An intrusion surveillance system to detect IRC-based DDoS attacks

Distributed Denial of Service (DDoS) attacks has been a serious threat on security of the current Internet. Recently there is a trend that many DDoS attacks utilize Internet Relay Chat (IRC) infrastructures as the communication channels. In this paper we propose an Intrusion Surveillance System (ISS) to detect IRC-based DDoS attacks. The main functions of ISS are to observe network conditions, gather intelligence from distributed sources, and determine what potential attacks will likely happen. We give the detailed design of ISS in this paper. We also implement this system by using a new approach of text-based decision making - Distributed Preference-Based Surveillance (DPBS) algorithm. By experiments we demonstrate that this distributed algorithm can effectively identify potential IRC-based DDoS attacks based on the information from different locations. © 2006 IEEE