Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches
Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Zaoxing Liu;Hun Namkung;G. Nikolaidis;Jeongkeun Lee;Changhoon Kim;Xin Jin;V. Braverman;Minlan Yu-Minlan
中科院分区：
文献类型：
--
作者：
Zaoxing Liu;Hun Namkung;G. Nikolaidis;Jeongkeun Lee;Changhoon Kim;Xin Jin;V. Braverman;Minlan Yu-Minlan
可编程交换机的出现为重新审视isp规模的DDoS攻击防御提供了新的机会。理论上，相对于专有硬件和虚拟设备，它们可以提供更好的成本、性能和灵活性权衡。然而，ISP设置在这方面带来了独特的挑战——我们需要在可编程交换机硬件上运行广泛的检测和缓解功能，并大规模响应动态自适应攻击。因此，先前使用可编程开关承担带外检测和/或仅将开关用作特定任务的加速器的努力已不再足够，因此，这种潜力仍未实现。为了应对这些挑战，我们设计并实现了Jaqen，这是一种用于批量DDoS防御的交换机原生方法，可以在交换机上完全内联地运行检测和缓解功能，而无需依赖额外的数据平面硬件。我们设计了开关优化、资源高效的检测和缓解构建模块。我们设计了一个灵活的API来构建广泛的最佳实践（和未来）防御策略，有效地使用交换机功能。我们构建了一个网络范围的资源管理器，它可以快速适应攻击姿态的变化。我们的实验表明，Jaqen的性能比现有系统高出几个数量级：Jaqen可以在几秒钟内处理大规模的混合和动态攻击，并在高线路速率（380 Gbps）下有效地缓解它们。
The emergence of programmable switches offers a new opportunity to revisit ISP-scale defenses for volumetric DDoS attacks. In theory, these can offer better cost vs. performance vs. flexibility trade-offs relative to proprietary hardware and virtual appliances. However, the ISP setting creates unique challenges in this regard—we need to run a broad spectrum of detection and mitigation functions natively on the programmable switch hardware and respond to dynamic adaptive attacks at scale. Thus, prior efforts in using programmable switches that assume out-of-band detection and/or use switches merely as accelerators for specific tasks are no longer sufficient, and as such, this potential remains unrealized. To tackle these challenges, we design and implement Jaqen, a switch-native approach for volumetric DDoS defense that can run detection and mitigation functions entirely inline on switches, without relying on additional data plane hardware. We design switch-optimized, resource-efficient detection and mitigation building blocks. We design a flexible API to construct a wide spectrum of best-practice (and future) defense strategies that efficiently use switch capabilities. We build a network-wide resource manager that quickly adapts to the attack posture changes. Our experiments show that Jaqen is orders of magnitude more performant than existing systems: Jaqen can handle large-scale hybrid and dynamic attacks within seconds, and mitigate them effectively at high line-rates (380 Gbps).