A Framework for a Collaborative DDoS Defense

Abstract

Increasing use of the Internet for critical services makes flooding distributed denial-of-service (DDoS) a top security threat. A distributed nature of DDoS suggests that a distributed mechanism is necessary for a successful defense. Three main DDoS defense functionalities -attack detection, rate limiting and traffic differentiation -are most effective when performed at the victim-end, core and sourceend respectively. Many existing systems are successful in one aspect of defense, but none offers a comprehensive solution and none has seen a wide deployment. We propose to harvest the strengths of existing defenses by organizing them into a collaborative overlay, called DefCOM, and augmenting them with communication and collaboration functionalities. Nodes collaborate during the attack to spread alerts and protect legitimate traffic, while rate limiting the attack. DefCOM can accommodate existing defenses, provide synergistic response to attacks and naturally lead to an Internet-wide response to DDoS threat.

A Denial-of-Service Resistant DHT

“…Internet Indirection Infrastructure (i3) [9] also uses the Chord overlay to protect applications from direct DoS attacks. Other DoS limiting overlay network architectures have been explored in, e.g., [15,23]. Most of the approaches above use traffic analysis or indirection approaches to make DoS attacks hard, but none of these would be able to survive the attackers considered in this paper since they essentially rely on the ability to protect servers from direct hits of adversarial traffic.…”

A Hybrid Defense Technique for ISP Against the Distributed Denial of Service Attacks

“…Oikonomou et al developed the overlay concept of defense mechanism, proposing DefCOM [35]. The authors present a defense system that is both collaborative and deployed widely by combining the advantages of end-to-end approaches, core defenses, and heterogeneous network systems.…”

“…To defend against these botnet attacks, two kinds of defense mechanism have been proposed according to the areas that they protect: the network-based and the application-based defense mechanism. The former approach consists mainly of three technical methods: congestion control [33] [34], network configuration [22] [35], and signature filters [16] [18] [36]. On the other hand, the types of application-based defense mechanisms are much more numerous: client-puzzle [37], IRC-based [23], anomaly-based [10] [27], DNS tracking [25], and attack traffic suppression [24].…”

“…The network configuration-based defense mechanism originated in methods that enhance the network availability by adding more network facilities or reconfiguring the logical network boundaries [22] [35]. Secure Overlay Service (SOS) [22] uses an overlay network to provide the server with good protection.…”

A Dynamic Recursive Unified Internet Design (DRUID)

“…The dynamic decisions of the recursive traversal of the translation table graph, as well as the persistent state, help DRUID to be more adaptive and context dependent, so that various protections and compensation can be added as needed, delaying the cost of expensive mechanisms until they are of real benefit. For example, certain types of DDoS protection [37,41] require adding marks to packets and checking for those marks at various points in the network. DRUID's ability to add and remove blocks dynamically would permit inserting and removing the necessary blocks at the appropriate locations only when DDoS defense was actually required, rather than at all times.…”