DDoS-Resilient Scheduling to Counter Application Layer Attacks Under Imperfect Detection

TLDR

Countering Distributed Denial of Service (DDoS) attacks is becoming ever more challenging with the vast resources and techniques increasingly available to attackers. The paper addresses protocol‑compliant, non‑intrusive application‑layer DDoS attacks that use legitimate requests to overload servers, and proposes a counter‑mechanism comprising a suspicion assignment mechanism and a DDoS‑resilient scheduler, DDoS Shield. The authors characterize application‑layer resource attacks as request flooding, asymmetric, or repeated one‑shot, and introduce a continuous‑valued suspicion assignment mechanism paired with a scheduler that uses these values to decide when to serve client requests, evaluated in testbed experiments on a web application. Under an asymmetric attack that raises legitimate client response time from 0.1 s to 10 s, DDoS Shield reduces the impact of false negatives and positives, restoring performance to 0.8 s.

Abstract

Countering Distributed Denial of Service (DDoS) attacks is becoming ever more challenging with the vast resources and techniques increasingly available to attackers. In this paper, we consider sophisticated attacks that are protocol-compliant, non-intrusive, and utilize legitimate application-layer requests to overwhelm system resources. We characterize application-layer resource attacks as either request flooding, asymmetric, or repeated one-shot, on the basis of the application workload parameters that they exploit. To protect servers from these attacks, we propose a counter-mechanism that consists of a suspicion assignment mechanism and a DDoS-resilient scheduler, DDoS Shield. In contrast to prior work, our suspicion mechanism assigns a continuous valued vs. binary measure to each client session, and the scheduler utilizes these values to determine if and when to schedule a session’s requests. Using testbed experiments on a web application, we demonstrate the potency of these resource attacks and evaluate the efficacy of our counter-mechanism. For instance, we effect an asymmetric attack which overwhelms the server resources, increasing the response time of legitimate clients from 0.1 seconds to 10 seconds. Under the same attack scenario, DDoS Shield limits the effects of false-negatives and false-positives and improves the victims’ performance to 0.8 seconds.