A Distributed Defensive Architecture for DoS/DDoS Attacks
Subramaniam Malliga, Angamuthu Tamilarasi · Journal of Information Privacy and Security · 2008
Denial of Service (DoS) and Distributed DoS (DDoS) attacks pose a great security threat to the availability of Internet resources to users. Despite research efforts, progress in solving these flooding attacks is limited. Present techniques place the burden of detection on the violated machines. To address this situation, an integrated defense solution, implemented in a distributed manner throughout the network to prevent, detect, filter and rate limit is essential. Such a distributed system requires integration of various components to perform the aforementioned tasks. This paper advocates a distributed architecture of heterogeneous entities, placed at various points of a network working co-operatively to yield an effective defense against the attacks. Through analysis, we prove our system offers very little bandwidth to attack traffic while maximizing the bandwidth to legitimate traffic. Our system also saves significant CPU cycles by detecting and filtering the spoofed traffic at the earliest possible time. Instead of a single point of deployment, we find that this shift to a new paradigm outperforms the previously existing techniques.