CHAN for the degree of Master of Philosophy at The University of Hong Kong in August 2004 Distributed Denial-of-Service (DDoS) attacks have recently become a major security threat. DDoS attacks use thousands of zombies that can bring down a website. It is comparatively easy to launch such attacks, but very difficult to defend against them. The difficulties lie in the features of the DDoS attacks. These include: (1) the similarity between the DDoS attack packets and the normal packets; (2) the flooding nature of the DDoS attacks; (3) the unknown sources of attacks that make use of spoofed source IP addresses; and (4) the highly distributed nature of DDoS attacks. Several counter-measures, including traceback techniques, have been proposed by researchers, but it has not yet been possible to develop a generic scheme to solve the problem. This thesis investigates a DDoS defensive scheme, Intrusion Detection Router (IDR), aimed at providing a defense against flooding-based DDoS attacks of all possible types. IDR basically consists of three modules. When a suspicious DDoS attack is detected by the DDoS Attack Detection Module, attack packets will be classified and discarded by the Packet Classification Module. The remaining packets can be optionally rate-limited by the TrafficControl Module to provide a second line of defense. The effectiveness of IDR was analysed through various experiments using both internet traffic traces and a large-scale testbed. The results of these experiments demonstrated that IDR is able to detect and repel DDoS attacks of different types. DOI: 10.5353/th_b3017330 Subjects: Internet - Security measuresComputer networks - Security measuresElectronic data processing - Distributed processing