DDoS Response: Part 2

In my post “DDoS Response: Part 1,” I started an analysis on combating distributed-denial-of-service attacks. In this post, Part 2, I shall examine solutions for private networks.

To proactively prevent attacks on private networks, one solution is to hide the legitimate paths from attackers and to periodically change the topology of the network. Source-address filtering, secret proxy servers (servlets), and virtual overlay network (with Secure Overlay Access Points, SOAPs) are helpful in a reconfiguration scheme:

Any transmissions that wish to pass the overlay must first be validated at entry points of the overlay (SOAP machines). Only confirmed users can access the network. If the attacker discovers the address of the filtering router in front of the client, a brute force attack is still possible.

Another solution for protecting a private network is to use a cryptographic process such as “client puzzle.” This method requires a client to sacrifice some of its resources to prove that it is legitimate. Basically, when a server comes under attack, it distributes small cryptographic puzzles to clients making service requests. To complete the request, the client must solve the puzzle correctly:

Other solutions filter and mitigate DDoS traffic. In resource replication (for example, XenoService), the victim or the network responds to DDoS attacks by producing replicas of the resources in demand. Legitimacy testing (NetBouncer) can distinguish legitimate from illegitimate traffic. Using containment, ISPs can employ honeypots to trap malicious code, which can then be studied and blocked.

For these posts, I consulted various white papers and thesis reports. The most significant is an impressive (204 pages) August 2008 Ph.D. thesis submitted to Imperial College London by Dr. Vrizlynn Thing Ling Ling.

I extracted the following table to summarize the usefulness of the responses I have already described:

At McAfee, equipment in the McAfee Network Security Platform series can help customers in this fight.

McAfee’s NSP (formerly IntruShield) sensors can detect DDoS attacks by learning the network’s “normal” traffic behaviors and detecting attacks based on deviations from these normal behaviors, including packet counts and rates for various types of packets such as ICMP, TCP SYN, UDP, IP fragments, etc. Details are available in the two McAfee white papers listed below.

Other useful documents:

• A video (in French) on DDoS mitigation (Orange group)
• IP Traceback: A New DOS Deterrent? (IEEE Security & Privacy)
• Secure Overlay Services (Auburn University)
• A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms (University of California)
• Pushback: Remedy for DDoS attack (San Jose State University)
• Deciphering Detection Techniques: Anomaly-Based Intrusion Detection (McAfee)
• Deciphering Detection Techniques: Denial of Service Detection (McAfee)