Abstract
Clone attacks are a way to perform DDOS attack on Internet Relay Chat networks. There is no tool which prevents an IRC network against such attacks despite some handcrafted methods which are not so efficient. Here, we present qui-gon, the first tool which defeat clones attacks. It uses a temporal oracle which detect attacks by measuring the connection rate; and another oracle which distinguish clones using probabilistic automata. These oracles learn the characteristic of the network in order to fit better to the network.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
J. Mirkovic, P. Reiher: A Taxonomy of DDoS Attacks and Defense Mechanisms, ACM SIGCOMM Computer Communications Review, vol. 34, no. 2, 2004
C. Douligeris, A. Mitrokotsa: DDoS Attacks and Defense Mechanisms: Classification and State-of-the-Art, Computer Networks, vol 44, no 5, 2003
H. Alaganandam, P. Mittal, A. Singh, C. Fleizach: Cybercriminal Activity, 2005
J. Oikarinen, D. Reed: Internet Relay Chat Protocol, IETF, RFC n1459, 1993
B. McCarty: Botnets: Big and Bigger, IEEE Security and Privacy, vol. 1, n0. 4, 2003
D. Geer: Malicious bots threaten network security, IEEE Computer Society, vol. 38, n0. 1, 2005
D. R. Karrels: Internet Relay Chat Service Framework : GNUWorld, 2003
N. W. Van Dyke, H. Lieberman, P. Maes: Butterfly: a conversationfinding agent for Internet Relay Chat, 4th International Conference on Intelligent User Interfaces, 1998
Dr. R. S. Wallace: The Elements of AIML Style, A.L.I.C.E. Artificial Intelligence Foundation, Inc., 2003
J. Canavan: The evolution of malicious IRC Bots, Virus Bulletin Conference, 2005
D. Bernstein: Syn cookies - http://cr.yp.to/syncookies.html, Last acessed: July 2007
H. Bechar-Israeli: From Bonehead to cLoNehEAd: Nicknames, Play and Identity on Internet Relay Chat, Journal of Computer-Mediated Communication, vol 1, no 2, 1996
E. M. Reid: Electropolis : Communication and Community on Internet Relay Chat, 1991
http://packetstormsecurity.org/DoS/pru.c, Example of clone attack tool, Last accessed: July 2007
P. Dupont: Noisy Sequence Classification with smoothed Markov Chains, 8me confrence francophone sur l’apprentissage automatique, 2006
T. Henin: Reprsentation par jeu du chaos de squences d’ADN, ENS Cachan, University Rennes 1, 2007
F. Thollard, A. Clark: Apprentissage d’automates probabilistes dterministes, Confrence d’Apprentissage, 2004
J. Callut, P. Dupont: Inducing Hidden Markov Models to Model Long-Term Dependencies, Artificial Intelligence, European Conference on Machine Learning, 2005
V. Laurikari: Efficient Submatch Addressing for Regular Expressions, Helsinki University of Technology, 2001
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer Science+Business Media, LLC
About this paper
Cite this paper
Henin, T., Huguennet, C. (2009). QuiGon: The First Tool Against Clone Attack on Internet Relay Chat. In: Siris, V., Anagnostakis, K., Ioannidis, S., Trimintzios, P. (eds) Proceedings of the 3rd European Conference on Computer Network Defense. Lecture Notes in Electrical Engineering, vol 30. Springer, Boston, MA. https://doi.org/10.1007/978-0-387-85555-4_8
Download citation
DOI: https://doi.org/10.1007/978-0-387-85555-4_8
Publisher Name: Springer, Boston, MA
Print ISBN: 978-0-387-85554-7
Online ISBN: 978-0-387-85555-4
eBook Packages: EngineeringEngineering (R0)