Dynamic DDoS Defense Resource Allocation using Network Function Virtualization
A H M Jakaria, Bahman Rashidi, Mohammad Ashiqur Rahman, Carol Fung, Yang Wei · 2017
Distributed Denial of Service (DDoS) is one of the most common but destructive kind of cyberattacks. The DDoS attack traffic vastly includes the SYN packets. To handle excessive DDoS traffic without large impact on the benign traffic, it is important to allocate sufficient resource for the defense. With the support from Network Function Virtualization (NFV) technology, this can be done in a significantly lower lower cost, with higher flexibility. In this work, we propose a DDoS defense mechanism based on Network Function Virtualization platform, which is capable to balance with the attack load. Our proposed mechanism uses dynamic network agents to intercept packets when the system experiences DDoS attack. In particular, we focus on the mechanism that deploys virtual agents dynamically according to the attack strength. The corresponding load-balancing algorithm dynamically determines the number of agents to allocate for defending the attack traffic. Our simulation results demonstrate that the mechanism can successfully defeat the DDoS attacks with different attack intensities, while it incurs minimal performance degradation on the benign traffic and keeps the increase in the server's response time sufficiently low compared to that of a successful DDoS attack.