A New Mitigation Method against DRDoS Attacks Using a Snort UDP Module in Low-Specification Fog Computing Environments

Abstract

Current cloud computing expects to face huge traffic costs, data loads, and high latency due to the explosion of data from devices as the IoT and 5G technology evolve. Fog computing has emerged to overcome these issues. It deploys small fog servers at the edge of the network to process critical data in real time while sending the remaining secondary tasks to the central cloud, instead of sending massive amounts of data to the cloud. With the rise in fog computing, among traditional security threats, distributed denial-of-service (DDoS) attacks have become the major threat to availability. This is especially true for fog computing, where real-time processing is critical; there are many fog servers, and the processing power is relatively low. Distributed reflection denial-of-service (DRDoS), one of the frequently used DDoS attack techniques, is an amplification attack that can be used on a small or large scale. It is widely used in attack tools due to its easy configuration. This study analyzes the characteristics of fog computing, the characteristics of DRDoS attacks, and the advantages and disadvantages of existing countermeasures. Based on these analyses, this study proposes a model that could effectively mitigate attacks even on low-specification fog servers by combining a modified Snort module with reduced functionality, simple pattern matching, and filtering distribution using Anycast. This mitigation algorithm has a simple structure rather than a complex filtering structure. To achieve this goal, this study virtually implemented the corresponding fog IoT environment. In spite of its simple structure, it proved that the fog server could secure availability even under DRDoS attacks by implementing and validating the mitigation model.