Blackhat 2016

Investigating DDOS Architecture Actors and Attribution
Date: 2016-12-16
Summary:
The data collection is done through DDoS honeypots in which nodes that mimic UDP services that commonly abused to produce DDoS attacks.
They collect the timestamp, source, destination IPs and ports, attack type.