CoDDoS: Detecting and mitigating diverse DDoS attacks with programmable switches

Over the past decades, DDoS attacks have dramatically evolved in attack scale and patterns. However, state-of-the-art DDoS defenses encounter challenges in maintaining high performance while handling large-scale network traffic. Most require rerouting traffic to a centralized collector (or analyzer), introducing additional processing latency and cost. Emerging programmable switches have become a promising means for conducting flexible DDoS defense directly on the data plane. However, due to the limited resources on each device and the lack of monitoring statistics from a network-wide perspective, these works have not provided sufficient capabilities to detect and mitigate diverse DDoS attacks. In this paper, we propose CoDDoS, a Collaborative DDoS defense system that combines device-local and network-wide monitoring information to defend against diverse DDoS attacks with programmable switches. For device-local estimation, we propose a resource-efficient sketch DBMin, to recognize suspicious DDoS attack flows from tremendous ongoing traffic. It is fully deployed on the data plane and achieves much lower memory consumption than existing approaches. We further initiate an In-band Network Telemetry mechanism to perform the network-wide measurement on suspicious flows detected by DBMin sketch. To defend against diverse DDoS attacks, CoDDoS enables a comprehensive investigation of the collected statistics and sets appropriate mitigation strategies for different DDoS attacks. The experiment results show that CoDDoS can achieve high detection accuracy for endpoint-based DDoS defense referring to F1 score/FNR/FPR metrics and effectively detect and mitigate link-based DDoS attacks.