【Paper reading-DDoS】

Realtime DDoS Defense Using COTS SDN Switches via Adaptive Correlation Analysis

Abstract:

• defend against a wide range of flooding-based DDoS attacks, e.g., link flooding (including Crossfire), SYN flooding, and UDP-based amplification attacks
• unmodified commercial off-the-shelf (COTS) SDN switches(requiring neither modifications in SDN switches/protocols nor extra appliances.)
• detects attacks by identifying attack features in suspicious flows, and locates attackers (or victims) to throttle the attack traffic by adaptive correlation analysis.

Background:

• sophisticated DDoS attacks, e.g., Crossfire , Pulsing DDoS attacks , as well
  as some real-world DDoS attacks
• Natural way about using SDN to defend DDoS attack:

rely on SDN switches to collect necessary flow information and report it to the SDN controller

Capacity limitation of controller: a controller is not able to receive and analyze based on original flow counter information for all network flows from all switches. SO rely on switches to perform pre-processing on flow counter information, generate some brief statistics (e.g., changes of flow rates), and report such brief information to the controller.
THAT incurs losing important original information

By design, UDP is a connection-less protocol that does not validate source Internet Protocol (IP) addresses. Unless the application-layer protocol uses countermeasures such as session initiation in Voice over Internet Protocol, an attacker can easily forge the IP packet datagram (a basic transfer unit associated with a packet-switched network) to include an arbitrary source IP address. [1] When many UDP packets have their source IP address forged to the victim IP address, the destination server (or amplifier) responds to the victim (instead of the attacker), creating a reflected denial-of-service (DoS) attack.

• UDP-Based Amplification Attacks:

Certain commands to UDP protocols elicit responses that are much larger than the initial request. Previously, attackers were limited by the linear number of packets directly sent to the target to conduct a DoS attack; now a single packet can generate between 10 and 100 times the original bandwidth. This is called an amplification attack, and when combined with a reflective DoS attack on a large scale, using multiple amplifiers and targeting a single victim, DDoS attacks can be conducted with relative ease.
The potential effect of an amplification attack can be measured by BAF, which can be calculated as the number of UDP payload bytes that an amplifier sends to answer a request, compared to the number of UDP payload bytes of the request. [2] [3]
see more