Abstract:By penetrating into a large number of machines and stealthily installing malicious pieces of code, a distributed denial of service (DDoS) attack constructs a hierarchical network and uses it to launch coordinated assaults. DDoS attacks often exhaust the network bandwidth, processing capacity and information resources of victims, thus, leading to unavailability of computing systems services. Various defense mechanisms for the detection, mitigation and/or prevention of DDoS attacks have been suggested including resource redundancy, traceback of attack origins and identification of programs with suspicious behavior. Contemporary DDoS attacks employ sophisticated techniques including formation of hierarchical networks, one-way communication channels, encrypted messages, dynamic ports allocation and source address spoofing to hide the attackers' identities; such techniques make both detection and tracing of DDoS activities a challenge and render traditional DDoS defense mechanisms ineffective. In this paper, we propose the DDoS Container, a comprehensive framework that uses network-based detection methods to overcome the above complex and evasive types of attacks; the framework operates in 'inline' mode to inspect and manipulate ongoing traffic in real-time. By keeping track of connections established by both potential DDoS attacks and legitimate applications, the suggested DDoS Container carries out stateful inspection on data streams and correlates events among sessions. The framework performs stream re-assembly and dissects the resulting aggregations against protocols followed by various known DDoS attacks facilitating their identification. The traffic pattern analysis and data correlation of the framework further enhance its detection accuracy on DDoS traffic camouflaged with encryption. Actions available on identified DDoS traffic range from simple alerting to message blocking and proactive session termination. Experimentation with the prototype of our DDoS Container shows its effectiveness in classifying DDoS traffic.

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

An Inline Detection and Prevention Framework for Distributed Denial of Service Attacks

A Cross-Plane Cooperative DDoS Detection and Defense Mechanism in Software-Defined Networking.

SDN-Based Intrusion Detection System for Early Detection and Mitigation of DDoS Attacks

OverWatch: A Cross-Plane DDoS Attack Defense Framework with Collaborative Intelligence in SDN.

DDoS attack protection in the era of cloud computing and Software-Defined Networking

Combating DDoS Attack with Dynamic Detection of Anomalous Hosts in Software Defined Network

A Defense Mechanism for Distributed Denial of Service Attack in Software-Defined Networks

Efficient Distributed Denial-of-Service Attack Defense in SDN-Based Cloud

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

DDoS Detection and Protection Based on Cloud Computing Platform

DMAIDPS: a distributed multi-agent intrusion detection and prevention system for cloud IoT environments

A Novel Distributed Denial-of-Service Attack Detection Scheme for Software Defined Networking Environments.

SDNDefender: AComprehensiveDDoSDefenseMechanismUsing Hybrid Approaches over Software Defined Networking

IDPS: An Integrated Intrusion Handling Model for Cloud

FIDS: Fuzzy Intrusion Detection System for simultaneous detection of DoS/DDoS attacks in Cloud computing

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Distributed Denial of Service Defense in Software Defined Network Using OpenFlow.

Detection and Mitigation of DoS Attacks in Software Defined Networks