dFence Transparent Network-based Denial of Service Mitigation.pdfVIP

dFence: Transparent Network-based Denial of Service Mitigation Ajay Mahimkar, Jasraj Dange, Vitaly Shmatikov, Harrick Vin, Yin Zhang Department of Computer Sciences, The University of Texas at Austin {mahimkar,jasraj,shmat,vin,yzhang}@ Abstract Denial of service (DoS) attacks are a growing threat to the availability of Internet services. We present dFence, a novel network-based defense system for mitigating DoS attacks. The main thesis of dFence is complete trans- parency to the existing Internet infrastructure with no software modifications at either routers, or the end hosts. dFence dynamically introduces special-purpose middle- box devices into the data paths of the hosts under attack. By intercepting both directions of IP traffic (to and from attacked hosts) and applying stateful defense policies, dFence middleboxes effectively mitigate a broad range of spoofed and unspoofed attacks. We describe the ar- chitecture of the dFence middlebox, mechanisms for on- demand introduction and removal, and DoS mitigation policies, including defenses against DoS attacks on the middlebox itself. We evaluate our prototype implemen- tation based on Intel IXP network processors. 1 Introduction Denial of service (DoS) attacks pose a significant threat to the reliability and availability of Internet services. Consequently, they are emerging as the weapon of choice for hackers, cyber-extortionists [24], and even terror- ists [26]. The widespread availability of attack tools [3] makes it relatively easy even for “script kiddies” to mount significant denial of service attacks. Our goal is to design and build a transparent network- based defense system capable of mitigating a broad range of large-scale, distributed denial of service attacks di- rectly inside the network, without requiring software modification at either routers, or end hosts. Such a sys- tem can be deployed by Internet service providers (ISPs) in today’s Internet, providing on-demand protection to customers, including