An Empirical Analysis of Target-Resident DoS Filters
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
Numerous techniques have been proposed by which an end-system, subjected to a denial-of-service flood, filters the offending traffic. In this paper, we provide an empirical analysis of several such proposals, using traffic recorded at the border of a large network and including real DoS traffic. We focus our analysis on four filtering techniques, two based on the addresses from which the victim server typically receives traffic (static clustering and network-aware clustering), and two based on coarse indications of the path each packet traverses (hop-count filtering and path identifiers). Our analysis reveals challenges facing the proposed techniques in practice, and the implications of these issues for effective filtering. In addition, we compare techniques on equal footing, by evaluating the performance of one scheme under assumptions made by another. We conclude with an interpretation of the results and suggestions for further analysis.
Cite This SEI Report
Collins, M., & Reiter, M. (2004, May 9). An Empirical Analysis of Target-Resident DoS Filters. Retrieved September 21, 2026, from https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/.
@techreport{collins_2004,
author={Collins, Michael and Reiter, Michael},
title={An Empirical Analysis of Target-Resident DoS Filters},
month={May},
year={2004},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/},
note={Accessed: 2026-Sep-21}
}
Collins, Michael, and Michael Reiter. "An Empirical Analysis of Target-Resident DoS Filters." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, May 9, 2004. https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/.
M. Collins, and M. Reiter, "An Empirical Analysis of Target-Resident DoS Filters," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 9-May-2004 [Online]. Available: https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/. [Accessed: 21-Sep-2026].
Collins, Michael, and Michael Reiter. "An Empirical Analysis of Target-Resident DoS Filters." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 9 May. 2004. https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/. Accessed 21 Sep. 2026.
Collins, Michael; & Reiter, Michael. An Empirical Analysis of Target-Resident DoS Filters. Software Engineering Institute. 2004. https://www.sei.cmu.edu/library/an-empirical-analysis-of-target-resident-dos-filters/
This content was created for a conference series or symposium and does not necessarily reflect the positions and views of the Software Engineering Institute.