DDoS Defense by Offence Michael Walfish, Mithili Vutukuru, Hari Balakrishnan, David Karger, and Scott Shenker MIT CSAIL, UCB and ICSI ACM SigComm 2006

Server Capacity and Traffic  Attacker ’ s traffic : B requests/s  Good users ’ traffic : G requests/s  Server ’ s normal load : g requests/s  Server ’ s capacity: C requests/s C*G/(G+B) > g  C > g*(1+B/G)

How to Deal With Requests with Different Server Load  ‘ Time Slice ’ each request Normal: 1 slots Need database service: extra 4 slots Need parallel search: extra 2 slots … … etc  For a req that needs K time slot The user has to win the auction K times to process this req

Server Capacity Effect

Bottleneck Link Effect  Drawbacks of the protocol – 牛驥同一皁 雞棲鳳凰食 10 good nodes and 10 bad nodes ……  No bottleneck 30 nodes with bottleneck 40Mbps

Peer Heterogeneous Effect (1/2)  Peer with shorter RTT tent to have large proportion of the server

Peer Heterogeneous Effect (2/2)  Peer with larger b/w tent to have larger part of the server

Conclusion  How do I think of this paper Easy to read, nice idea Easy to combine with other schemes  Something insufficient The test scale is too small Does the assumption really holds The method may consume large b/w