EAGER: Collaborative: Leveraging High-Density Internet Peering Hubs to Mitigate Large-Scale DDoS Attacks

EAGER：协作：利用高密度互联网对等中心缓解大规模 DDoS 攻击

• 批准号: 1741607
• 负责人: Maria Konte
• 金额: $ 12.02万
• 依托单位: Georgia Tech Research Corporation
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-15 至 2020-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1741607&HistoricalAwards=false
• 关键词: EAGER; Collaborative; Leveraging; Density; Internet

Large-scale distributed denial of service (DDoS) attacks pose an imminent threat to the availability of critical Internet-based operations, as demonstrated by recent incidents that brought down a number of highly popular web services such as Twitter, Spotify and Reddit. While several solutions to counter DDoS attacks have been proposed by both industry and academia, most of the solutions that are currently deployed on the Internet - such as traffic scrubbing - tend to detect and mitigate DDoS attacks close to the victim edge network, once the attack has already caused damage. Creating systems for early DDoS attack detection and mitigation that can be deployed at the core of the Internet has the potential to significantly improve Internet security and reliability. This project investigates innovative machine learning-based DDoS attack detection and mitigation solutions that can be deployed at the core of the Internet, within Internet eXchange Points (IXPs). IXPs are high-density peering hubs that provide infrastructure used by autonomous systems (ASes) to interconnect, and are therefore well positioned to observe significant fractions of global Internet traffic. The project leverages IXP-based traffic monitoring to develop advanced traffic analysis and classification methods for efficient, automated early detection and mitigation of DDoS attacks. The researchers aim to first investigate methods for defending against distributed reflective DoS (DRDoS) attacks, which rely on spoofed IP traffic to amplify the attacker's available bandwidth, and to then expand the investigation to volumetric DDoS attacks that do not rely on spoofed traffic. As part of the project, the researchers aim to develop collaborations with IXPs and Internet operators around the world, to facilitate research on DDoS defenses and increase opportunities for high-impact technology transfer.

大规模分布式拒绝服务(DDoS)攻击对基于互联网的关键操作的可用性构成了迫在眉睫的威胁，最近发生的导致Twitter、Spotify和Reddit等许多非常流行的Web服务瘫痪的事件就证明了这一点。虽然工业界和学术界已经提出了几种应对DDoS攻击的解决方案，但目前部署在互联网上的大多数解决方案(如流量清理)往往会在攻击已经造成破坏后检测并缓解靠近受害者边缘网络的DDoS攻击。创建可部署在互联网核心的早期DDoS攻击检测和缓解系统，有可能显著提高互联网的安全性和可靠性。该项目研究基于机器学习的创新DDoS攻击检测和缓解解决方案，这些解决方案可以部署在互联网的核心、互联网交换点(IXP)内。IXP是高密度对等集线器，提供自治系统(AS)用于互联的基础设施，因此能够很好地观察全球互联网流量的重要部分。该项目利用基于IXP的流量监控来开发先进的流量分析和分类方法，以实现高效、自动的早期检测和缓解DDoS攻击。研究人员的目标是首先研究防御分布式反射DoS(DrDoS)攻击的方法，这种攻击依靠欺骗的IP流量来放大攻击者的可用带宽，然后将调查范围扩大到不依赖欺骗流量的体积DDoS攻击。作为该项目的一部分，研究人员的目标是与世界各地的IXP和互联网运营商开展合作，以促进对DDoS防御的研究，并增加高影响力技术转让的机会。