<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01411196</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T22:28:15+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">DoS Amplification Attacks – Protocol-Agnostic Detection of Service Abuse in Amplifier Networks</title>
            <author role="aut">
              <persName>
                <forename type="first">Timm</forename>
                <surname>Böttger</surname>
              </persName>
              <email type="md5">6c620cb7653eb3e75822ebcdbaebe224</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">995534</idno>
              <idno type="halauthorid" notation="string">1090347-995534</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Lothar</forename>
                <surname>Braun</surname>
              </persName>
              <email type="md5">ac4d97266c646554fa9e3940fff8d6a1</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">995535</idno>
              <idno type="halauthorid" notation="string">1090348-995535</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Oliver</forename>
                <surname>Gasser</surname>
              </persName>
              <email type="md5">4cf92f2f8ad4547925f638812b20c6f2</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">1612281</idno>
              <idno type="halauthorid" notation="string">1090344-1612281</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-3425-9331</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Felix</forename>
                <forename type="middle">Von</forename>
                <surname>Eye</surname>
              </persName>
              <email type="md5">9622c02c07976c3fcc8e8b035e31c98c</email>
              <email type="domain">lrz.de</email>
              <idno type="idhal" notation="numeric">995536</idno>
              <idno type="halauthorid" notation="string">1090349-995536</idno>
              <affiliation ref="#struct-475187"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Helmut</forename>
                <surname>Reiser</surname>
              </persName>
              <email type="md5">a200b69ad76d9b3a122160a6cf2cf75e</email>
              <email type="domain">lrz.de</email>
              <idno type="idhal" notation="numeric">995537</idno>
              <idno type="halauthorid" notation="string">1090350-995537</idno>
              <affiliation ref="#struct-475187"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Georg</forename>
                <surname>Carle</surname>
              </persName>
              <email type="md5">58f2e825fcdb5e4a83ee30752a380d2d</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">993621</idno>
              <idno type="halauthorid" notation="string">1012752-993621</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-12-07 10:56:19</date>
              <date type="whenModified">2026-01-28 10:52:04</date>
              <date type="whenReleased">2016-12-07 11:00:28</date>
              <date type="whenProduced">2015-04-21</date>
              <date type="whenEndEmbargoed">2018-01-01</date>
              <ref type="file" target="https://hal.science/hal-01411196v1/document">
                <date notBefore="2018-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-01411196v1/file/336978_1_En_14_Chapter.pdf" id="file-1411196-1497011">
                <date notBefore="2018-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01411196</idno>
            <idno type="halUri">https://hal.science/hal-01411196</idno>
            <idno type="halBibtex">bottger:hal-01411196</idno>
            <idno type="halRefHtml">&lt;i&gt;7th Workshop on Traffic Monitoring and Analysis (TMA)&lt;/i&gt;, Apr 2015, Barcelona, Spain. pp.205-218, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-17172-2_14"&gt;&amp;#x27E8;10.1007/978-3-319-17172-2_14&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">7th Workshop on Traffic Monitoring and Analysis (TMA), Apr 2015, Barcelona, Spain. pp.205-218, &amp;#x27E8;10.1007/978-3-319-17172-2_14&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1411196-1497011"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC6" corresp="IFIP-TC">TC 6: Communication Systems</idno>
            <idno type="stamp" n="IFIP-TMA">IFIP-TMA</idno>
            <idno type="stamp" n="IFIP-WG6-6">Management of Networks and Distributed Systems</idno>
            <idno type="stamp" n="IFIP-LNCS-9053" corresp="IFIP-LNCS">Traffic Monitoring and Analysis</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 5: New Protocols</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">DoS Amplification Attacks – Protocol-Agnostic Detection of Service Abuse in Amplifier Networks</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Timm</forename>
                    <surname>Böttger</surname>
                  </persName>
                  <email type="md5">6c620cb7653eb3e75822ebcdbaebe224</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">995534</idno>
                  <idno type="halauthorid" notation="string">1090347-995534</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Lothar</forename>
                    <surname>Braun</surname>
                  </persName>
                  <email type="md5">ac4d97266c646554fa9e3940fff8d6a1</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">995535</idno>
