EAGER: Collaborative: Leveraging High-Density Internet Peering Hubs to Mitigate Large-Scale DDoS Attacks

大规模分布式拒绝服务（DDoS）攻击对关键的基于互联网的操作的可用性构成了迫在眉睫的威胁，最近的事件导致Twitter，Spotify和Reddit等一些非常受欢迎的Web服务崩溃。虽然工业界和学术界已经提出了几种对抗DDoS攻击的解决方案，但目前部署在互联网上的大多数解决方案（如流量清理）倾向于在攻击已经造成损害后，检测和缓解靠近受害者边缘网络的DDoS攻击。创建可以部署在互联网核心的早期DDoS攻击检测和缓解系统，有可能显着提高互联网的安全性和可靠性。该项目研究了基于机器学习的DDoS攻击检测和缓解解决方案，这些解决方案可以部署在互联网核心的互联网交换点（IXP）内。IXP是高密度对等网络集线器，提供自治系统（AS）用于互连的基础设施，因此能够很好地观察全球互联网流量的重要部分。该项目利用基于IXP的流量监控来开发高级流量分析和分类方法，以实现高效、自动化的DDoS攻击早期检测和缓解。研究人员的目标是首先研究防御分布式反射式拒绝服务（DRDoS）攻击的方法，这种攻击依赖于欺骗的IP流量来放大攻击者的可用带宽，然后将调查扩展到不依赖欺骗流量的容量DDoS攻击。作为该项目的一部分，研究人员的目标是与世界各地的IXP和互联网运营商开展合作，以促进对DDoS防御的研究，并增加高影响力技术转让的机会。

Large-scale distributed denial of service (DDoS) attacks pose an imminent threat to the availability of critical Internet-based operations, as demonstrated by recent incidents that brought down a number of highly popular web services such as Twitter, Spotify and Reddit. While several solutions to counter DDoS attacks have been proposed by both industry and academia, most of the solutions that are currently deployed on the Internet - such as traffic scrubbing - tend to detect and mitigate DDoS attacks close to the victim edge network, once the attack has already caused damage. Creating systems for early DDoS attack detection and mitigation that can be deployed at the core of the Internet has the potential to significantly improve Internet security and reliability. This project investigates innovative machine learning-based DDoS attack detection and mitigation solutions that can be deployed at the core of the Internet, within Internet eXchange Points (IXPs). IXPs are high-density peering hubs that provide infrastructure used by autonomous systems (ASes) to interconnect, and are therefore well positioned to observe significant fractions of global Internet traffic. The project leverages IXP-based traffic monitoring to develop advanced traffic analysis and classification methods for efficient, automated early detection and mitigation of DDoS attacks. The researchers aim to first investigate methods for defending against distributed reflective DoS (DRDoS) attacks, which rely on spoofed IP traffic to amplify the attacker's available bandwidth, and to then expand the investigation to volumetric DDoS attacks that do not rely on spoofed traffic. As part of the project, the researchers aim to develop collaborations with IXPs and Internet operators around the world, to facilitate research on DDoS defenses and increase opportunities for high-impact technology transfer.