DDoS defense by offense

Michael Walfish, Mythili Vutukuru, Hari Balakrishnan, David Karger, Scott Shenker

Research output: Contribution to journalArticle

Abstract

This article presents the design, implementation, analysis, and experimental evaluation of speak-up, a defense against application-level distributed denial-of-service (DDoS), in which attackers cripple a server by sending legitimate-looking requests that consume computational resources (e.g., CPU cycles, disk). With speak-up, a victimized server encourages all clients, resources permitting, to automatically send higher volumes of traffic. We suppose that attackers are already using most of their upload bandwidth so cannot react to the encouragement. Good clients, however, have spare upload bandwidth so can react to the encouragement with drastically higher volumes of traffic. The intended outcome of this traffic inflation is that the good clients crowd out the bad ones, thereby capturing a much larger fraction of the server's resources than before. We experiment under various conditions and find that speak-up causes the server to spend resources on a group of clients in rough proportion to their aggregate upload bandwidths, which is the intended result.

Original languageEnglish (US)
Article number3
JournalACM Transactions on Computer Systems
Volume28
Issue number1
DOIs
StatePublished - Mar 1 2010

Keywords

  • Bandwidth
  • Currency
  • DoS attack

ASJC Scopus subject areas

  • Computer Science(all)

Fingerprint Dive into the research topics of 'DDoS defense by offense'. Together they form a unique fingerprint.

  • Cite this

    Walfish, M., Vutukuru, M., Balakrishnan, H., Karger, D., & Shenker, S. (2010). DDoS defense by offense. ACM Transactions on Computer Systems, 28(1), [3]. https://doi.org/10.1145/1731060.1731063