Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control

Zhuotao Liu, Hao Jin, Yih Chun Hu, Michael Bailey

Research output: Contribution to journalArticle

Abstract

Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common distributed denial-of-service (DDoS) attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed, and large-scale simulations.

Original languageEnglish (US)
Article number8418343
Pages (from-to)1948-1961
Number of pages14
JournalIEEE/ACM Transactions on Networking
Volume26
Issue number4
DOIs
StatePublished - Aug 2018

Fingerprint

Traffic control
Internet
Testbeds
Computer hardware
Industry
Feedback
Bandwidth
Denial-of-service attack

Keywords

  • Network security
  • internet technology
  • middle-boxes

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Cite this

Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control. / Liu, Zhuotao; Jin, Hao; Hu, Yih Chun; Bailey, Michael.

In: IEEE/ACM Transactions on Networking, Vol. 26, No. 4, 8418343, 08.2018, p. 1948-1961.

Research output: Contribution to journalArticle

@article{c617da479c9f48168385a293667bc0e8,
title = "Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control",
abstract = "Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common distributed denial-of-service (DDoS) attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed, and large-scale simulations.",
keywords = "Network security, internet technology, middle-boxes",
author = "Zhuotao Liu and Hao Jin and Hu, {Yih Chun} and Michael Bailey",
year = "2018",
month = "8",
doi = "10.1109/TNET.2018.2854795",
language = "English (US)",
volume = "26",
pages = "1948--1961",
journal = "IEEE/ACM Transactions on Networking",
issn = "1063-6692",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
number = "4",

}

TY - JOUR

T1 - Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control

AU - Liu, Zhuotao

AU - Jin, Hao

AU - Hu, Yih Chun

AU - Bailey, Michael

PY - 2018/8

Y1 - 2018/8

N2 - Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common distributed denial-of-service (DDoS) attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed, and large-scale simulations.

AB - Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common distributed denial-of-service (DDoS) attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed, and large-scale simulations.

KW - Network security

KW - internet technology

KW - middle-boxes

UR - http://www.scopus.com/inward/record.url?scp=85050387736&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85050387736&partnerID=8YFLogxK

U2 - 10.1109/TNET.2018.2854795

DO - 10.1109/TNET.2018.2854795

M3 - Article

AN - SCOPUS:85050387736

VL - 26

SP - 1948

EP - 1961

JO - IEEE/ACM Transactions on Networking

JF - IEEE/ACM Transactions on Networking

SN - 1063-6692

IS - 4

M1 - 8418343

ER -