01/15/04

THIS PACKAGE ENCLOSES SEVERAL MATLAB CODES ASSOCIATED WITH The MODEL
AND THE DATA ANALYSIS, AS WELL AS THE RAW DATA:

I. SIMULATION MODEL

The simulation model is described in the section 3 of the paper.

1) ABILENEtddosCR.m
The Constant rate attack of the section 4.1

2) ABILENEtddosIR.m
The Increasing rate attack of the section 4.2

3) ABILENEtddosNR.m
The Natural-network-congestion-like attack of the section 4.3

4) ABILENEtddosGA.m
The Subgroup attack of the section 4.4

5) ABILENEtddosPA.m
The Pulsing attack of the section 4.5

6) ABILENEtddosPAt.m
The TCP-targeted attack of the section 4.5

II. RAW DATA
(Network Flow Data: AAX)

1) Constant rate attack
H=1/5:
ABILENEtddosCR-f5D5T20K2R8A160A20A5-a15on50-a15off5000
H=1/10:
ABILENEtddosCR-f10D5T20K2R8A160A20A5-a15on50-a15off5000

2) Increasing rate attack

ABILENEtddosIR-f35t5D5T20K2R8A160A20A5-a15on50-a15off5000

3) Natural-network-congestion-like attack

ABILENEtddosNR-N5F50D5T20K2R8A160A20A5-a15on50-a15off5000

4) Subgroup attack

ABILENEtddosGA-3a17f5D5T20K2R8A160A20A5-a15on50-a15off5000

5) Pulsing attack

ABILENEtddosPA-f5D5T20K2R8A160A20A5-a15on50-a15off5000

6) TCP-targeted attack

ABILENEtddosPAt-f1D5T1K2R8A160A20A5-a15on50-a15off5000


III. ANALYSIS 

Network flow data AAX is already at the level T=20s. Fisrt, let XL=AAX. Then,  
we can directly compute the spatial-temporal pattern at the subnet-router level with ap11.m.


IV. REFERENCE

J. Yuan, K. Mills, Monitoring the macroscopic effect of DDoS flooding attacks, 2004