MOTAG: Moving Target Defense against Internet Denial of Service Attacks

TLDR

Distributed Denial of Service (DDoS) attacks remain a significant threat to critical infrastructure and Internet services. The paper proposes MOTAG, a moving target defense that secures service access for authenticated clients against flooding DDoS attacks. MOTAG employs dynamic packet‑indirection proxies and a greedy shuffling algorithm to relay traffic and minimize proxy reallocations, with simulations evaluating its effectiveness across service scales. MOTAG effectively blocks external DDoS attacks, forces attackers to rely on insider collusion, and isolates insider threats by continuously relocating secret proxies and shuffling client assignments.

Abstract

Distributed Denial of Service (DDoS) attacks still pose a significant threat to critical infrastructure and Internet services alike. In this paper, we propose MOTAG, a moving target defense mechanism that secures service access for authenticated clients against flooding DDoS attacks. MOTAG employs a group of dynamic packet indirection proxies to relay data traffic between legitimate clients and the protected servers. Our design can effectively inhibit external attackers' attempts to directly bombard the network infrastructure. As a result, attackers will have to collude with malicious insiders in locating secret proxies and then initiating attacks. However, MOTAG can isolate insider attacks from innocent clients by continuously "moving" secret proxies to new network locations while shuffling client-to-proxy assignments. We develop a greedy shuffling algorithm to minimize the number of proxy re- allocations (shuffles) while maximizing attack isolation. Simulations are used to investigate MOTAG's effectiveness on protecting services of different scales against intensified DDoS attacks.