Distributed and Predictive-Preventive Defense Against DDoS Attacks

Abstract

Distributed Denial of Service (DDoS) attacks are a perpetual threat to today's business. Existing strategies against DDoS are implemented as single-point solutions, or reactive solutions, or focus on differentiating traffic and localizing attackers. Our understanding is that no single network location can cater to the needs of a full-proof defense solution. In this paper we propose a solution based on two principles -- 'distributed defense for distributed attack' and 'need for a preventive solution over a reactive solution'. We present a system architecture for distributed and predictive-preventive defense mechanism. We also propose two algorithms for systematic placement of the defense nodes in the victim's upstream router network. We compare the performance and efficiency of the proposed algorithms through simulation results. We also present an algorithmic approach for prediction of attack to determine the potential attackers as well as the time-to-saturation of victim. We present experimental evaluation to show the effectiveness of the proposed approach.