Poster: In-switch Defense against DNS Amplification DDoS Attacks
Seyed Mohammad Hadi Mirsadeghi · 2024
Amplification Distributed Denial of Service (DDoS) attacks continue to be a high-impact force in the cybersecurity landscape. Programmable switching paves the way for revisiting the measurement of traffic integrity, offering a new opportunity to devise independent defense mechanisms against amplification traffic. A novel method capable of defending against DNS amplification distributed denial-of-service cyberattacks has been developed. The technique enables a programmable switch to independently drop up to 89% of untrusted DNS traffic. The coupling of programmable switching and sequence analysis to detect and drop amplification traffic at line rate appears to be both innovative and practical. A significant aspect of the methodology is that amplification traffic detection and prevention is accomplished in linear time. Another important advantage of this method is the suitability for applications of game theory as utility function. The contributions of this work can be summarized as follows: We present an intermediary algorithm that enables profile-agnostic defense against amplification traffic. The sequence analysis algorithm relies on parts of the packet payload to detect untrusted traffic at line rate. Furthermore, we gauge the potential benefit of in-switch sequence analysis that presents a fundamental step in the direction of more complex applications towards game theoretic trust.