Signature-Based Traffic Classification and Mitigation for DDoS Attacks Using Programmable Network Data Planes

Abstract

Distributed Denial of Service (DDoS) mitigation typically relies on source IP-based filtering rules; these may present scaling issues due to the vast amount of involved sources. By contrast, we propose a source IP-agnostic DDoS traffic classification and filtering schema that identifies malicious packet signatures via supervised Machine Learning methods and subsequently generates signature-based filtering rules. To accelerate packet processing, our schema utilizes XDP middleboxes operating as programmable Deep Packet Inspectors. Signatures are extracted from network traffic as unique combinations of the most significant packet features; these are subsequently fed to supervised Machine Learning algorithms that classify them as malicious or benign. Malicious signatures undergo a reduction process tailored to the attack vector in order to generate a concise set of filtering rules, thus expediting mitigation performance. Our schema was implemented as a proof-of-concept and evaluated for DNS volumetric attacks in terms of signature classification accuracy and packet filtering throughput. Experiments were based on benign and malicious traffic datasets recorded in production network environments. Our approach was compared to source-based mechanisms in terms of (i) malicious traffic identification, (ii) filtering rules cardinality, and (iii) packet processing throughput required in modern high speed networks. The experimental results demonstrate that our signature-based approach outperforms IP-based alternatives, achieving high detection accuracy and significant generalization capabilities.

P4 Telemetry collector

“…Considering that the comprehensive collection of network data made available by PDP opens the door for many possible applications in the network and brings in Artificial Intelligence (AI) to the decisionmaking. Where the AI can have an important role in steering user traffic to the best serving node for lower latency and better Quality of Service (QoS) as in [10], or even provide filtering of traffic based on signatures that are generated from packet features for enhanced detection and mitigation of DDoS attacks [11].…”

The current state and future of mobile security in the light of the recent mobile security threat reports

“…It can also predict the class of an application with 97.82% accuracy. Dimolianis et al [ 13 ] have presented an integrated scheme for signature-based traffic classification processing for DDoS protection. With this signature-based scheme, it outperformed traditional IP-based schemes in terms of malicious traffic categorization, cardinality of filtering rules, and packet processing efficiency in high-speed networks.…”

A Method for DDOS Attacks Prevention Using SDN and NFV

“…The main idea in [16] is to increase resource utilization and support scalability in such a way that the control layer is physically or logically distributed hierarchically in the control layer. Dimolianis et al in [17] proposed an IP-based DDOS protection mechanism in addition to the traditional lter mechanisms that are based on IP rules and increase in proportion to the number of malicious sources.…”