DS-0777

FRGP_SSDP_Reflection_DDoS_Attack_Traffic_anon-20140930

Dataset

University of Southern California-Information Sciences Institute

University of Southern California-Information Sciences Institute

09/30/2014

09/30/2014

20 (lowest rank is 56)

Traffic Flow Data

traffic flow data, denial of service

Quasi-Restricted

true

Data Use Terms

Short Description
SSDP reflection attack

Long Description
About 3 hours of DDoS attack traffic to a victim in the form of Argus flows. Most of the attack traffic is UDP Simple Service Discovery Protocol (SSDP) traffic. The traffic also includes ICMP and other UDP protocols traffic. The IP addresses are fully anonymized using a prefix-preserving algorithm. The flows are on a 10Gb/s link between a regional and a content ISP. These attacks are triggered by the attackers via UPnP/SSDP discovery requests with spoofed source IP addresses to vulnerable hosts running SSDP.

5.0GB

true

false

ssdp, attack, institute, southern, california, sciences, reflection, traffic, ddos, 20140930, anon, frgp, 777, frgp_ssdp_reflection_ddos_attack_traffic_anon-20140930, dos, reflector, anonymized, 2014, university of southern california-information sciences institute, flows, udp, discovery, 10gb, attacks, vulnerable, protocol, victim, icmp, hours, attackers, source, form, simple, service, isp, prefix, triggered, running, spoofed, includes, preserving, hosts, traffic flow data, algorithm, regional, link, flow, upnp, protocols, requests, content, argus

DOS Reflector attack SSDP