Header menu link for other important links
X
Net-Police: A network patrolling service for effective mitigation of volumetric DDoS attacks
Published in Elsevier B.V.
2020
Volume: 150
   
Pages: 438 - 454
Abstract
Volumetric Distributed Denial of Service (DDoS) attacks are a significant concern for information technology-based organizations. These attacks result in significant revenue losses in terms of wastage of resources and unavailability of services at the victim (e.g., business websites, DNS servers, etc.) as well as the Internet Service Providers (ISPs) along the path of the attack. The state-of-the-art DDoS mitigation mechanisms attempt to alleviate the losses at either the victim or the ISPs, but not both. In this paper, we present Net-Police, which is a traffic patrolling system for DDoS mitigation. Net-Police identifies the sources of attack so that filters can be employed at these sources in order to quickly mitigate the attack. Such a solution effectively prevents the flow of malicious traffic across the ISP networks, thereby benefiting the ISPs also. Net-Police patrols the network by designating a small number of routers as dynamic packet taggers, to prune benign regions in the network, and localize the search to the Autonomous Systems (AS) from which the attack originates. We evaluate the proposed solution on 257 real-world topologies from the Internet Topology Zoo library and the Internet AS level topology. The paper also presents details of our hardware test-bed platform consisting of 30 routers on which network services such as Net-Police can be implemented and studied for on-field feasibility. Our experiments reveal that Net-Police performs better than the state-of-the-art cloud-based and traceback-based solutions in terms of ISP bandwidth savings and availability of the victim to legitimate clients. © 2019 Elsevier B.V.
About the journal
JournalData powered by TypesetComputer Communications
PublisherData powered by TypesetElsevier B.V.
ISSN01403664
Open AccessNo
Concepts (14)
  •  related image
    Internet protocols
  •  related image
    Internet service providers
  •  related image
    Law enforcement
  •  related image
    Network security
  •  related image
    Topology
  •  related image
    Autonomous systems
  •  related image
    DDOS DEFENSE
  •  related image
    Distributed denial of service attack
  •  related image
    INTERNET AS LEVELS
  •  related image
    Internet topologies
  •  related image
    IP TRACEBACK
  •  related image
    PACKET TAGGING
  •  related image
    PATROL ALGORITHMS
  •  related image
    Denial-of-service attack