{"id":"https://openalex.org/W3211494975","doi":"https://doi.org/10.1145/3460120.3485385","title":"United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale","display_name":"United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale","publication_year":2021,"publication_date":"2021-11-12","ids":{"openalex":"https://openalex.org/W3211494975","doi":"https://doi.org/10.1145/3460120.3485385","mag":"3211494975"},"language":"en","primary_location":{"id":"doi:10.1145/3460120.3485385","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3460120.3485385","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3460120.3485385","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3460120.3485385","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101519023","display_name":"Daniel W\u00e4gner","orcid":"https://orcid.org/0009-0007-8666-9539"},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Daniel Wagner","raw_affiliation_strings":["DE-CIX & Max Planck Institute for Informatics, Cologne, Germany"],"affiliations":[{"raw_affiliation_string":"DE-CIX & Max Planck Institute for Informatics, Cologne, Germany","institution_ids":["https://openalex.org/I4210109712"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051513192","display_name":"Daniel Kopp","orcid":"https://orcid.org/0000-0002-7012-5007"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Daniel Kopp","raw_affiliation_strings":["DE-CIX, Cologne, Germany"],"affiliations":[{"raw_affiliation_string":"DE-CIX, Cologne, Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068648437","display_name":"Matthias Wichtlhuber","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Matthias Wichtlhuber","raw_affiliation_strings":["DE-CIX, Cologne, Germany"],"affiliations":[{"raw_affiliation_string":"DE-CIX, Cologne, Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005215035","display_name":"Christoph Dietzel","orcid":null},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christoph Dietzel","raw_affiliation_strings":["DE-CIX & Max Planck Institute for Informatics, Cologne, Germany"],"affiliations":[{"raw_affiliation_string":"DE-CIX & Max Planck Institute for Informatics, Cologne, Germany","institution_ids":["https://openalex.org/I4210109712"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003825969","display_name":"Oliver Hohlfeld","orcid":"https://orcid.org/0000-0002-7557-1081"},"institutions":[{"id":"https://openalex.org/I51783024","display_name":"Brandenburg University of Technology Cottbus-Senftenberg","ror":"https://ror.org/02wxx3e24","country_code":"DE","type":"education","lineage":["https://openalex.org/I51783024"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Oliver Hohlfeld","raw_affiliation_strings":["Brandenburg University of Technology, Cottbus, Germany"],"affiliations":[{"raw_affiliation_string":"Brandenburg University of Technology, Cottbus, Germany","institution_ids":["https://openalex.org/I51783024"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005247877","display_name":"Georgios Smaragdakis","orcid":"https://orcid.org/0000-0002-4127-3617"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Georgios Smaragdakis","raw_affiliation_strings":["TU Delft, Delft, Netherlands"],"affiliations":[{"raw_affiliation_string":"TU Delft, Delft, Netherlands","institution_ids":["https://openalex.org/I98358874"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027274731","display_name":"Anja Feldmann","orcid":"https://orcid.org/0000-0002-5530-6993"},"institutions":[{"id":"https://openalex.org/I4210109712","display_name":"Max Planck Institute for Informatics","ror":"https://ror.org/01w19ak89","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210109712"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Anja Feldmann","raw_affiliation_strings":["Max Planck Institute for Informatics, Saarbr\u00fccken, Germany"],"affiliations":[{"raw_affiliation_string":"Max Planck Institute for Informatics, Saarbr\u00fccken, Germany","institution_ids":["https://openalex.org/I4210109712"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5101519023"],"corresponding_institution_ids":["https://openalex.org/I4210109712"],"apc_list":null,"apc_paid":null,"fwci":4.8008,"has_fulltext":true,"cited_by_count":50,"citation_normalized_percentile":{"value":0.95119389,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"970","last_page":"987"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.8779884576797485},{"id":"https://openalex.org/keywords/peering","display_name":"Peering","score":0.8046666979789734},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.8018544912338257},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7139497995376587},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6734200716018677},{"id":"https://openalex.org/keywords/trinoo","display_name":"Trinoo","score":0.6496022939682007},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5518143177032471},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.49615105986595154}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8779884576797485},{"id":"https://openalex.org/C95981142","wikidata":"https://www.wikidata.org/wiki/Q772532","display_name":"Peering","level":3,"score":0.8046666979789734},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.8018544912338257},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7139497995376587},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6734200716018677},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.6496022939682007},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5518143177032471},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.49615105986595154},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3460120.3485385","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3460120.3485385","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3460120.3485385","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:tudelft.nl:uuid:7000bd72-993f-40f5-ba1b-833cb1161b3d","is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:7000bd72-993f-40f5-ba1b-833cb1161b3d","pdf_url":null,"source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"conference