ALPi: A DDoS defense system for high-speed networks

Paulo E. Ayres, Huizhong Sun, H. Jonathan Chao, Wing Cheong Lau

Research output: Contribution to journalArticle

Abstract

Distributed denial-of-service (DDoS) attacks pose a significant threat to the Internet. Most solutions proposed to-date face scalability problems as the size and speed of the network increase, with no widespread DDoS solution deployed in the industry. PacketScore has been proposed as a proactive DDoS defense scheme, which detects DDoS attacks, differentiates attack packets from legitimate ones with the use of packet scoring (where the score of a packet is calculated based on attribute values it possesses), and discards packets whose scores are lower than a dynamic threshold. In this paper, we propose ALPi, a new scheme which extends the packet scoring concept with reduced implementation complexity and enhanced performance. More specifically, a leaky-bucket overflow control scheme simplifies the score computation, and facilitates high-speed implementation. An attribute-value-variation scoring scheme analyzes the deviations of the current traffic attribute values, and increases the accuracy of detecting and differentiating attacks. An enhanced control-theoretic packet discarding method allows both schemes to be more adaptive to challenging attacks such as those with ever-changing signatures and intensities. When combined together, the proposed extensions not only greatly reduce the memory requirement and implementation complexity but also substantially improve the accuracies in attack detection and packet differentiation. This makes ALPi an attractive DDoS defense system amenable for high-speed hardware implementation.

Original languageEnglish (US)
Article number1705618
Pages (from-to)1864-1875
Number of pages12
JournalIEEE Journal on Selected Areas in Communications
Volume24
Issue number10
DOIs
StatePublished - Oct 2006

Keywords

  • Denial-of-service (DoS) attack
  • Network security
  • Overload control
  • Packet differentiation

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'ALPi: A DDoS defense system for high-speed networks'. Together they form a unique fingerprint.

  • Cite this