Wire-speed DDoS Attack Mitigation using Hardware Acceleration of Programmable DPUs
Stefano Hinic, Rana Abu Bakar, Andrea Marotta, Francesco Paolucci · 2024
Service providers face significant challenges from Distributed Denial of Service (DDoS) attacks since existing mitigation techniques, including various Machine Learning and flow-based approaches, often lack efficiency due to high latency and inadequate filtering. This paper proposes a novel DDoS mitigation strategy using programmable Data Processing Units (DPUs) to offload detection and mitigation processes, utilizing hardware acceleration. Our approach leverages DPUs to execute flow-based filtering, focusing on mitigating TCP SYN flood attacks. We demonstrate that our DPU-based hardware-accelerated framework successfully eliminates, after a fast learning phase, all the malicious traffic while maintaining high data throughput up to 100 Gbps.