Anti-DDoS firewall; A zero-sum mitigation game model for distributed denial of service attack using Linear programming
Emmanuel Chimuebuka Amadi, G. E. Eheduru, F. U. Eze, Charles Ikerionwu, Kennedy Chinedu Okafor · 2017
Game theory has been used over the years in areas involving competition such as marketing, auction, gambling etc. The concept of game theory has found application in security domains and is usually called security games. This paper proposes a Linear programming model for solving a game problem that involves the interaction of an attacker (zombie) and a defender (firewall) during a distributed denial of service attack (DDoS). It also presents two algorithms that are used to form the mitigation perimeter firewall against DDoS attack on web servers (Anti-DDoS firewall). In a DDoS attack scenario, the players (zombie and firewall) are competing for greater share of a resource of the network. An attack occurs when the zombies flood the link in such a way that legitimate users are denied access to a target resource on the network. This paper presents a game model solved using linear programming that provides the best strategy for the defender by reducing rogue packets that seek to flood the bandwidth of the network. Our model is validated using defined numbers in the pay-off matrix. Solving the matrix using the model approach shows that both the row and the column sum equal one. The output of the model presents probabilistic values that are related to specific actions to be taken by the defender. Two mitigation scripts where presented that makes use of maximum number of connection and sending rate to monitor traffic targeting the web port 80/443. It is clearly observed from extensive simulation on a test bed that using linear programming to model the network behavior and setting the mitigation script with the highest value of the game matrix solution, a better pay-off is obtained by the firewall.