Abstract
The nature of the threats posed by Distributed Denial of Service (DDoS) attacks on large networks, such as the Internet, demands effective detection and response methods. These methods must be deployed not only at the edge but also at the core of the network. The DDoS Tolerant Networks technology incorporates methods to detect, characterize, and respond to DDoS attacks by computing entropy and frequency-sorted distributions of selected packet attributes. Preliminary results indicate that these methods can be effective against current attacks and suggest directions for improving detection of more stealthy attacks.