APFS: Adaptive Probabilistic Filter Scheduling against distributed denial-of-service attacks

Dongwon Seo, Heejo Lee, Adrian Perrig

    Research output: Contribution to journalArticlepeer-review

    23 Citations (Scopus)

    Abstract

    Distributed denial-of-service (DDoS) attacks are considered to be among the most crucial security challenges in current networks because they significantly disrupt the availability of a service by consuming extreme amount of resource and/or by creating link congestions. One type of countermeasure against DDoS attacks is a filter-based approach where filter-based intermediate routers within the network coordinate with each other to filter undesired flows. The key to success for this approach is effective filter propagation and management techniques. However, existing filter-based approaches do not consider effective filter propagation and management. In this paper, we define three necessary properties for a viable DDoS solution: how to practically propagate filters, how to place filters to effective filter routers, and how to manage filters to maximize the efficacy of the defense. We propose a novel mechanism, called Adaptive Probabilistic Filter Scheduling (APFS), that effectively defends against DDoS attacks and also satisfies the three necessary properties. In APFS, a filter router adaptively calculates its own marking probability based on three factors: 1) hop count from a sender, 2) the filter router's resource availability, and 3) the filter router's link degree. That is, a filter router that is closer to attackers, has more available resources, or has more connections to neighbors inserts its marking with a higher probability. These three factors lead a victim to receive more markings from more effective filter routers, and thus, filters are quickly distributed to effective filter routers. Moreover, each filter router manages multiple filters using a filter scheduling policy that allows it to selectively keep the most effective filters depending on attack situations. Experimental results show that APFS has a faster filter propagation and a higher attack blocking ratio than existing approaches that use fixed marking probability. In addition, APFS has a 44% higher defense effectiveness than existing filter-based approaches that do not use a filter scheduling policy.

    Original languageEnglish
    Pages (from-to)366-385
    Number of pages20
    JournalComputers and Security
    Volume39
    Issue numberPART B
    DOIs
    Publication statusPublished - 2013

    Keywords

    • Adaptive packet marking
    • DDoS attack defense
    • Filter propagation
    • Filter scheduling
    • Filter-based defense

    ASJC Scopus subject areas

    • Computer Science(all)
    • Law

    Fingerprint

    Dive into the research topics of 'APFS: Adaptive Probabilistic Filter Scheduling against distributed denial-of-service attacks'. Together they form a unique fingerprint.

    Cite this