Active shaping: a countermeasure against DDoS attacks

Abstract

Distributed denial of service (DDoS) attacks are a pressing problem on the Internet as demonstrated by attacks on major e-commerce servers and ISPs. Since the attack is distributed and the attack tools evolve at a rapid and alarming rate, an effective solution must be formulated using a distributed and adaptive approach. In this paper, we propose a countermeasure against DDoS attacks using a method we call active shaping. The core-enabling technology of this framework is the active network, which allows us to detect, backtrack and defend against attacks at suitable network nodes and minimize damage. We also evaluate the effectiveness of our system using a prototype.