CoFence: A collaborative DDoS defence using network function virtualization

Abstract

With the exponential growth of the Internet use, the impact of cyber attacks are growing rapidly. Distributed Denial of Service (DDoS) attacks are the most common but damaging type of cyber attacks. Among them SYN Flood attack is the most common type. Existing DDoS defense strategies are encountering obstacles due to their high cost and low flexibility. The emerging of Network Function Virtualization (NFV) technology introduces new opportunities for low-cost and flexible DDoS defense solutions. In this work, we propose CoFence — a DDoS defense mechanism which facilitates a collaboration framework among NFV-based peer domain networks. CoFence allows domain networks help each others handle large volumes of DDoS attacks through resource sharing. Specifically, we focus on the resource allocation problem in the collaboration framework. Through CoFence a domain network decides the amount of resource to share with other peers based on a reciprocal-based utility function. Our simulation results demonstrate the designed resource allocation system is effective, incentive compatible, fair, and reciprocal.