On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

TLDR

Denial‑of‑service attacks are a major threat to the Internet, and the effectiveness of mitigation techniques depends on the underlying power‑law topology of autonomous‑system networks. This study proposes and evaluates route‑based distributed packet filtering (DPF) as a novel method for preventing distributed DoS attacks. DPF proactively filters spoofed packet flows and, for the sparse remaining flows, uses IP traceback to localize their origin to a small, constant number of candidate sites. DPF achieves proactive filtering of a significant fraction of attack traffic, reactive traceback of sparse flows, requires deployment on fewer than 20 % of AS sites, and its performance is strongly linked to the power‑law structure of the Internet AS graph.

Abstract

Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.