Large-Scale Edge DDoS Protection Sean Newman Director Product Management

Is DDoS Still on the increase? 500 Gbps Hong Kong attack France swarmed after terror attack PlayStation & Xbox hit at Christmas Mirai Botnet OVH / Krebs / DYN 600 Gbps -> 1Tbps Memcached GitHub 1.35-1.7Tbps Anon hits Church of Scientology Spamhaus attack: Reported to reach 310 Gbps Rio Olympics 540 Gbps Spammers discover botnets Reaper Botnet 2M Devices First Hacktivists: Zapatista National Liberation Army ProtonMail attack Estonia: Parliament, banks, media, Estonia Reform Party Coordinated US bank attacks: Grew to 200 Gbps, and continue today DoS for Notoriety 2019 ?? 1993 … 2005 2007 2009 2011 2013 2015 2016 2017 2018

DDoS Evolution in 2018 High Bandwidth Botnets Multivector memcached exceeds 1Tbps, routinely > 100Gbps Botnets Mirai (and its many known variants) IoT (100s of Millions of easy to recruit devices) Multivector 10+ vectors, Additive + Variation + Spray/Subnet Booter/Stresser Services the “10 minute” attack and pulsed attacks

Frequent DDoS Trend Continues… Frequent, low-volume, short-duration attacks dominate! 40% 7 77% 94% However… Corero H1 2018 Trend Report: https://www.corero.com/resources/reports/h1-ddos-trends-report/

SP/Telco DDoS Scrubbing Protection DDoS attacks arriving from transit/peering Good traffic destined for subscribers SP SP SP ingress from transit/peering Netflow Detect (out-of-band) Service Provider egress to subscribers DDoS victims DDoS victims

SP/Telco DDoS Scrubbing Redirect DDoS attacks arriving from transit/peering Good traffic destined for subscribers SP SP SP ingress from transit/peering BGP redirect Netflow Detect (out-of-band) note: Some Providers will have multiple scrubbing centers for Geos, redundancy, backhaul reasons. Service Provider Scrubbing Capacity (<10% edge capacity) egress to subscribers Good traffic tunneled to edge or cust Good traffic tunneled to edge or cust

SP/Telco Large DDoS Attack Blackhole Large DDoS attack from transit/peering Good traffic blocked by blackhole SP SP SP ingress from transit/peering BGP RTBH Netflow Detect (out-of-band) note: Some Providers will have multiple scrubbing centers for Geos, redundancy, backhaul reasons. Service Provider Scrubbing Capacity (<10% edge capacity) egress to subscribers Customer offline for attack Duration Customer offline for attack Duration

Scrubbing Approach Increasingly Challenged Size of Attack Blackhole Zone Provider Edge Capacity 100s of Gbps to multiple Terabits/sec Provider RTBH Mitigation Manual instantiation of blackholes with target offline for duration of attack Attacks Provider Scrubbing Capacity More attacks mitigated with Blackhole Scrubbing capacity needs to increase Partial Protection (needs to be > 10%) Scrubbing Zone Number of Attacks

Scrubbing Redirect Challenges DDoS Attacks Over Scrubbing Capacity Succeed! Flow Monitoring Aggregation delay Attack overload Header only BGP/RTBH/FlowSpec BGP propagation Limited visibility Sampled Mirror Immediate forwarding Scales with attack Header and payload ACL Filters Rapid configuration Streaming telemetry

New Opportunity for Edge Mitigation NOC/SOC Network Edge Monitor Inspect Detect Report / Signal Mitigate Sampled Mirror (1:N) Seconds Sampled Mirror (tuple + payload) Streaming Telemetry Ingress Traffic Egress Traffic Filter Generation (tuple + payload) Dynamic Filter (tuple + payload) Detection Mitigation

Full Edge Capacity Mitigation Size of Attack Blackhole Zone Provider Edge Capacity 100s of Gbps to multiple Terabits/sec <1% of attacks need to be blackholed 100% Edge Protection Provider Edge Mitigation Zone Provider Edge Mitigation Leverage real-time data and analytics to deliver intelligent automation Scales to Tens of Terabits of DDoS Protection Attacks Provider Scrubbing Capacity >90% attacks mitigated at Provider Edge <10% redirected to scrubbing Scrubbing Zone Number of Attacks

Provider Edge DDoS Protection DDoS Attacks arriving from transit/peering SP Internet SP SP ingress from transit/peering Service Provider egress to subscribers Good traffic to edge or customer Good traffic to edge or customer

Example Edge Filtering with Juniper MX Matching Firewall-type rules with defined actions Filters entered manually, or programmatically via netconf API Unique ID for each filter provides statistics via remote telemetry

Summary DDoS as a whole still on the Increase Attack Methods/Vectors more Sophisticated Emerging trend for increase in number of larger attacks Traditional Scrubbing/RTBH Protection is inadequate Typically too slow to react to avoid damage, or completes attack Wastes core network bandwidth backhauling junk DDoS traffic New Opportunity for Protection on Network Edge Devices Leverage built-in power of latest infrastructure devices No need to insert new devices at every ingress point Deliver always-on protection at edge capacity up to unprecedented scale Can operate as an overlay to existing scrubbing centers Deploy filters automatically from DDoS protection solution

Questions?

Thank You!