Protecting Public-Access Sites Against Distributed Denial-of-Service Attacks
Abstract
A distributed denial-of-service (DDoS) attack can flood a victim site with malicious traffic, causing service disruption or even complete failure. Public-access sites like amazon or ebay are particularly vulnerable to such attacks, because they have no way of a priori blocking unauthorized traffic. We present Active Internet Traffic Filtering (AITF), a mechanism that protects public-access sites from highly distributed attacks by causing undesired traffic to be blocked as close as possible to its sources. We identify filters as a scarce resource and show that AITF protects a significant amount of the victim's bandwidth, while requiring from each participating router a number of filters that can be accommodated by today's routers. AITF is incrementally deployable, because it offers a substantial benefit even to the first sites that deploy it.
Cite
@article{arxiv.cs/0403042,
title = {Protecting Public-Access Sites Against Distributed Denial-of-Service Attacks},
author = {Katerina J. Argyraki and David R. Cheriton},
journal= {arXiv preprint arXiv:cs/0403042},
year = {2012}
}
Comments
Description and evaluation of a filter management protocol that reactively protects public-access sites against DDoS attacks. 12 pages long