1. Source Router Approach to DDoS Defense Jelena Mirković and Peter Reiher UCLA USENIX Work-In Progress Session Washington DC, 08/17/2001 {sunshine, reiher}@cs.ucla.edu

2. Approach Overview  Goal: Prevent our site from participating in DDoS attack  Monitor incoming and outgoing traffic looking for signs that some destination is in trouble  Reduce traffic to that destination  Separate attacking from normal flows  Shut down attacking machines

3. Approach Overview A B C D E F G I J H

4. A B C D E F G I J H

5. A B C D E F G I J H

6. A B C D E F G I J H

7. A B C D E F G I J H

8.  For every destination address router keeps lightweight statistics (number of packets/bytes, timing).  The statistics are used along with built-in models to characterize “normal” traffic.

9. Approach Overview  Router periodically matches the model with current packet statistics: Discrepancy > threshold  router throttles all traffic to that destination and extends monitoring to separate good from bed flows.

10. Approach Overview  Attacking flows should stand out from legitimate flows by the number and frequency of packets in them.  Once attacking flows are identified measures can be taken to track and shut down the attacking machines.

11. Related Work - MULTOPS  Yes, it is similar to MULTOPS, but:  It is located on source side only  Traffic models do not rely only on packet ratio  Discovery of attacking machines  Can be pushed further in the network

12. time Stable Packet Ratio in Mixed Traffic packet ratio

13. time packet ratio Stable Packet Ratio in TCP Traffic

14. time packet ratio Stable Packet Ratio in UDP Traffic

15. time packet ratio Stable Packet Ratio in UDP Traffic

16. time packet ratio Variable Packet Ratio in Mixed Traffic

17. DDoS + FTP FTP DDoS time packet ratio Variable Packet Ratio in Attack Traffic

18. Challenges  Router performance.  Why would ISP implement this?  False positives.  Multicast traffic is usually unidirectional.  Asymmetric routes.  Throttling and TCP congestion control mechanism.  Traffic patterns in the Internet change drastically over time.

19. For More Info... http://fmg-www.cs.ucla.edu/ddos