Many approaches have been proposed to handle DoS and DDoS attacks. These approaches address diverse aspects of these complex threats, such as attack prevention, detection or response. Still, there is not a common, comprehensive methodology to evaluate an impact of a DoS attack on a given network, or the performance of a given defense. Such a methodology is needed for the following reasons:

• To be able to protect systems from DDoS attacks, we need ways to characterize how dangerous the attack is, to estimate the potential damage/cost from the attack to a specific network (with or without defense).
• Given many DDoS defenses, we need a common evaluation setting to evaluate and compare the performance of these defenses. These tests will also indicate a defense's weak features that need improvement.

This page describes our project on building a common methodology for DDoS defense evaluation. The project consists of: (1) DDoS benchmarks that represent a set of scenarios to be used for defense evaluation, (2) a set of performance metrics that characterize an attack's impact and a defense's performance and (3) A set of tools we used for benchmark development, integration of benchmarks with the DETER testbed and calculation of performance metrics from tcpdump traces collected during DDoS experimentation.