                  <idno type="halauthorid" notation="string">1090348-995535</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Oliver</forename>
                    <surname>Gasser</surname>
                  </persName>
                  <email type="md5">4cf92f2f8ad4547925f638812b20c6f2</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">1612281</idno>
                  <idno type="halauthorid" notation="string">1090344-1612281</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-3425-9331</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Felix</forename>
                    <forename type="middle">Von</forename>
                    <surname>Eye</surname>
                  </persName>
                  <email type="md5">9622c02c07976c3fcc8e8b035e31c98c</email>
                  <email type="domain">lrz.de</email>
                  <idno type="idhal" notation="numeric">995536</idno>
                  <idno type="halauthorid" notation="string">1090349-995536</idno>
                  <affiliation ref="#struct-475187"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Helmut</forename>
                    <surname>Reiser</surname>
                  </persName>
                  <email type="md5">a200b69ad76d9b3a122160a6cf2cf75e</email>
                  <email type="domain">lrz.de</email>
                  <idno type="idhal" notation="numeric">995537</idno>
                  <idno type="halauthorid" notation="string">1090350-995537</idno>
                  <affiliation ref="#struct-475187"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Georg</forename>
                    <surname>Carle</surname>
                  </persName>
                  <email type="md5">58f2e825fcdb5e4a83ee30752a380d2d</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">993621</idno>
                  <idno type="halauthorid" notation="string">1012752-993621</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Lecture Notes in Computer Science</title>
                <meeting>
                  <title>7th Workshop on Traffic Monitoring and Analysis (TMA)</title>
                  <date type="start">2015-04-21</date>
                  <date type="end">2015-04-24</date>
                  <settlement>Barcelona</settlement>
                  <country key="ES">Spain</country>
                </meeting>
                <editor>Moritz Steiner</editor>
                <editor>Pere Barlet-Ros</editor>
                <editor>Olivier Bonaventure</editor>
                <imprint>
                  <biblScope unit="serie">Traffic Monitoring and Analysis</biblScope>
                  <biblScope unit="volume">LNCS-9053</biblScope>
                  <biblScope unit="pp">205-218</biblScope>
                  <date type="datePub">2015</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-17172-2_14</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>For many years Distributed Denial-of-Service attacks have been known to be a threat to Internet services. Recently a configuration flaw in NTP daemons led to attacks with traffic rates of several hundred Gbit/s. For those attacks a third party, the amplifier, is used to significantly increase the volume of traffic reflected to the victim. Recent research revealed more UDP-based protocols that are vulnerable to amplification attacks. Detecting such attacks from an abused amplifier network’s point of view has only rarely been investigated.In this work we identify novel properties which characterize amplification attacks and allow to identify the illegitimate use of arbitrary services.Their suitability for amplification attack detection is evaluated in large high-speed research networks. We prove that our approach is fully capable of detecting attacks that were already seen in the wild as well as capable of detecting attacks we conducted ourselves exploiting newly discovered vulnerabilities.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 6</org>
              <org type="consortium">WG 6.6</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-132871" status="VALID">
          <idno type="IdRef">031660150</idno>
          <idno type="ISNI">0000000123369749</idno>
          <idno type="ROR">https://ror.org/02kkvpp62</idno>
          <idno type="Wikidata">Q157808</idno>
          <orgName>Technische Universität Munchen = Technical University Munich = Université Technique de Munich</orgName>
          <orgName type="acronym">TUM</orgName>
          <date type="start">1868-01-01</date>
          <desc>
            <address>
              <addrLine>Arcisstrasse 21, D- 80333 München</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">https://www.tum.de</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-475187" status="VALID">
          <idno type="ROR">https://ror.org/05558nw16</idno>
          <orgName>Leibniz Supercomputing Centre</orgName>
          <orgName type="acronym">LRZ</orgName>
          <desc>
            <address>
              <addrLine>Leibniz-Rechenzentrumder Bayerischen Akademie der WissenschaftenBoltzmannstraße 185748 Garching bei München</addrLine>
              <country key="DE"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>