Hello everyone, my name is Daniel Wagner and I am
one of the authors of the paper titled
"United We Stand - Collaborative Detection and
Mitigation of Amplification DDoS Attacks at Scale".
DDoS attacks are a type of networking attack that
can cause service downtime of anything that is
hosted online, for example financial services or
the health sector and so forth. The press
keeps reporting about ever-growing amplification
DDoS attacks, so they still pose a serious threat
to the internet. An attacker sends requests
towards a set of globally distributed machines,
which will then in turn generate responses much
larger than the initial request. By spoofing the
source IP address field of the request, the
attacker can steer the reflectors responses
towards any target at will. Traditionally, in
order to mitigate such attacks, a local
scrubbing service is deployed close to the target,
where they have the consolidated and
sophisticated view about the ongoing attack and
drop all the traffic. But the traffic needs to
travel there and pollutes with unwanted packets
the infrastructures in between. So we propose
to drop the traffic early in the core of the
internet, where infrastructures like the IXPs
are located, in order to make them have the
global view some kind of collaboration is
necessary in
between of them. In order to underline the
beneficial position of the IXPs, we partnered
with 11 IXPs and assessed the difference the
distance between the reflectors origin and the
IXP. We found that more than 40% of the attack
traffic is actually originated by a direct IXP
member, strongly underlining that they have a
beneficial position within the internet topology.
We further conducted other measurements in order
to quantify the origin distribution, we quantified
the collaboration benefit for the individual IXPs,
we put emphasis on the IXPs critical role
for DDoS mitigation just by the plain position in
the internet topology. And we also in order to
enable the collaboration proposed a platform for
exchanging information about ongoing DDoS attacks
and evaluated their effectiveness. If you're
further interested in the paper, you're happily
invited to read it or attend the full talk.