Analyzing Large DDoS Attacks Using Multiple Data Sources

Internet distributed denial of service (DDoS) attacks are becoming increasingly prevalent [1]. To prevent the discovery of attack sources, attackers have been known to spoof the source IP addresses of packets in DDoS attack. These spoofed addresses were often chosen randomly from the IPv4 space, which allowed a technique called backscatter analysis [2] to be used to infer the prevalence of such spoofed DDoS attacks on the Internet. This technique works by measuring the amount of unwanted tra