Optimal control of DDoS defense with multi-resource max-min fairness

Distributed defense of DDoS (Distributed Denial of Service) attack has been extensively researched in recent years and control-based defense is a hopeful way. However, existed methods only deal with bandwidth protection. The paper takes defense of DDoS flood as a kind of Processing and Bandwidth Res...

Full description

Saved in:
Bibliographic Details
Published in2008 IEEE Conference on Cybernetics and Intelligent Systems pp. 1285 - 1293
Main Authors Wei Wei, Yabo Dong, Dongming Lu, Guang jin
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.09.2008
Subjects
Bandwidth
Computer crime
Control theory
DDoS
Feedback
Filtering
Filters
Floods
max-min fairness
Optimal control
Protection
Resource management
Online AccessGet full text

Cover

More Information
Summary:Distributed defense of DDoS (Distributed Denial of Service) attack has been extensively researched in recent years and control-based defense is a hopeful way. However, existed methods only deal with bandwidth protection. The paper takes defense of DDoS flood as a kind of Processing and Bandwidth Resources allocation and solves it using control theory. Our defense mechanism FFDRF (Feedback Filtering with Dual-Resource Fairness) sets up filters in edge routers of AS and adjusts the filtering thresholds through feedback between these routers and the victim. The simulation results show that FFDRF can make the legitimate traffic keep high survival rate while is stable and converges quickly even in case of heterogeneous flow sources and link conditions. Compared with level-k max-min fairness defense, FFDRF is more effective against CPU-consuming flood. And an implementation of FFDRF in a linux router indicates that FFDRF is feasible in real-life routers.
ISBN:1424416736
9781424416738
ISSN:2326-8123
DOI:10.1109/ICCIS.2008.4670732