PRIMED

Abstract

Most existing distributed denial-of-service (DDoS) mitigation proposals are reactive in nature, i.e., they are deployed to limit the damage caused by attacks after they are detected. In contrast, we present PRIMED, a proactive approach to DDoS mitigation that allows users to specify to their ISP a priori their (dis)interest in receiving traffic from particular network entities. Our solution employs communities of interest (COIs) to capture the collective past behavior of remote network entities and uses them to predict future behavior. Specifically, ISPs construct a network-wide bad COI that contains network entities who exhibited unwanted behavior in the past, and per-customer good COIs containing remote network entities that have previously engaged in legitimate communication with the customer. Our system uses these derived sets together with customer-specific policies to proactively mitigate DDoS attacks using existing router mechanisms. Indeed, preliminary lab testing shows that our approach is deployable on modern edge router platforms without degrading packet forwarding performance. This implies that our approach offers DDoS protection at a truly massive scale, i.e., every customer access link. Simulation results show that our approach improves protection against 91--93% of actual DDoS attacks on real customers---providing complete protection against 38--53% of such attacks---while slightly increasing vulnerability in only 5--7% of attacks.