Description

Internet attacks, such as distributed denial-ofservice attacks and worm attacks, are increasing in severity and frequency. Identifying and mitigating realtime attacks are an important and challenging task for network administrators. An infected host can make a large number of connections to distinct destinations during a short time. Such a host is called a superpoint. Detecting superpoints can be utilized for traffic engineering and anomaly detection.