Collaborative Research: DefCOM: Distributed Defense Against DDoS Attacks

协作研究：DefCOM-分布式防御DDoS Jelena Mirkovic，特拉华州大学Peter Reiher，UCLA奖0430228摘要本项目调查分布式拒绝服务攻击问题的分布式协作解决方案。建议的防御系统DefCOM结合了受害者端防御(准确的攻击检测)和源端防御(高效响应和将合法流量与攻击流量精确分离)的优势。它还利用骨干路由器的帮助来控制部分部署场景中的攻击流量，其中许多潜在的来源没有部署源端防御。DefCOM节点将部署在源网络、受害者网络和核心网络中，并将通过覆盖协作来检测和阻止攻击。覆盖通信将确保有效运行，即使DefCOM节点是分散和非连续部署的。DefCOM对攻击的响应有两个方面：防御节点减少攻击流量，释放受害者的资源；它们还合作检测可疑数据流中的合法流量，并确保将其正确传输到受害者。由于部署防御节点的网络直接受益于它们的运营，DefCOM有一个可行的经济模式来刺激其部署。DefCOM进一步为现有安全系统提供了一个框架，以加入覆盖并在防御中进行合作。这些功能为广泛部署创造了极好的动力，并有可能对DDoS威胁产生重大影响。

Collaborative Research: DefCOM - Distributed Defense against DDoS Jelena Mirkovic, University of DelawarePeter Reiher, UCLAAward 0430228AbstractThis project investigates a distributed cooperative solution to the problem of distributed denial-of-service attacks. The proposed defense system, DefCOM, combines the advantages of victim-end defenses (accurate attack detection) and source-end defenses (efficient response and precise separation of the legitimate traffic from the attack traffic). It also enlists the help of backbone routers to control attack traffic in partial deployment scenarios where many potential sources do not deploy a source-end defense.DefCOM nodes will be deployed in source, victim and core networks, and will cooperate via an overlay to detect and stop attacks. Overlay communication will ensure effective operation even if DefCOM nodes are sparsely and non-contiguously deployed. DefCOM's response to attacks is twofold: defense nodes reduce the attack traffic, freeing the victim's resources; and they also cooperate to detect legitimate traffic within the suspicious stream and ensure its correct delivery to the victim. Because networks deploying defense nodes directly benefit from their operation, DefCOM has a workable economic model to spur its deployment. DefCOM further offers a framework for existing security systems to join the overlay and cooperate in the defense. These features create excellent motivation for wide deployment, and the possibility of a large impact on the DDoS threat.