MF (minority first) scheme for defeating distributed denial of service attacks

Abstract

The one of the biggest barrier that hinders Internet development is security problem caused by malicious user. In this paper, we deal with distributed denial of service (DDoS) attacks that monopolize network resource, thus result in network or system congestion. Under DDoS attack, its very difficult to provide legitimate users with their fair share of available network resource. This paper proposes MF (minority first) as a traffic metering and control scheme that can provide quick weakness of DDoS attack, while protecting legitimate user's traffic. The key idea of MF scheme is to provide good quality of service (QoS) to sources that use the network resource properly and poor QoS to sources that use network resource so excessively as to result in network congestion. MF scheme is composed of both source-traffic-trunk based metering and queue mapping mechanism for controlling malicious DDoS traffic and legitimate traffic. To show our scheme's excellence, its performance is measured and compared with that of the existing queuing services and static rate-limit through simulation.