The abnormal traffic control framework based on QoS mechanisms

Recently various hacking tools that dig out the vulnerabilities of hosts on a network are easily accessible through the Internet, and large-scale network attacks have been increased during last decades. To detect these network attacks, a variety of schemes are developed by several companies and organizations. But, many previous schemes are known to have some weakness in protecting important hosts from network attacks because of their inherent unconditional filtering mechanisms. This means that they unconditionally filter out doubtful network traffic in spite of its being normal network traffic. Therefore, to filter out only abnormal network traffic, step-by-step filtering capabilities are required. In this paper, we propose a framework for controlling abnormal network traffic. This framework is implemented through the CBQ and iptables mechanisms in Linux kernel.