An effective network flow prioritization approach in DDoS scenarios

Abstract

In the modern Internet, Distributed Denial-of-Service (DDoS) has been a constant threat to all web services. An attacker may send a flood of requests with a botnet to the victim system, so that the system will waste all resources processing the huge number of unnecessary requests generated by an attacker and will not be available to any normal user. To mitigate DDoS attacks, it is crucial for a defense mechanism to have a policy that can discriminate legitimate network flows from the malicious ones. Such a fairness policy will help prioritizing the legitimate flows and prevent the system from DDoS attacks. In this thesis, we present and compare the effectiveness of four different fairness policies using data collected from real-world DDoS scenarios on a commercial web server. Unlike previous prioritization schemes, our policies study the characteristics of the network flows and are proved to be effective.