Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control

Zhuotao Liu, Hao Jin, Yih Chun Hu, Michael Bailey

Research output: Contribution to journalArticlepeer-review

Abstract

Volumetric attacks, which overwhelm the bandwidth of a destination, are among the most common distributed denial-of-service (DDoS) attacks today. Despite considerable effort made by both research and industry, our recent interviews with over 100 potential DDoS victims in over 10 industry segments indicate that today's DDoS prevention is far from perfect. On one hand, few academical proposals have ever been deployed in the Internet; on the other hand, solutions offered by existing DDoS prevention vendors are not silver bullet to defend against the entire attack spectrum. Guided by such large-scale study of today's DDoS defense, in this paper, we present MiddlePolice, the first readily deployable and proactive DDoS prevention mechanism. We carefully architect MiddlePolice such that it requires no changes from both the Internet core and the network stack of clients, yielding instant deployability in the current Internet architecture. Further, relying on our novel capability feedback mechanism, MiddlePolice is able to enforce destination-driven traffic control so that it guarantees to deliver victim-desired traffic regardless of the attacker strategies. We implement a prototype of MiddlePolice and demonstrate its feasibility via extensive evaluations in the Internet, hardware testbed, and large-scale simulations.

Original languageEnglish (US)
Article number8418343
Pages (from-to)1948-1961
Number of pages14
JournalIEEE/ACM Transactions on Networking
Volume26
Issue number4
DOIs
StatePublished - Aug 2018

Keywords

  • Network security
  • internet technology
  • middle-boxes

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint

Dive into the research topics of 'Practical Proactive DDoS-Attack Mitigation via Endpoint-Driven In-Network Traffic Control'. Together they form a unique fingerprint.

Cite this