EclipseFortify: Imperceptible Shuffle-Based Moving Target Defense for Budget-Friendly Web Service DDoS Protection
Lin Yan, Zan Zhou, Shujie Yang, Changqiao Xu · 2024
Distributed Denial of Service (DDoS) attacks continue to pose a significant threat to web services, making effective defense strategies crucial. However, traditional DDoS protection solutions are often expensive and may not be feasible for all organizations. To address this challenge, this paper presents EclipseFortify, a novel approach that combines the principles of Moving Target Defense (MTD) with cost-effective measures. EclipseFortify leverages the concept of reverse proxies as moving targets, employing proactive shuffling techniques to dynamically allocate valid proxies to users. By disrupting the correlation between users and reverse proxies, EclipseFortify effectively rejects attack traffic, significantly reducing the cost of defense. Furthermore, the method introduces a dynamically updated suspicious rating system to counter advanced attackers who adapt their strategies. To ensure uninterrupted service, EclipseFortify embeds scripts in reverse proxy forwarding, establishing a control link with user-side browsers. This enables seamless switching of reverse proxies without affecting users’ browsing experience. Experimental evaluations demonstrate the effectiveness of EclipseFortify in mitigating DDoS attacks while remaining imperceptible to legitimate users. A demo of EclipseFortify is available at https://hub.docker.com/r/frogsoftware/eclipse-fortify.