Analyzing effective mitigation of DDoS attack with software defined networking

Abstract

Distributed Denial of Service (DDoS) attack prevention research is mostly focused upon attack detection. Early attack detection facilitates the network administrator to quickly manage these attacks with least impact on the legitimate users. The approach generally used to manage/mitigate the DDoS attacks is to start dropping the attack/suspicious flows at the location of detection, which affects the communication of legitimate users of the network as well. This paper is focused on comparing the DDoS attack mitigation approaches, as well as, the location of mitigation in the network that will impose the least impact on the legitimate users in the network, resulting in least network performance degradation. A mathematical analysis of packet filtering, rate limiting and controller/server migration techniques for mitigation of DDoS attacks is done, followed by Mininet implementation with realistic traffic. It provides a detailed insight of the pros and cons of respective techniques w.r.t. various network requirements. Further, the identification of appropriate location to deploy desired mitigation technique is done.