An efficient filter for denial-of-service bandwidth attacks

In this paper, we present an efficient method for detecting and filtering denial-of-service bandwidth attacks. Our system called TOPS (tabulated online packet statistics) can monitor a large number of network addresses in a compact, fixed-size structure using several effective heuristics. We demonstrate that TOPS can detect bandwidth attacks in a standard benchmark dataset with a high accuracy and a low false alarm rate. A key benefit of TOPS is that it uses few computational resources and does not slow down during an attack.