Can We Beat DDoS Attacks in Clouds?

TLDR

Cloud computing dominates modern infrastructure, yet DDoS attacks exploit resource competition, and while clouds’ abundant, dynamically allocatable resources promise mitigation, individual cloud‑hosted servers remain vulnerable when run traditionally. The study proposes a dynamic resource allocation strategy to counter DDoS attacks against individual cloud customers. The strategy uses idle cloud resources to clone intrusion‑prevention servers during an attack and employs a queue‑theory‑based mathematical model to estimate required resource investment. System analysis and real‑world experiments show that the proposed approach can defeat DDoS attacks in a cloud environment.

Abstract

Cloud is becoming a dominant computing platform. Naturally, a question that arises is whether we can beat notorious DDoS attacks in a cloud environment. Researchers have demonstrated that the essential issue of DDoS attack and defense is resource competition between defenders and attackers. A cloud usually possesses profound resources and has full control and dynamic allocation capability of its resources. Therefore, cloud offers us the potential to overcome DDoS attacks. However, individual cloud hosted servers are still vulnerable to DDoS attacks if they still run in the traditional way. In this paper, we propose a dynamic resource allocation strategy to counter DDoS attacks against individual cloud customers. When a DDoS attack occurs, we employ the idle resources of the cloud to clone sufficient intrusion prevention servers for the victim in order to quickly filter out attack packets and guarantee the quality of the service for benign users simultaneously. We establish a mathematical model to approximate the needs of our resource investment based on queueing theory. Through careful system analysis and real-world data set experiments, we conclude that we can defeat DDoS attacks in a cloud environment.