paper"}],"best_oa_location":{"id":"doi:10.1145/3460120.3485385","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3460120.3485385","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3460120.3485385","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1401486260","display_name":null,"funder_award_id":"ResolutioNet (ERC-StG-679158)","funder_id":"https://openalex.org/F4320316953","funder_display_name":"European Resuscitation Council"},{"id":"https://openalex.org/G3031800739","display_name":null,"funder_award_id":"BIFOLD","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G352791218","display_name":null,"funder_award_id":"(BMBF)","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G4533892997","display_name":null,"funder_award_id":"01IS18037","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G5269777170","display_name":null,"funder_award_id":"01IS18037A","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G6548623498","display_name":null,"funder_award_id":"01IS18025A and 01IS18037A","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G7225624288","display_name":null,"funder_award_id":"This work was","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"},{"id":"https://openalex.org/G7624340995","display_name":null,"funder_award_id":"01IS18025A","funder_id":"https://openalex.org/F4320321114","funder_display_name":"Bundesministerium f\u00fcr Bildung und Forschung"}],"funders":[{"id":"https://openalex.org/F4320316953","display_name":"European Resuscitation Council","ror":"https://ror.org/05s6r7486"},{"id":"https://openalex.org/F4320321114","display_name":"Bundesministerium f\u00fcr Bildung und Forschung","ror":"https://ror.org/04pz7b180"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3211494975.pdf","grobid_xml":"https://content.openalex.org/works/W3211494975.grobid-xml"},"referenced_works_count":40,"referenced_works":["https://openalex.org/W205175404","https://openalex.org/W1499648394","https://openalex.org/W1756665610","https://openalex.org/W1796296964","https://openalex.org/W1977206554","https://openalex.org/W2001637908","https://openalex.org/W2040534455","https://openalex.org/W2044384431","https://openalex.org/W2046438299","https://openalex.org/W2059874241","https://openalex.org/W2063104870","https://openalex.org/W2070112613","https://openalex.org/W2116696275","https://openalex.org/W2505084349","https://openalex.org/W2542527754","https://openalex.org/W2549994809","https://openalex.org/W2624744148","https://openalex.org/W2748868501","https://openalex.org/W2768883253","https://openalex.org/W2770908045","https://openalex.org/W2783706545","https://openalex.org/W2902983161","https://openalex.org/W2903436061","https://openalex.org/W2923481942","https://openalex.org/W2947389128","https://openalex.org/W2963822870","https://openalex.org/W2964212624","https://openalex.org/W2973936959","https://openalex.org/W2980771234","https://openalex.org/W3036623709","https://openalex.org/W3040590365","https://openalex.org/W3046687504","https://openalex.org/W3094487866","https://openalex.org/W3100857721","https://openalex.org/W3139597027","https://openalex.org/W3174009088","https://openalex.org/W3212591162","https://openalex.org/W4210432015","https://openalex.org/W4251303575","https://openalex.org/W4288086151"],"related_works":["https://openalex.org/W2783466926","https://openalex.org/W4286539397","https://openalex.org/W1968168724","https://openalex.org/W2204131204","https://openalex.org/W2754163055","https://openalex.org/W4322008378","https://openalex.org/W2383770723","https://openalex.org/W2186749541","https://openalex.org/W2360429410","https://openalex.org/W4256682929"],"abstract_inverted_index":{"Amplification":[0],"Distributed":[1],"Denial":[2],"of":[3,67,83,95],"Service":[4],"(DDoS)":[5],"attacks'":[6],"traffic":[7,26,61,118],"and":[8,58,77,114],"harm":[9],"are":[10],"at":[11],"an":[12],"all-time":[13],"high.":[14],"To":[15],"defend":[16],"against":[17],"such":[18,24],"attacks,":[19],"distributed":[20,120],"attack":[21,49,60,117,121],"mitigation":[22,50,94,122],"platforms,":[23],"as":[25,65],"scrubbing":[27],"centers":[28],"that":[29],"operate":[30],"in":[31,42],"peering":[32],"locations,":[33],"e.g.,":[34],"Internet":[35,44],"Exchange":[36],"Points":[37],"(IXP),":[38],"have":[39],"been":[40,74],"deployed":[41],"the":[43,46,104],"over":[45],"years.":[47],"These":[48],"platforms":[51,88,123],"apply":[52],"sophisticated":[53],"techniques":[54],"to":[55,79,91,109],"detect":[56],"attacks":[57,113],"drop":[59,115],"locally,":[62],"thus,":[63],"act":[64],"sensors":[66],"attacks.":[68,98],"However,":[69],"it":[70,107],"has":[71],"not":[72],"yet":[73],"systematically":[75],"evaluated":[76],"reported":[78],"what":[80],"extent":[81],"coordination":[82],"these":[84],"views":[85],"by":[86],"different":[87],"can":[89],"lead":[90],"more":[92,111,116],"effective":[93],"amplification":[96,112],"DDoS":[97],"In":[99],"this":[100],"paper,":[101],"we":[102],"ask":[103],"question:":[105],"\"Is":[106],"possible":[108],"mitigate":[110],"when":[119],"collaborate?\"":[124]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":16},{"year":2024,"cited_by_count":16},{"year":2023,"cited_by_count":8},{"year":2022,"cited_by_count":6}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}