Can We Beat DDoS Attacks in Clouds?

• Published in: IEEE transactions on parallel and distributed systems Vol. 25; no. 9; pp. 2245 - 2254
• Main Authors: Shui Yu, Yonghong Tian, Song Guo, Wu, Dapeng Oliver
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.09.2014; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Analytical models; Cloud computing; Computer crime; Computer networks; DDoS attacks; Denial of service attacks; Dynamics; Financing; Mathematical model; Mathematical models; mitigation; Quality of service; Queueing analysis; resource investment; Resource scheduling; Servers; system modelling
• DOI: 10.1109/TPDS.2013.181
• ISSN: 1045-9219

Cloud is becoming a dominant computing platform. Naturally, a question that arises is whether we can beat notorious DDoS attacks in a cloud environment. Researchers have demonstrated that the essential issue of DDoS attack and defense is resource competition between defenders and attackers. A cloud usually possesses profound resources and has full control and dynamic allocation capability of its resources. Therefore, cloud offers us the potential to overcome DDoS attacks. However, individual cloud hosted servers are still vulnerable to DDoS attacks if they still run in the traditional way. In this paper, we propose a dynamic resource allocation strategy to counter DDoS attacks against individual cloud customers. When a DDoS attack occurs, we employ the idle resources of the cloud to clone sufficient intrusion prevention servers for the victim in order to quickly filter out attack packets and guarantee the quality of the service for benign users simultaneously. We establish a mathematical model to approximate the needs of our resource investment based on queueing theory. Through careful system analysis and real-world data set experiments, we conclude that we can defeat DDoS attacks in a cloud environment.