This paper presents a novel defense scheme for DDoS attacks that uses an image processing method. This scheme especially focused on the prevalence of adjacent neighbor spoofing, called subnet spoofing. It is rarely studied and there is few or no feasible approaches than other spoofing attacks. The key idea is that a “DDoS attack with IP spoofing” is represented as a specific pattern such as a “line” on the spatial image planes, which can be recognized through an image processing technique. Applying the clustering technique to the lines makes it possible to identify multiple attack source networks simultaneously. For the identified networks in which the zombie hosts reside, we then employ a signature-based pattern extraction algorithm, called a pivoted movement, and the DDoS attacks are filtered by correlating the IP and media access control pairing signature. As a result, this proposed scheme filters attacks without disturbing legitimate traffic. Unlike previous IP traceback schemes such as packet marking and path fingerprinting, which try to diagnose the entire attack path, our proposed scheme focuses on identifying only the attack source. Our approach can achieve an adaptive response to DDoS attacks, thereby mitigating them at the source, while minimizing the disruption of legitimate traffic. The proposed scheme is analyzed and evaluated on the IPv4 and IPv6 network topology from CAIDA, the results of which show its effectiveness.

Because network diagrams drawn using the spring embedder are not easy to read, this paper proposes the use of "anchored maps" in which some nodes are fixed as anchors. The readability of network diagrams is discussed, anchored maps are proposed, and a method for drawing anchored maps is explained. The method uses indices to decide the orders of anchors because those orders markedly affect the readability of the network diagrams. Examples showing the effectiveness of the anchored maps are also shown.

Most current management systems employ graphic-user-interface displays to visualize the networks being managed. Some networks are so large that it is difficult to display all network elements in a single window alone, and therefore, the hierarchical multi-window style presentation is commonly used. This form of presentation has disadvantages, however, including the fact that window manipulations are complex. Our approach (bifocal network visualization) is able to display both the context and any detail of a network within a single window, and overcomes the disadvantages of hierarchical multi-window presentation. We implemented this bifocal network visualization on a workstation using a frame buffer memory called DUALQUEST that is able to generate images in real-time and is simple to operate. This paper describes bifocal network visualization and its implementation. Furthermore, we present an experiment to compare our interface with conventional hierarchical multi-window presentation.