Abstract
Defences against Denial and Distributed Denial of Service (DDoS) attacks commonly responds to flooding by dropping excess traffic. Such rate limiting schemes drop all excess-traffic when the request arrival rate goes above a certain empirically calculated threshold. Flooding based DoS/DDoS attacks like TCP SYN Attack does not exhibit any special signature except that their arrival-rate is high enough to overwhelm the victim. Hence it is very difficult to differentiate between legitimate and attack traffic as they share the same signature. As a result, rate limiting schemes cause heavy collateral damage by dropping out legitimate traffic [15]. In this paper we propose a novel packet marking mechanism which not only mitigates DoS/DDoS attacks by filtering but also reduces collateral damage significantly by selectively dropping attack packets based on its packet mark while allowing the legitimate traffic to be processed smoothly. Our packet mark contains fingerprint of the path in each single packet which allows us in identifying attack packets coming from various sources even in case of IP spoofing. Our scheme does not require any protocol specific knowledge and can generically filter out attack packets for all kinds of flooding attacks. We have extensively evaluated our packet marking scheme. Results show effectiveness of our scheme in filtering attack traffic. Our scheme inflicts extremely low collateral damage to legitimate traffic while quickly detecting and selectively filtering attack traffic.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.