Abstract:Despite the proliferation of traffic filtering capabilities throughout the Internet, attackers continue to launch distributed denial-of-service (DDoS) attacks to successfully overwhelm the victims with DDoS traffic. In this paper, we introduce a distributed filtering system that leverages nodes distributed along the paths of DDoS traffic to filter the DDoS traffic. In particular, we focus on adaptive distributed filtering, a new direction in filtering DDoS traffic. In our design, a subscriber to the distributed filtering service can act on behalf of a DDoS victim and generate filtering rules that not only adapt to the most suitable and effective filtering granularity (e.g., IP source address and a port number vs. an individual IP address vs. IP prefixes at different lengths), but also adapt to the preferences of the subscriber (e.g., maximum coverage of DDoS traffic vs. minimum collateral damage from dropping legitimate traffic vs. minimum number of rules). We design an efficient algorithm that can generate rules adaptive toward filtering granularities and objectives, which can further help determine where to deploy generated rules for the best efficacy. We evaluated our system through both large-scale simulations based on real-world DDoS attack traces and pilot studies. Our evaluations confirm that our algorithm can generate rules that adapt to every distinct filtering objective and achieve optimal results. We studied the success rate and distribution of rule deployment under different Internet-scale rule deployment profiles, and found a small number of autonomous systems can contribute disproportionately to the defense. Our pilot studies also show our adaptive distributed filtering system can effectively defend against real-world DDoS attack traces in real time.

A Distributed Cooperative Mechanism Of Software Based Network Security Filtering

Source Address Filtering For Large Scale Network: A Cooperative Software Mechanism Design

Implementation of Network Processor-Based Content Filtering

Multi-resource Max-Min Fairness and Support Vector Machine Based DDoS Defense

Cooperation System of Worm Detection and Quarantine in Real Time

Source address filtering in large scale network: a cooperative software mechanism design

RIFFLE: A Distributed Network Operating System with Re-configurability for Multiple Domains

Towards a Cooperative Mechanism Based Distributed Source Address Filtering

Cooperative Networking Towards Maritime Cyber Physical Systems

Adaptive Distributed Filtering of DDoS Traffic on the Internet

Control Framework for Large Networks

A Parallel Processing and Synthesis Structure for Improving Access Security and Efficiency in Sdn Environment

Empowering Computing and Networks Convergence System with Distributed Cooperative Routing

RepuFilter: Prevention of Untrusted Packet Spread Based on Trust Evaluation in Wireless Networks.

NetFence: Preventing Internet Denial of Service from Inside Out

CoFilter: A High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers

Performing software defined route-based IP spoofing filtering with SEFA

Routers with Coding and Performance Simulation

Distributed Filtering Under Constrained Bit Rate Over Wireless Sensor Networks: Dealing with Bit Rate Allocation Protocol

Policy Based Access Control Framework for Large Networks

Source address filtering for large scale networks