Aggregate-Based Congestion Control for Pulse-Wave DDoS Defense
METADATA ONLY
Loading...
Author / Producer
Date
2022-08
Publication Type
Conference Paper
ETH Bibliography
yes
Citations
Altmetric
METADATA ONLY
Data
Rights / License
Abstract
Pulse-wave DDoS attacks are a new type of volumetric attack formed by short, high-rate traffic pulses. Such attacks target the Achilles' heel of state-of-The-Art DDoS defenses: Their reaction time. By continuously adapting their attack vectors, pulse-wave attacks manage to render existing defenses ineffective. In this paper, we leverage programmable switches to build an in-network DDoS defense effective against pulse-wave attacks. To do so, we revisit Aggregate-based Congestion Control (ACC): A mechanism proposed two decades ago to manage congestion events caused by high-bandwidth traffic aggregates. While ACC proved efficient in inferring and controlling DDoS attacks, it cannot keep up with the speed requirements of pulse-wave attacks. We propose ACC-Turbo, a renewed version of ACC that infers attack patterns by applying online-clustering techniques in the network and mitigates them by leveraging programmable packet scheduling. By doing so, ACC-Turbo identifies attacks at line rate and in real-Time, and rate-limits attack traffic on a per-packet basis. We fully implement ACC-Turbo in P4 and evaluate it on a wide range of attack scenarios. Our evaluation shows that ACC-Turbo autonomously identifies DDoS attack vectors in an unsupervised manner and rapidly mitigates pulse-wave DDoS attacks. We also show that ACC-Turbo runs on existing hardware (Intel Tofino).
Permanent link
Publication status
published
External links
Editor
Book title
SIGCOMM '22: Proceedings of the ACM SIGCOMM 2022 Conference
Journal / series
Volume
Pages / Article No.
693 - 706
Publisher
Association for Computing Machinery
Event
36th ACM SiGCOMM Conference (SIGCOMM 2022)
Edition / version
Methods
Software
Geographic location
Date collected
Date created
Subject
Network Security; DDoS; Pulse-Wave DDoS; ACC; Aggregate-Based Congestion Control; Programmable Scheduling; Network Defenses
Organisational unit
09477 - Vanbever, Laurent / Vanbever, Laurent
Notes
Conference lecture on August 26, 2022