1. DDoS Mitigation for ISP subscribers Rajaram Pejaver November 23, 2010 De-DDoS

2. November 23, 2010© Rajaram Pejaver2 Agenda An introduction to DDoS Solution Architecture Operation –Configuration and Provisioning –Mitigation Operation –Tear down Simple Questions ™ Product positioning Conclusions

3. November 23, 2010© Rajaram Pejaver3 Introduction to DDoS  History & Motivation  DDoS attack structure 

4. November 23, 2010© Rajaram Pejaver4 Architecture - 1

5. November 23, 2010© Rajaram Pejaver5 Architecture - 2

6. November 23, 2010© Rajaram Pejaver6 Configuration & Provisioning

7. November 23, 2010© Rajaram Pejaver7 Mitigation Operation - 1 What happens at the Mitigation Service? Mega service accepts ALL incoming connections.  Consists of a cluster of powerful servers, load balanced. Responds to every HTTP request with a query.  Humans can easily recognize and answer the query.  Computer programs can’t. IP addresses of correct responders are White Listed.  White Listed traffic is forwarded to subscriber via tunnel. Statistical sharing of Mitigation Service. Only a few subscribers will be under attack at any one time.  Service needs to handle only a few simultaneous attacks.  Capital costs are spread over entire subscriber base.

8. November 23, 2010© Rajaram Pejaver8 Mitigation Operation - 2

9. November 23, 2010© Rajaram Pejaver9 Tear Down Ending Mitigation Service is easy. Just restore normal routing to the subscriber’s IP address. GRE tunnel can be left up for a bit (useful if attack resumes.) Final billing and usage statistics can include: Mitigation duration, start & end times. Connections permitted through & blocked. Total packets (& bytes) permitted through & blocked. Traffic rates to subscriber, before and during mitigation. Final White List (useful if attack resumes.) Geographic distribution of blocked IP addresses.

10. November 23, 2010© Rajaram Pejaver10 Simple Questions Represents an improvement over CAPTCHA.  “Which letter follows D in the alphabet?”  E  “How much is five plus two?”  7 CAPTCHA needs: Character recognition. Simple Questions needs: Character recognition. Sentence parsing. Semantic understanding. Common sense for response. Video nuCAPTCHA increases Bot work load.

11. November 23, 2010© Rajaram Pejaver11 Product Placement Current products for DDoS infected subscribers: Constant Guard: List based infection notification. AUPM: Acceptable use traffic monitoring. Both limit damage done by infected subscribers. Proposal protects uninfected subscribers from attacks from everywhere around the world. Premium service – for a fee. Subscription or on-demand models. Product differentiator from other ISPs. Can be advertized as a “must have” for businesses.

12. November 23, 2010© Rajaram Pejaver12 Conclusions A new & unique method of DDoS Mitigation. Distinguishes between Attack & Valid traffic.  Acceptable to human users.  Very reliable; very low false positive rates. Revenue Generator. Product Differentiator. A “must have” for today. Possible patentable idea. Questions?